I'm searching for a special Regex, that recognizes an IP Adresses after a certain string.

That's the regex for the IP


The IP follows in my log to


Which Regex do i need to just select a IP after DST= but not after SRC=

  • 2
    ...have you tried sticking DST= in the front of the IP regex? Sometimes the simplest solution is the correct one :-) – voretaq7 Oct 8 '10 at 19:02
  • yes, sure :) but i just wanna mark the ipadress not also the string dst= – user56548 Oct 8 '10 at 19:23
  • @zordache: I'm using multitail. Tried your regex but it doesn't work. – user56548 Oct 8 '10 at 19:40

the problem is it finds DST= but it should only find

It depends a lot on the tool you use. For example with sed this might give you want you want.

echo "... SRC= DST= LEN=40 ..."  | \
sed -e 's/.*DST=\([0-9]\+\.[0-9]\+\.[0-9]\+\.[0-9]\+\).*/\1/g'

See this article about regex grouping.

If you are trying to do highlighting this looks like what you may want/need. From the configuration.

# cs_re_s:<color>:<regular expression>
#             Like cs_re but only the substrings are used(!). E.g.:
#             ^....(...)...(...)
#             In the example above only what matches between '(' and ')' is
#             assigned a color. See the 'acctail' colorscheme for an example.

There is even an example that in that file close to what I believe you want. The example is cs_re_s:cyan:kernel: .*(SRC=[^ ]*) *(DST=[^ ]*) What you want which I think is to highlight anything following a DST may be cs_re_s:red:kernel: .*DST=([^ ]*).

  • it doesn't work for multitail, gives me an error in regex - invalid back reference – user56548 Oct 8 '10 at 20:01
  • Great zoredache, muchas Gracias, it works, your help is highly appreciated – user56548 Oct 8 '10 at 21:56
  • the problem is it finds DST= but it should only find i'm searching for an expression that just finds the ip after DST= – user56548 Oct 8 '10 at 19:20
  • 1
    the braces should put the ip address into $1, $2, ... – krissi Oct 8 '10 at 19:51
  • No the braces do pattern repeating. I think you mean "parentheses". – Paused until further notice. Oct 10 '10 at 0:18

It can be done with lookbehind expression.

regex_test.txt content:


then from command line:

   grep -P '(?<=DST=)(([2]([0-4][0-9]|[5][0-5])|[0-1]?[0-9]?[0-9])[.]){3}(([2]([0-4][0-9]|[5][0-5])|[0-1]?[0-9]?[0-9]))' regex_test.txt




grep -Po '(?<=DST=)(([2]([0-4][0-9]|[5][0-5])|[0-1]?[0-9]?[0-9])[.]){3}(([2]([0-4][0-9]|[5][0-5])|[0-1]?[0-9]?[0-9]))' regex_test.txt

  • Change the -P to -Po to output only the IP address. – Paused until further notice. Oct 10 '10 at 0:21
  • You are right. My output statement does not state that it matches only IP. On my terminal DST= is green and is red so it is obvious. – Casual Coder Oct 10 '10 at 3:57

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy