Log files can grow as large as you let them and if for any reason you need to redact the IP addresses they hold it’s often impractical to do it manually.
It can be automated using Notepad++ (A free text editor Notepad++ Download link) with some clever regex.
There are 2 different methods, one using simple regex which will do the job but will also remove some non-IP numbers which look similar in format to an IP address.
Quick and dirty method
Here are some demo log files with thousands of IP addresses inside:
Launch Notepad++ and select search >> find in files >>
The quick and dirty regex is : (\d{1,3}\.){3}\d{1,3}
set some replacement text or leave blank if you want to just delete the entries.
set the directory which contains your log files, and most importantly set the search mode to “regular expression”. It’s set to “Normal” by default.
When you press “Replace in Files” you’ll turn this:
Into :
As you can see it’s also gone through all of the log files and saved you a lot of manual time and effort:
Regex explained:
(\d{1,3}\.){3}\d{1,3}
(\d{1,3}\.) finds any set of numbers 1-3 digits in length with a full stop at the end.
{3} repeats the previous regex 3 times.
\d{1,3} is similar to the first part and searches for a set of numbers 1-3 digits in length but with no full stop at the end.
The reason you cannot simply use (\d{1,3}\.){4} is because the last octet of an IP address doesn’t end with a full stop.
The problem with this quick regex is that it will also pick up numbers such as:
999.999.999.999 which is not a valid IP. Depending on the contents of your log files this might not be a problem.
IP Specific regex
If the quick and dirty method doesn’t do exactly what you need you can use this much longer regex to specify the numbers which can appear in an IP address:
(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)
It will do mostly the same as the previous regex but is smart enough to not remove 999.999.999.999
Urban Security Research 