IP Address Extractor
Parse server access logs, firewall reports, and network traces to extract valid IPv4 addresses. Automatically removes duplicates for security analysis.
Step-by-Step Instructions
Paste Server Logs or Network Text
Paste Nginx/Apache access logs, firewall output, packet captures, or system logs into the editor.
Select IP Version
Choose to extract IPv4 addresses (`192.168.1.1`), IPv6 addresses (`2001:db8::1`), or both.
Configure Filtering Rules
Filter out private/local network ranges (RFC 1918 `10.0.0.0/8`, `192.168.0.0/16`, `127.0.0.1`) and remove duplicate IPs.
Copy Clean IP List
Copy extracted unique IP addresses ready for firewall blocking (iptables, Cloudflare WAF) or security auditing.
Key Features & Capabilities
- Strict IPv4 (`0.0.0.0` to `255.255.255.255`) and IPv6 standard hexadecimal address extraction regex
- RFC 1918 Private and Loopback IP filter (automatically isolates public routable IPs from local network IPs)
- Automatic de-duplication, frequency counting (hits per IP), and numerical sorting
- Firewall rule generator formatting (exports directly to Cloudflare IP Access Rules, CIDR blocks, or iptables commands)
Frequently Asked Questions
How does the extractor validate that IPv4 octets are within the valid 0-255 range?
A naive regex matches any 4 numbers separated by dots (e.g., `999.999.999.999`). Our extractor uses strict octet boundary validation: `(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)`, ensuring each of the 4 octets is mathematically valid between 0 and 255.
What are RFC 1918 Private IP ranges?
RFC 1918 reserves three private IP blocks for local area networks that are never routed on the public internet: **10.0.0.0/8** (`10.0.0.0` – `10.255.255.255`), **172.16.0.0/12** (`172.16.0.0` – `172.31.255.255`), and **192.168.0.0/16** (`192.168.0.0` – `192.168.255.255`), along with loopback **127.0.0.1**.
How does the extractor handle IPv6 addresses and shorthand notation?
The extractor supports full 128-bit IPv6 hexadecimal addresses (8 groups of 4 hex digits) as well as RFC 4291 compressed shorthand notations using double colons (`::`) and mixed IPv4-mapped IPv6 addresses (`::ffff:192.0.2.128`).
Can this tool count IP address frequency to identify DDoS attacks in server access logs?
Yes. The extractor includes an IP Frequency Counter that tallies how many times each IP appears in your web server log file, sorting top offenders to the top so you can instantly identify scraping bots or DDoS attack sources.
Related Utilities
Discover complementary online tools in the same workflow.
JSON Formatter & Validator
Format, beautify, minify, validate, and view JSON data online with instant syntax highlighting and error detection.
Base64 Encoder & Decoder
Encode text or binary data into Base64 format or decode Base64 back into raw string format.
CSV to JSON Converter
Easily convert CSV data to clean JSON format. Turn tabular spreadsheets into structured JSON.
YAML to JSON Converter
Convert YAML configuration files into structured JSON for APIs and modern web tooling.
JWT Parser & Token Debugger
Decode JWT tokens to view header, payload claims, and expiration status without sending secrets anywhere.
Hash Generator (SHA-256, SHA-512, MD5)
Generate cryptographically secure SHA-256, SHA-512, SHA-384, and SHA-1 hashes for any text.