ips
"ips" is a console program that plucks IPv4 and IPv6 addresses out of stdin. You use it like you would use grep, but for IP addresses. (IPs, especially abbreviated IPv6s are notoriously obnoxious to pick out with regular expressions). In particular, ips is capable of doing IPv4 and IPv6 math and understands ranges both in the document you are searching and as a search term itself. I've tried to include the most common syntaxes for IP ranges, if you need another let me know.
The --cisco option will, in addition to whatever other context you have asked for, will return the first prior line to the matched line that does not have leading spaces. This has the effect of picking out the head of the stanza for cisco style configuration files. In 0.3 the --cisco option will additionally notice the 'object' and 'object-group' definitions that match your search terms and add the name of the object/object-group as a string match to your results.
You might also be interested in this program's baby brother: xips. Xips uses the same ip matching engine to expand/condense lists of ip addresses.
Usage:
Syntax: your_command | ips [-4] [-6] [-v] [-%] [-s] [-q] [-c lines] [-f file] [ip or range] Eats STDIN, outputs lines containing IP addresses or matching specified IP or range. Options: -4 : match IPv4 addresses only -6 : match IPv6 addresses only -% : include IPv6 scope -s : strict, require IPs to be surrounded by whitespace -n : output line numbers -q : quiet, no output -c X : print X lines of context. (Also --context) -b : 'basic' mode - one ip per line, no context. (--basic) -x : match 'hex ipv4' addresses, for instance 'FFFFFFFF' -v : Display version information --cisco: Include the last non-indented line when printing context --aton : Use "old" inet_aton behavior. For instance, 10.5 is another name for 10.0.0.5 -f file: read input from file instead of stdin (also --file; may be repeated) --count : count matching IPs and print total instead of outputting them --private: only output private/RFC1918 addresses --public : only output non-private addresses --masks : allow subnet masks to be shown as standalone IPs (suppressed by default) --link-local : only output IPv6 link-local addresses (fe80::/10) --link-local-mac: only output link-local addresses with EUI-64 MAC-derived IDs --v4mapped : only output IPv4-mapped IPv6 addresses (::ffff:x.x.x.x) --6to4 : only output 6to4 IPv6 addresses (2002::/16; embeds IPv4 in bytes 2-5) --teredo : only output Teredo IPv6 addresses (2001::/32; embeds client IPv4 in bytes 12-15 XOR 0xFF) --sort : collect all matching IPs and output in numeric order (IPv4 then IPv6) --unique : deduplicate IPs in appearance order (alias: --uniq) --cidr R : only output IPs within CIDR R (may be repeated, matches any) Shorthand: -A,-B,-C,-D,-E : Shorthand to match addresses in the classical IP address classes. Also --multicast, --experimental for D and E --loopback : Shorthand to match 127.0.0.0 through 127.255.255.255 --10,--192,--172 : Shorthand to match RFC 1918 address ranges IP/Range Syntax: 192.168.1.1 192.168.1.1-192.168.1.255 192.168.1.1/24 192.168.1.1/C '192.168.1.1 255.255.255.0' 192.168.1.5-15 Exit status (like grep): 0 : at least one matching IP was found 1 : no matching IP was found
Action shots:
$ipconfig |./ips
IPv6 Address. . . . . . . . . . . : (REDACTED):5937:92d0:87f1:8eac
Temporary IPv6 Address. . . . . . : (REDACTED):355c:a5d8:4249:2704
Temporary IPv6 Address. . . . . . : (REDACTED):4da8:dd2:2107:1717
Temporary IPv6 Address. . . . . . : (REDACTED):6199:a955:c19b:dd21
Temporary IPv6 Address. . . . . . : (REDACTED):7449:e249:f999:f17b
Temporary IPv6 Address. . . . . . : (REDACTED):a453:97e8:1f27:69d8
Temporary IPv6 Address. . . . . . : (REDACTED):a99c:3441:6557:dd3
Link-local IPv6 Address . . . . . : (REDACTED):92d0:87f1:8eac%7
IPv4 Address. . . . . . . . . . . : 192.168.2.20
Subnet Mask . . . . . . . . . . . : 255.255.255.0
Default Gateway . . . . . . . . . : (REDACTED):fe00:df0b%7
192.168.2.1
$cat asa_example.txt |ips --cisco 10.20.30.188-10.20.30.192
name 10.20.30.189 example1
name 10.20.30.190 example2
name 10.20.30.188 example3
interface Ethernet0/2.444
...
ip address 10.20.30.129 255.255.255.128
...
object-group network example_object_group
...
network-object host 10.20.30.189
network-object host 10.20.30.190
...
object-group network example_object_group2
...
network-object 10.20.30.128 255.255.255.128
...
object-group network example_object_group3
...
network-object host 10.20.30.192
...
object-group network example_object_group4
...
network-object host 10.20.30.188
network-object host 10.20.30.189
...
access-list outside_in extended permit tcp any host 10.20.30.191 eq 210
access-list vlan1_in extended permit udp 10.20.30.128 255.255.255.128 host 10.20.30.244 eq tftp
access-list vlan2_in extended deny ip any 10.20.30.128 255.255.255.128
static (dmz,outside) 10.20.30.188 10.20.30.188 netmask 255.255.255.255
static (dmz,outside) 10.20.30.189 10.20.30.189 netmask 255.255.255.255
static (dmz,outside) 10.20.30.190 10.20.30.190 netmask 255.255.255.255
static (inside,outside) 10.20.30.191 172.20.141.126 netmask 255.255.255.255
route outside 0.0.0.0 0.0.0.0 10.20.99.249 1
Downloads:
Listing directory https://download.elifulkerson.com/files/ips/0.8:LICENSE June 01 2026 03:23:09 35149 ASCII text
dist June 01 2026 03:43:22 - directory
ips.cpp.asc June 01 2026 03:35:00 801 GnuPG signature
ips.cpp.md5 June 01 2026 03:35:01 42 MD5 checksum
To compile: g++ -std=c++11 -o ips ips.cpp
Updates:
Update: June 12 2017, v0.5. Bug fixes. Support of '192.168.1.X-Y' syntax in the input file.
Update: June 26 2017, v0.6. More bug fixes. Moved to new download server.
Update: July 10 2017, v0.7. I don't remember what I changed. I wrote this update in Jan 2018 when I added compiled versions to this update.
Update: June 01 2026, v0.8. Multiple updates.
License:
GPLv3
See also:
xips - an ip address expander/summarizer that uses the same parsing logic as ips