Sign in to follow this  
Followers 0
lilx

Help extracting ip from string

12 posts in this topic

Hi evryone,

I have a small problem. My company manages mail from other companies. Sometimes they call telling us that they dont receive mail from an certain adres. We then go through the mail logs to see if its blacklisted.

This is the quick code i wrote.

FileChangeDir("Z:")
$search = FileFindFirstFile ( "smtp-201003290000*" )
MsgBox(0,"test",$search)
$email = InputBox("dinges","yo")

While 1
    $file = FileFindNextFile($search)
    If @error Then ExitLoop
    MsgBox(4096, "File:", $file)
    zoekblack()
WEnd

FileClose($search)

Func zoekblack()
    $fileo = FileOpen($file, 0)
If $fileo = -1 Then
    MsgBox(0, "Error", "Unable to open file.")
    Exit
EndIf

For $line = 1 To 110
    If StringInStr(FileReadLine($fileo, $line), $email) And StringInStr(FileReadLine($fileo, $line), "SNDRIP=EIPMAP" ) Then
        MsgBox(0,"welke regel enzo", $line )

            $linestr = FileReadLine($file,$line)
                        ;HERE IS MY PROBLEM \/
            $ipadres = StringInStr($linestr,"HOW????")
            MsgBox(0,"welke ip enzo", $ipadres )

            MsgBox(0, "Line read:", $linestr)

    EndIf
Next
FileClose($fileo)
EndFunc

Example from log:

"Test.nl" "Test.nl" "123.12.123.231" "2010-03-29 00:00:56" "[123.12.123.231]" "" "118782811117076@example.nl" "" "" "SNDRIP=EIPMAP (dnsbl-1.uceprotect.net)" "" "0" ""

I need to have the ip adres from this line(in script $linestr). I don't think its very hard but can't make it work. If someone can please help me.

Share this post


Link to post
Share on other sites



#2 ·  Posted (edited)

$a = StringSplit($LineStr," ")
$ip = StringMid($a[2],2,StringLen($a[2]-2))

That will work if there are no spaces in the "Test.nl" file names. *Edit:* It just occurred to me that "Test.nl" is probably a server name, not a file name, so it can't have spaces in it.

If you can have spaces in the file names, try something like this:

$ip1 = StringMid( $LineStr, StringInStr($LineStr,""" """,False,2)+2)
$ip2 = StringLeft( $ip1, 2, StringInStr($ip1,""" """,False,1)-2)
Edited by PhilHibbs

Share this post


Link to post
Share on other sites

$sStr = '"Test.nl" "Test.nl" "123.12.123.231" "2010-03-29 00:00:56" "[123.12.123.231]" "" "118782811117076@example.nl" "" "" "SNDRIP=EIPMAP (dnsbl-1.uceprotect.net)" "" "0" ""'

$sIP = StringRegExpReplace($sStr, "(?i).*\[([.\d]+)\].*", "$1")
$sAddress = StringRegExpReplace($sStr, "(?i).*\b(.+@.+?\.\w+)\b.*", "$1")

MsgBox(0, "Result", "IP = " & $sIP & @CRLF & "Address = " & $sAddress)


George

Question about decompiling code? Read the decompiling FAQ and don't bother posting the question in the forums.

Be sure to read and follow the forum rules. -AKA the AutoIt Reading and Comprehension Skills test.***

The PCRE (Regular Expression) ToolKit for AutoIT - (Updated Oct 20, 2011 ver:3.0.1.13) - Please update your current version before filing any bug reports. The installer now includes both 32 and 64 bit versions. No change in version number.

Visit my Blog .. currently not active but it will soon be resplendent with news and views. Also please remove any links you may have to my website. it is soon to be closed and replaced with something else.

"Old age and treachery will always overcome youth and skill!"

Share this post


Link to post
Share on other sites

$sStr = '"Test.nl" "Test.nl" "123.12.123.231" "2010-03-29 00:00:56" "[123.12.123.231]" "" "118782811117076@example.nl" "" "" "SNDRIP=EIPMAP (dnsbl-1.uceprotect.net)" "" "0" ""'

$sIP = StringRegExpReplace($sStr, "(?i).*\[([.\d]+)\].*", "$1")
$sAddress = StringRegExpReplace($sStr, "(?i).*\b(.+@.+?\.\w+)\b.*", "$1")

MsgBox(0, "Result", "IP = " & $sIP & @CRLF & "Address = " & $sAddress)

Caution: that will pick the first thing it finds that looks like an IP address. What are those "Test.nl" strings? Are they a server name? If so, could the server name actually be a different IP address to the one you are trying to extract? If so, then you will get this server IP address instead of the third quoted section of your input.

Share this post


Link to post
Share on other sites

#5 ·  Posted (edited)

Another way to handle it is something along these lines

#include <Array.au3>
$sStr = FileRead(@DeskTopDir & "\test.txt")

$sSearch = InputBox("Search", "Enter the Email address to find", "", "", 200, 150)

If NOT $sSearch Then Exit

$aPossible = StringRegExp($sStr, "(?i)(?m:^).+(\[.+" & $sSearch & "[@.a-z]*).*(?:\v|\z)+", 3)
If NOT @Error Then
     _ArrayDisplay($aPossible)
     ClipPut($aPossible[0])
     Local $aRtn[UBound($aPossible)]
    For $i = 0 To UBound($aPossible) -1
        $sIP = StringRegExpReplace($aPossible[$i], "^.*\[([\d.]+)\].*$", "$1")
        $aRtn[$i] = $sIP
    Next
    _ArrayDisplay($aRtn)
EndIf

I should mention that the Input box will accept just the first part of the email and it's not case sensitive.

118782811117076@example.nl

118782811117076@example

118782811117076@

118782811117076

Are all valid search strings.

Edited by GEOSoft

George

Question about decompiling code? Read the decompiling FAQ and don't bother posting the question in the forums.

Be sure to read and follow the forum rules. -AKA the AutoIt Reading and Comprehension Skills test.***

The PCRE (Regular Expression) ToolKit for AutoIT - (Updated Oct 20, 2011 ver:3.0.1.13) - Please update your current version before filing any bug reports. The installer now includes both 32 and 64 bit versions. No change in version number.

Visit my Blog .. currently not active but it will soon be resplendent with news and views. Also please remove any links you may have to my website. it is soon to be closed and replaced with something else.

"Old age and treachery will always overcome youth and skill!"

Share this post


Link to post
Share on other sites

Caution: that will pick the first thing it finds that looks like an IP address. What are those "Test.nl" strings? Are they a server name? If so, could the server name actually be a different IP address to the one you are trying to extract? If so, then you will get this server IP address instead of the third quoted section of your input.

It will actually grab the IP between the sgaure brackets.

George

Question about decompiling code? Read the decompiling FAQ and don't bother posting the question in the forums.

Be sure to read and follow the forum rules. -AKA the AutoIt Reading and Comprehension Skills test.***

The PCRE (Regular Expression) ToolKit for AutoIT - (Updated Oct 20, 2011 ver:3.0.1.13) - Please update your current version before filing any bug reports. The installer now includes both 32 and 64 bit versions. No change in version number.

Visit my Blog .. currently not active but it will soon be resplendent with news and views. Also please remove any links you may have to my website. it is soon to be closed and replaced with something else.

"Old age and treachery will always overcome youth and skill!"

Share this post


Link to post
Share on other sites

It will actually grab the IP between the sgaure brackets.

Oh yeah, my apologies. Didn't spot that. Regular expressions are awesome but they ain't easy on the eye.

Share this post


Link to post
Share on other sites

No problem Phil, that can be a hard one to spot anyway.


George

Question about decompiling code? Read the decompiling FAQ and don't bother posting the question in the forums.

Be sure to read and follow the forum rules. -AKA the AutoIt Reading and Comprehension Skills test.***

The PCRE (Regular Expression) ToolKit for AutoIT - (Updated Oct 20, 2011 ver:3.0.1.13) - Please update your current version before filing any bug reports. The installer now includes both 32 and 64 bit versions. No change in version number.

Visit my Blog .. currently not active but it will soon be resplendent with news and views. Also please remove any links you may have to my website. it is soon to be closed and replaced with something else.

"Old age and treachery will always overcome youth and skill!"

Share this post


Link to post
Share on other sites

@lilx

If you need more help with this, I worked up a couple of function that will do it and more.


George

Question about decompiling code? Read the decompiling FAQ and don't bother posting the question in the forums.

Be sure to read and follow the forum rules. -AKA the AutoIt Reading and Comprehension Skills test.***

The PCRE (Regular Expression) ToolKit for AutoIT - (Updated Oct 20, 2011 ver:3.0.1.13) - Please update your current version before filing any bug reports. The installer now includes both 32 and 64 bit versions. No change in version number.

Visit my Blog .. currently not active but it will soon be resplendent with news and views. Also please remove any links you may have to my website. it is soon to be closed and replaced with something else.

"Old age and treachery will always overcome youth and skill!"

Share this post


Link to post
Share on other sites

Geosoft: Thanks, stringregexpreplace works good. Although sometimes for an example with an point in the adres it doesn't give the whole adres. I'd like to see more i'm trying hard to learn some good functions like these.

PhilHibbs: It is a domain name so no spaces. And the ip adres between [] is not always there so the ip between quotes is the one that's every time.

"test.nl" "test.nl" "117.192.5.15" "2010-03-30 00:12:23" "[117.192.18.22]" "" "1166196967.3588@unknown.nl" "" "" "SNDRIP=EIPMAP (dnsbl-2.uceprotect.net)" "" "0" ""

"test.nl" "test.nl" "84.227.51.112" "2010-03-30 00:12:25" "adslplus.ch" "" "dimuxoy1146@justanexample.ch" "" "" "SNDRIP=EIPMAP (dnsbl-1.uceprotect.net)" "" "0" ""

"test.nl" "test.nl" "94.254.233.34" "2010-03-30 00:13:01" "[94.254.233.34]" "" "virginia@forbidden.nl" "" "" "SNDRIP=EIPMAP (dnsbl-2.uceprotect.net)" "" "0" ""

3lines from a log. There is alot more space between the qoutes than the forum alows so those are removed. I don't know if it matters.

Share this post


Link to post
Share on other sites

Geosoft: Thanks, stringregexpreplace works good. Although sometimes for an example with an point in the adres it doesn't give the whole adres. I'd like to see more i'm trying hard to learn some good functions like these.

PhilHibbs: It is a domain name so no spaces. And the ip adres between [] is not always there so the ip between quotes is the one that's every time.

"test.nl" "test.nl" "117.192.5.15" "2010-03-30 00:12:23" "[117.192.18.22]" "" "1166196967.3588@unknown.nl" "" "" "SNDRIP=EIPMAP (dnsbl-2.uceprotect.net)" "" "0" ""

"test.nl" "test.nl" "84.227.51.112" "2010-03-30 00:12:25" "adslplus.ch" "" "dimuxoy1146@justanexample.ch" "" "" "SNDRIP=EIPMAP (dnsbl-1.uceprotect.net)" "" "0" ""

"test.nl" "test.nl" "94.254.233.34" "2010-03-30 00:13:01" "[94.254.233.34]" "" "virginia@forbidden.nl" "" "" "SNDRIP=EIPMAP (dnsbl-2.uceprotect.net)" "" "0" ""

3lines from a log. There is alot more space between the qoutes than the forum alows so those are removed. I don't know if it matters.

I was just going to post some functions for you to play with when I noticed the bit about the address not always being within the square brackets. So I'll quickly change what I have to get the one within quotes. You can do the same in the one I gave you by changing the \[ and \]. Change both to \x22

I'll be back in a few minutes with code for you again.


George

Question about decompiling code? Read the decompiling FAQ and don't bother posting the question in the forums.

Be sure to read and follow the forum rules. -AKA the AutoIt Reading and Comprehension Skills test.***

The PCRE (Regular Expression) ToolKit for AutoIT - (Updated Oct 20, 2011 ver:3.0.1.13) - Please update your current version before filing any bug reports. The installer now includes both 32 and 64 bit versions. No change in version number.

Visit my Blog .. currently not active but it will soon be resplendent with news and views. Also please remove any links you may have to my website. it is soon to be closed and replaced with something else.

"Old age and treachery will always overcome youth and skill!"

Share this post


Link to post
Share on other sites

#12 ·  Posted (edited)

The space may or may not make a difference. In order to test properly I would need a file with some actual lines in it instead of posting it in here.

#Include <Array.au3> ;; Included for _ArrayDisplay() only
$sStr = FileRead(@DesktopDir & "\test.txt")
_Email_Search()

Func _Email_Search()
    $sSearch = InputBox("Search", "Enter the Email address to find", "", "", 200, 150)
    If NOT $sSearch Then Exit
    If NOT _IsValid($sSearch) Then
        MsgBox(0, "Error", "You have entered an invalid email address.")
        _Email_Search()
    EndIf
    $aPossible = StringRegExp($sStr, "(?i)(?m:^).+?(\x22[\d.]+.+" & $sSearch & ").*(?:\v|\z)+", 3)
    If NOT @Error Then
        Local $aRtn[UBound($aPossible)][2]
        ;; Here I am creating an array where the first element [0] is the ip address and the second [1] is the email
        For $i = 0 To UBound($aPossible) - 1
            $sAddress = StringRegExpReplace($aPossible[$i], "^.+\].+(\b[\w\d]+@[\w.]+)\b.*$", "$1")
            $sIP = StringRegExpReplace($aPossible[$i], "^.*\x22(\d[\d.]+\d)\x22.*$", "$1")
            $aRtn[$i][0] = $sIP
            $aRtn[$i][1] = $sAddress
        Next
        _ArrayDisplay($aRtn)
    Else
        MsgBox(0, "No Match", "The email address you searched for was not found." & @CRLF & "Check the address and try again.")
    EndIf
EndFunc   ;; <===>_Email_Search

Func _IsValid($s_Domain)
    Return StringRegExp($s_Domain, "^([\w\d\-\.]+)@{1}(([\w\d\-]{1,67})|([\w\d\-]+\.[\w\d\-]{1,67}))\.(([a-zA-Z\d]{2,4})(\.[a-zA-Z\d]{2})?)$")
EndFunc   ;; <===>_IsValid

I also did a function for Domain searches but I have to re-do it now. Also I have a version of the code above that returns all possible matches based on matching the portion of the email before the @ symbol.

Example, it would match gman@your.org or gman@mine.net

Edit: forgot to post the _IsValid function that verifies the email address is actually formatted properly.

Edited by GEOSoft

George

Question about decompiling code? Read the decompiling FAQ and don't bother posting the question in the forums.

Be sure to read and follow the forum rules. -AKA the AutoIt Reading and Comprehension Skills test.***

The PCRE (Regular Expression) ToolKit for AutoIT - (Updated Oct 20, 2011 ver:3.0.1.13) - Please update your current version before filing any bug reports. The installer now includes both 32 and 64 bit versions. No change in version number.

Visit my Blog .. currently not active but it will soon be resplendent with news and views. Also please remove any links you may have to my website. it is soon to be closed and replaced with something else.

"Old age and treachery will always overcome youth and skill!"

Share this post


Link to post
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!


Register a new account

Sign in

Already have an account? Sign in here.


Sign In Now
Sign in to follow this  
Followers 0