Regular expression for isolating Comcast IP addresses in access log file for Apache

Question

Really the fact I want to use this for my Apache access log file is arbitrary and irrelevant, but it gives context to the situation.

I need to filter out records associated with Comcast IP addresses. Here's a list of the dynamic IP address ranges that Comcast assigns. I need a regular expression that can match all of those, and only those. I'll work on it on my own in the mean time but I figured there would be some RegEx guru out there on SO that would enjoy the problem.

Answer 1

Regex solution is possible, but very cumbersome, since the subnet mask is not multiple of 8. You will need to write a function to process the list and convert into regex.

It is better to use regex to grab the IP address and test the IP address against the list of IP addresses by Comcast. Simple implementation would be a set which allows you to search for the nearest number that is smaller than the argument.

Answer 2

That are a lot of IP adresses.

For example, 24.0.0.0/12 defines the IP range 24.0.0.1 - 24.15.255.255 . To match these numeric ranges with a regex:

24:    24
0-15:  [0-9]|1[0-5]
0-255: [0-9]|[1-9][0-9]|1[0-9][0-9]|2[0-4][0-9]|25[0-5]

Which gives

(24)\.([0-9]|1[0-5])\.([0-9]|[1-9][0-9]|1[0-9][0-9]|2[0-4][0-9]|25[0-5])\.([0-9]|[1-9][0-9]|1[0-9][0-9]|2[0-4][0-9]|25[0-5])

And that's just for 24.0.0.0/12 , 293 to go.

If you really want to do this you should write a small script to convert each IP range into a regex automatically.

Another approach would be to match any IP address and feed it into a callback that does the matching using an appropriate module / framework / API.