RegEx: Find IP Addresses in a File Using Grep

Here are some regular expressions that will help you to perform a validation and to extract all matched IP addresses from a file.

The following regular expressions match IPv4 addresses.

Matched IP addresses can be extracted from a file using grep command.

In this article you’ll find a regular expressions themselves and an example of how to extract matched IP addresses from a file with the grep command.

Regular Expression to Match IP Addresses

Use the following regular expression to match IPv4 addresses (actually it matches all expressions from 0.0.0.0 to 999.999.999.999).

"([0-9]{1,3}[\.]){3}[0-9]{1,3}"

Grep IP Addresses

Parse a file and print all expressions that match a range between 0.0.0.0 and 999.999.999.999.

$ grep -E -o "([0-9]{1,3}[\.]){3}[0-9]{1,3}" file.txt

This regular expression is quite simple but you should understand that not all matches are technically valid IP addresses.

Let’s find only valid IP addresses with the second regular expression.

Match only Valid IPv4 Addresses

Use the following regular expression to find and validate the IPv4 addresses:

"(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)"

Grep Only Valid IP Addresses

Find and extract only valid IP addresses from a file:

$ grep -E -o "(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)" file.txt
Option Description
-E, –extended-regexp Use extended regular expression
-o, –only-matching Print IP addresses only

Omit -o option to print lines that contains IP addresses.

19 Replies to “RegEx: Find IP Addresses in a File Using Grep”

  1. vikas gautam says: Reply

    hello all,
    i am getting multiple same output against same IP addresses.
    used command :

    grep -E -o "([0-9]{1,3}[\.]){3}[0-9]{1,3}"
    1. Dude, or Miss, did you even read the article? This pattern you define here allows non-sense IPs like 456.233.777.999… sooooo that is no validation at all.

  2. Nope, matches Safari/13606.3.4.1.4 as well 🙁 (06.3.4.1)

  3. very nice thnk you

  4. For this to work properly, you need to also match at least the end of the string. Otherwise, it will match invalid IP addresses such as “192.168.0.700”.

  5. what is the meaning of {3}

    1. x{1,3} 1 to 3 times the previous character or sequence
      x{3} exactly 3 times the previous character or sequence

  6. “`
    grep -E -o “((25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.){1,3}(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)” file.txt
    “`

    With a little playing around was able to combo two from here to make a shorter expression for correct IP address validation.

  7. This regex seems broken!

    echo “999.123.123.123” | grep -E -o “((25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.){1,3}(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)”
    99.123.123.123

  8. How do you approach this when you have a file and you want to count the number of times an IP address comes up and also print the IP addresses but you have a string that says something like “Your ip address is….” with different IP addresses following this string?

  9. I have this file:
    192.168.0.1
    980.190.190.0
    999.999.999.999
    192.999.0.1
    192.1.999.9
    1.1.1.999
    but when I run the scirpt:
    cat myfile.txt | grep -oE ‘(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)’
    I receive this output:
    192.168.0.1
    80.190.190.0
    1.1.1.99
    it remove “9” (or any other character) from second row.

  10. It is nice
    but still not valid because I got this adresses:

    029.191.76.219
    052.139.48.116
    091.115.103.218
    096.123.103.218

    1. grep -Eo “(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])”

  11. grep -Eo “(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])”

    1. This misses valid IP addresses with leading 0s in the second, third, or fourth octets. It also drops the leading digit off of invalid addresses starting with 256, or [3-9][0-9]{2}, and it drops the third digit in the fourth octet when the IP is invalid.

      IP List:

      ------------------------------------>8------------------------------------
      # INVALID IPs
      123.256.234.254
      124.255.256.255
      125.255.255.256
      999.999.999.999
      256.143.1.2
      556.222.2.2
      
      # VALID IPs
      192.168.5.5
      10.0.0.4
      10.000.000.04
      10.010.000.104
      10.210.000.104
      10.210.100.104
      ------------------------------------88------------------------------------
      $ grep -Eo "(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])" iplist
      125.255.255.25
      56.143.1.2
      56.222.2.2
      192.168.5.5
      10.0.0.4
      10.210.100.104
      ------------------------------------88------------------------------------
      $ grep -Ewo "((25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.){3}(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)" iplist
      192.168.5.5
      10.0.0.4
      10.000.000.04
      10.010.000.104
      10.210.000.104
      10.210.100.104
      ------------------------------------88------------------------------------
      $ grep -Eo "(\b(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.){3}(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\b" iplist
      192.168.5.5
      10.0.0.4
      10.000.000.04
      10.010.000.104
      10.210.000.104
      10.210.100.104
      ------------------------------------8<------------------------------------
      

      I'm not sure if there's a use-case where -Ewo wouldn't work and \b would, but it works either way on RHEL 7.

      1. Also, for the record, I have encountered situations where you have to include leading 0s in the IP address. I’m not sure if they’re still valid scenarios, but Verifone Omni 7000 and MX 800 series PIN Pads required leading 0s. 10.1.1.50 had to be entered as 010.001.001.050, for example. I’m sure there are other scenarios where this is true.

  12. A bit clumsy but I think the below works well:

    grep -E -o "(\b(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\b)|(^(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\b)" ip_add.txt
    1. Wrapping the whole query in parenthesis is not required. \b(25[0-5]|…\b works just as well. Even easier to type is `grep -Ewo (25[0-5]|…`

Leave a Reply