Telnet log parser

Question

I've set up a telnet honeypot and I'm looking for a library that could pull the IP address out of this:

[2021-02-22 10:28:06] [127.0.0.1:46368] AUTH: bog:bog
[2021-02-22 10:28:12] [127.0.0.1:46368] AUTH: :^]
[2021-02-22 10:28:13] [127.0.0.1:46368] AUTH: :
[2021-02-22 10:28:13] [127.0.0.1:46368] SESSION_END

Something in Python would be nice, but any language works.

Answer 1

The python re built in library, possibly with the regex or grin packages, looks good.

To get all of the unique IP addresses you could use something like:

import re

ip_addresses = set(re.findall(r'((?:[\d]{1,3}\.){3}\d{1,3})', open('file.log').read())
print(ip_addresses)

Adding the verbose flag to make things more readable:

import re

ip_addresses = set(re.findall(r'''
( # Capture Group
(?: # Non Capture Group
\d  # Digit
{1,3} # Between 1 & 3 times
\. # Literal .
) # End Non Capture Group
{3} # Repeat exactly 3 times
\d # Digit
{1,3} # Between 1 & 3 times
) # End capture group
''', open('file.log').read(), re.VERBOSE)

print(ip_addresses)

Of course you could use glob or argparse to make this into a utility script.