Regex problem detecting IP address

Autopsy Help
1

Hi,

I think there might be a problem with the regex expression to search for ip address, Used on an evtx file however the IP was not detected correctly.

Captura

Used the following regex as an alternative but didnt work:
(25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9]?[0-9])(.(25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9]?[0-9])){3}

What could be the problem?

Thanks in advance for your answers.

Regards.

2

Hi Nicolas,

Can you try this regex and see if it gives you better results. The only difference between what you have and what I am proposing is the “.”.

(25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9]?[0-9])(.(25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9]?[0-9])){3}

Let me know how it turns out.

Kind regards.

Mark