Extract public and private IP addresses fields separately

[cs308]

I have trouble with getting public and private IP addresses fields separately. How can I extract private and public IP addresses fields separately using regex???  Because, when I extract IP field from failed ssh login log, I get both public and private  fields in same filed, therefore I want extract them in different fields.

[PickleRick]

1. Don't think about it like that. If a field in your data is - let's say - the source of the connection, it is that source regardless of whether it is a public IP or a private one. You can filter on that field later.

2. Even if you tried doing that it will not be pretty using regex alone.

[ITWhisperer]

@PickleRick I think the point is that @cs308 wants to be able to determine if an IP address is private or not. Yes, the regex may not be pretty, but it is doable (about 135 characters for a version that detects private ip addresses, and about 150 characters for a version that detects non-private ip addresses). As I said, this depends on what the definition of private is and how robust the expression needs to be.

[ITWhisperer]

Please share what you have tried so far and some anonymised sample events that you are working with.

Also, is this ipv4 only?

In general, ipv4 private addresses fall into distinct groups, is it that you want to use these groups to determine which sort of address it is? If so, which groups do you want to treat as private? For example: 127.x.x.x, 192.168.x.x, etc?