Parsing IP addresses

[mswinkels]

Hi all,

I'm having some troubles filtering out IP addresses from an input text (p.e. an abuse complaint) using regular expressions. How do I make a regular expression that filters out everything except for an IP address? Because 100.101.102.103 is a valid IP but so is 10.11.12.13 or 1.2.3.4 so the length can be 1, 2 or 3 digits. Anyone who ever had the same problem? Thanks for a reply!

Marcel

[rheroux]

Here's a regexp for IP's taken straight off of php.net. 🙂

<?php

$ip = "1.2.35.2";

if(preg_match("/^(((([1-9])|([1-9][\d])|(1[\d]{2})|(2[0-4][\d])|(25[0-4]))(\.(([\d])|([1-9][\d])|(1[\d]{2})|(2[0-4][\d])|(25[0-4]))){3})|(0(\.0){3}))$/",$ip))
{

echo "Match!";

}

else

{

echo "No match!";

}

?>

[mswinkels]

Thanks, but it doesn't give a match with whatever IP address I enter. What I'm looking for is a code that filters out an IP address. For instance, I have an input text that contains the following string:

"Received: from cox.net ([24.136.40.130]) by amsfep15-int.chello.nl"

I want to use regular expressions to process that string so that the output will be "24.136.40.130".

Any idea if that is possible? Thanks.

Marcel

[xblue]

if it is in the middle of the string, then you should remove the assertion characters ^ and $ (for beginning and end of string) from the pattern.

[mswinkels]

I tried the following:

<?php

$input = "Received: from cox.net ([24.136.40.130]) by amsfep15-int.chello.nl";

echo "Input text: ".$input."\n";

preg_match("/(((([1-9])|([1-9][d])|(1[d]{2})|(2[0-4][d])|(25[0-4]))(.(([d])|([1-9][d])|(1[d]{2})|(2[0-4][d])|(25[0-4]))){3})|(0(.0){3}))/",$input,$matches);

echo "<BR>IP address found: ".$matches[0]."\n";

?>

The result printed on the screen:

Input text: Received: from cox.net ([24.136.40.130]) by amsfep15-int.chello.nl
IP address found:

It doesn't find any IP address within the text 🙁
Any suggestions? Thanks again for helping.

Marcel

[Weedpacket]

Well, you could do all the work of seeing if each part of the ip address is in the range 1..255 with something like:

$byte = '([1-9]\d?|1\d\d|2([0-4]\d|5[0-5]))';
$ip_addr = "/($byte\.){3}$byte/";
if(preg_match($ip_addr, $string, $matches))
{	echo $matches[0];
}

(So the full regexp would be /(([1-9]\d?|1\d\d|2([0-4]\d|5[0-5])).){3}([1-9]\d?|1\d\d|2([0-4]\d|5[0-5]))/

But it may be easier to just see if the digits and dots are there in the right proportions, and then see if it really is an IP.

if(preg_match('/(\d{1,3}\.){3}\d{1,3}/', $string, $matches))
{	if($matches[0] == long2ip(ip2long($matches[0])))
		echo $matches[0];
}

The two aren't equivalent. The first will find the IP in 624.125.16.215.30 (125.16.215.30), but the second won't. But are you going to be faced with such a situation?

[mswinkels]

Thank you very much, this is something I can use :-)

What do I need to do when there are two IP addresses in one line, p.e.

"Received: from 10.25.1.0 ([24.136.40.130]) by amsfep15-int.chello.nl"

The code only shows the first IP (10.25.1.0) and not the last one, is it in some way stored in the array $matches[] or do I need to make a change in the code to make it work?

Thanks again.

Marcel

[Weedpacket]

You'll need to use [man]preg_match_all[/man]. That will give you an array of all the matches the regexp finds. Note that in my second bit of code the ip-testing bit only works on single matches, so it will have to be inside some sort of loop.

foreach($matches[0] as $maybe_ip)
  if(long2ip(ip2long($maybe_ip))==$maybe_ip)
    $ips[] = $maybe_ip;

And you've got your IP's.

[mswinkels]

Thank you, it really helped me out!

[mswinkels]

Sigh, I feel realy stupid to bother you guys again, but I've been trying to filter out e-mailaddresses as well, I tried the following:

$string='my emailadres is [e-mail]';

preg_match("/^{@\d{2,4}/",$string,} $matches);
echo $matches[0];

But that doesn't give any output. I entered {2,4} for extension like .nl .info .com but it doesn't seem to work :-(

Marcel

[Weedpacket]

Originally posted by mswinkels
preg_match("/^{@\d{2,4}/",$string,} $matches);

Part of the reason is that "\d" means "a digit". What that expression will match is an @ at the start of the string, followed by two to four digits. I.e., things like "@16", "@667", "@9876" but not "[e-mail]" or "this@23". See here for details.

There are a number of regular expressions concocted for matching email addresses, but if you want to be serious about the things it's a nontrivial task.

http://www.phpbuilder.com/board/showthread.php?threadid=10207391

http://www.phpbuilder.com/board/showthread.php?threadid=10207615

http://www.phpbuilder.com/board/showthread.php?threadid=10232732

And a class available from elsewhere that has been developed:

http://phpclasses.spunge.org/browse.html/package/13.html

[mswinkels]

The class uses the following regular expression:

var $email_regular_expression="^([-!#\$%&'*+./0-9=?A-Z^_`a-z{|}~])+@([-!#\$%&'*+/0-9=?A-Z^_`a-z{|}~]+\\.)+[a-zA-Z]{2,6}\$";

Though when I try the following:

$string='marcel has emailaddress [email][e-mail][/email]';
$emailregexp="^([-!#\$%&'*+./0-9=?A-Z^_`a-z{|}])+@([-!#\$%&'*+/0-9=?A-Z^_`a-z{|}]+\\.)+[a-zA-Z]{2,6}\$";
preg_match("$emailregexp",$string,$matches);
echo $matches[0];

I get the error "Warning: Unknown modifier '_' in /var/www/blaat2.php on line 36"

What do I do wrong? I want only "[e-mail]" as output. The input is now an example text, but in the future the input text is something like:

person: Wiljan Dankers
address: Brandevoortse Dreef 2
address: Helmond
address: The Netherlands
phone: [phone]
e-mail: [e-mail]
nic-hdl: WD294-RIPE
remarks: complaints about spam and other net-abuse: [e-mail]
mnt-by: EU-IBM-NIC-MNT2
changed: [e-mail] 20010426
source: RIPE

And the output should be something like:
[e-mail]
[e-mail]
[e-mail]

Is that possible while using the reg.exp. above? I read the other articles but it doesn't make complete sense to me yet, hope that will come soon 🙂

Thanks. Marcel

[Weedpacket]

What's missing are the delimiters at the beginning and end of the regexp. Because the first character of the regexp is "^", it assumes you want to use that for your delimiter, and will take everything following that up to the next ^ as your regexp. It does so, sees the next character ("_"), and goes "duhhh....".

Here's a version with delimiters added ("/" is the traditional choice).

$emailregexp="/^([-!#\$%&'*+.\/0-9=?A-Z^_`a-z{|}])+@([-!#\$%&'*+\/0-9=?A-Z^_`a-z{|}]+\.)+[a-zA-Z]{2,6}\$/";

preg_match($emailregexp, $string, $matches);

(Modifiers are letters you can tack on to the regexp after the final delimiter that act as "switches" that adjust the behaviour of the regexp engine in various ways.)