IP Address Extractor (IPv4 and IPv6)

Input

IP addresses

0ipv40ipv60lines scanned

Shareable link

Settings are written to the URL as you change them. Nothing differs from the defaults yet.

Extract IP addresses from a log

Paste or open an access log, a firewall or VPN export, mail headers or an alert. IPv4 addresses are listed first and IPv6 after, each one once, in the order it first appears. Ports and brackets are left behind: 203.0.113.7:443 gives 203.0.113.7.

IPv4 checks

All four octets must be in 0-255, and the address must stand on its own, so the scanner does not take 1.2.3.4 out of 1.2.3.4.5 or 256.1.1.1. Private, loopback and reserved ranges are kept, because in a log they are often the interesting ones.

IPv6 normalisation

The same IPv6 address can be written many ways. Every match is parsed into its eight groups and printed in the RFC 5952 short form, so 2001:DB8:0:0:0:0:0:1, 2001:db8::0001 and 2001:db8::1 collapse into a single entry. IPv4-mapped addresses keep their dotted tail, as in ::ffff:192.0.2.1.

Next step

Take a list of addresses to the IP Subnet Calculator to see which block each belongs to, or to DNS Lookup for reverse records.

Frequently Asked Questions

How does it tell an IP address from a version number?

Each of the four parts must be 0-255, and the address must not touch another digit or dot. 192.168.1.10 matches, while 256.1.1.1 and the version string 1.2.3.4.5 do not.

Why does an IPv6 address look different in the output?

Every IPv6 address is printed in the RFC 5952 form: lowercase, leading zeros dropped, and the longest run of zero groups shortened to ::. 2001:0DB8:0000:0000:0000:0000:0000:0001 becomes 2001:db8::1, so two spellings of the same address count as one.

Does it catch addresses with ports or in brackets?

Yes. 8.8.8.8:53 gives 8.8.8.8, and [2001:db8::1]:443 gives 2001:db8::1. Defanged forms like 10[.]0[.]0[.]1 are read too.

Will it match times like 12:30:45?

No. A colon-separated run counts as IPv6 only when a full parser accepts it, it contains a digit, and it has at least two non-zero groups, so clock times, MAC addresses and C++ names like std::vector are skipped.