forked from ryantig/grepcidr
-
Notifications
You must be signed in to change notification settings - Fork 0
/
Copy pathREADME
executable file
·87 lines (69 loc) · 3.52 KB
/
README
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
grepcidr 2.991 - Filter IP addresses matching IPv4 and IPv6 CIDR specification
Parts Copyright (C) 2004-2005 Jem E. Berkes <jberkes@pc-tools.net>
http://www.pc-tools.net/unix/grepcidr/
Revised by John Levine <johnl@taugh.com> Dec 2013-Oct 2015, who makes
no copyright claims to the modifications.
PURPOSE
-------
grepcidr can be used to filter a list of IP addresses against one or more
Classless Inter-Domain Routing (CIDR) specifications, or arbitrary networks
specified by an address range. As with grep, there are options to invert
matching and load patterns from a file. grepcidr is capable of comparing
thousands or even millions of IPs to networks with little memory usage and
in reasonable computation time.
grepcidr has endless uses in network software, including: mail filtering and
processing, network security, log analysis, and many custom applications.
COMPILING & INSTALLING
----------------------
Edit Makefile to customize the build. Then,
make
make install
COMMAND USAGE
-------------
Usage:
grepcidr [-V] [-cCDvhais] PATTERN [FILE ...]
grepcidr [-V] [-V] [-cCDvhais] [-e PATTERN | -f FILE] [FILE ...]
-V Show software version
-a Anchor matches to beginning of line, otherwise match anywhere
-c Display count of the lines that would have been shown, instead of showing them
-C Parse CIDR ranges in input and only match if a search term encompasses the entire range.
-D Parse CIDR ranges in input and match if a search term matches any part of the range.
-v Invert the sense of matching, to select non-matching IP addresses
-e Specify pattern(s) on command-line
-f Obtain CIDR and range pattern(s) from file
-i Ignore patterns that are not valid CIDRs or ranges
-h Do not print filenames when matching multiple files
PATTERN specified on the command line may contain multiple patterns
separated by whitespace or commas. For long lists of network patterns,
specify a -f FILE to load where each line contains one pattern. Comment
lines starting with # are ignored, as are comments following white space
after a pattern. Use -i to ignore invalid pattern lines.
Each pattern, whether on the command line or inside a file, may be:
CIDR format a.b.c.d/xx or aa:bb::cc::dd/xx
IP range a.b.c.d-e.f.g.h
Single IP a.b.c.d or aa:bb:cc::dd
IPv6 addresses can be written in any format including embedded IPv4.
The zero address :: is accepted as a pattern but does not match in
files. (Use regular grep if that's what you're looking for,) It does
not accept IPv6 ranges, since few people use them.
Grepcidr uses a state machine to look for IP addresses in the input,
and a binary search to match addresses against patterns. Its speed is
roughly O(N) in the size of the input, and O(log N) in the number of
patterns. A prepass over the patterns merges adjacent and overlapping
patterns so there is negligle speed penalty for matching, e.g.
1.2.2.0/24 and 1.2.3.0/24 rather than 1.2.2.0/23.
Input files are mapped into memory if possible, so the state machine
can make one pass over the whole file. If mapping fails, it reads the
input a line at a time.
EXAMPLES
--------
grepcidr -f ournetworks blocklist > abuse.log
Find our customers that show up in blocklists
grepcidr 127.0.0.0/8,::1 iplog
Searches for any localnet IP addresses inside the iplog file
grepcidr "192.168.0.1-192.168.10.13" iplog
Searches for IPs matching indicated range in the iplog file
script | grepcidr -ivf whitelist > blacklist
Create a blacklist, with whitelisted networks removed (inverse)
grepcidr -if list1 list2
Cross-reference two lists, outputs IPs common to both lists