$ipaddr (parse-spec) function


This function returns the IPv4 portion of the word given by parse-spec. The function returns the text that is delimited by the first punctuation or space following the address, if any. If the parse-spec value does not return an IP address, the match specification is not matched. This function is especially useful in a nested specification. For more information, see Nested-parse-expressions.

The following examples show target strings, parse expressions, and return values:

Target string

Parse expression

Return value

src: 192.168.1.1 dest: 10.1.1.2

$ipaddr ($2)

192.168.1.1

address tgt: 1.2.1.1:88 logged


$ipaddr (tgt: *)

1.2.1.1

Explanation: The port number is not returned.

drop=66.2.3.45

$ipaddr (drop=*)

66.2.3.45

POST https://1.2.3.4:88

$ipaddr( post *)

No match

Explanation: The matched text is not an IPv4 address.

Test 123

$ipaddr ($2)

No match

Explanation: The second word of the target string is not an IPv4 address.

Test string AAA

$ipaddr ($4)

No match

Explanation: There is no fourth word in the string. 

Test 192.1.1.1 value

$ipaddr (xxx: *)

No match

Explanation: There is no match for xxx: * in the target string.

Related topic


 

Tip: For faster searching, add an asterisk to the end of your partial query. Example: cert*

BMC Defender SIEM Correlation Server 6.2