<div dir="auto"><div>I use rgxg on a daily basis for grepping firewall rules and logs. Before that I used grepcidr but didn't like how it was a standalone grep tool. rgxg just generates the regex string so you can use it in sed/awk/grep. Anything more advanced I'd look at tokenizing addresses into arrays or use perl -e/python -c standard ip modules.</div><div dir="auto"><br></div><div dir="auto">If you want to get a list of blocks owned by an organisation you can query Arins whois service or query an internet routing registry like radb.<br><div dir="auto"><br></div><div dir="auto"><a href="https://rgxg.github.io/">https://rgxg.github.io/</a><br></div><a href="https://www.radb.net/support/tutorials/how-to-query-merit-radb.html">https://www.radb.net/support/tutorials/how-to-query-merit-radb.html</a></div><div dir="auto"><br><br><div class="gmail_quote" dir="auto"><div dir="ltr" class="gmail_attr">On Sat, 12 Mar 2022, 9:47 am Brad Campbell, <<a href="mailto:brad@fnarfbargle.com">brad@fnarfbargle.com</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">G'day all,<br>
<br>
I've knocked up a simple log processor in bash to dump ip addresses that access our zimbra server on a daily basis.<br>
<br>
It's not pretty but it works :<br>
<br>
LIST=`zcat $LOGNOW | \<br>
grep -o 'oip=[^;]*' | \<br>
sed 's/oip=//g' | \<br>
sort | \<br>
uniq | \<br>
egrep -v '(^192.168.|^10.8.)' `<br>
<br>
At the moment it gives me a list like :<br>
1.126.106.244<br>
1.126.109.132<br>
1.146.128.86<br>
1.146.135.178<br>
1.146.167.203<br>
1.146.169.253<br>
1.146.174.225<br>
1.146.175.139<br>
<br>
That is yesterdays list and are all Telstra mobile CGNAT addresses. I'd like to be able to filter those based on the known telstra subnets and just leave the outliers (like the continuous stream of Russian bots hitting the EWS port scanning for Exchange vulnerabilities)<br>
<br>
What I'd like to be able to do is replace the final egrep with something that can handle subnets (and a list of them), for example : <a href="http://1.128.0.0/11" rel="noreferrer noreferrer" target="_blank">1.128.0.0/11</a>, <a href="http://1.120.0.0/13" rel="noreferrer noreferrer" target="_blank">1.120.0.0/13</a>, <a href="http://192.168.0.0/16" rel="noreferrer noreferrer" target="_blank">192.168.0.0/16</a>, <a href="http://10.0.0.0/8" rel="noreferrer noreferrer" target="_blank">10.0.0.0/8</a><br>
<br>
Before I converted the whole thing to python and implemented subnet filtering I thought I'd ask and see if anyone has something clever they've used/seen.<br>
<br>
Regards,<br>
Brad<br>
_______________________________________________<br>
PLUG discussion list: <a href="mailto:plug@plug.org.au" target="_blank" rel="noreferrer">plug@plug.org.au</a><br>
<a href="http://lists.plug.org.au/mailman/listinfo/plug" rel="noreferrer noreferrer" target="_blank">http://lists.plug.org.au/mailman/listinfo/plug</a><br>
Committee e-mail: <a href="mailto:committee@plug.org.au" target="_blank" rel="noreferrer">committee@plug.org.au</a><br>
PLUG Membership: <a href="http://www.plug.org.au/membership" rel="noreferrer noreferrer" target="_blank">http://www.plug.org.au/membership</a><br>
</blockquote></div></div></div>