Question

I analysed logs with http://www.w3perl.com/, now i want the IPs made anonymous.

So i want them changed in all html-files in the whole directory.

1. I thought about just always turning the third and fourth octet into the same number for all IPs. But i read something about XOR-ing them – what is that about?

2. what is the better way to manage the replacing and why? sed or perl or another option?

I am pretty new to this, i hope i searched the other topics enough. I haven’t found anything related to my problem.
Thanks in advance and please excuse my English.
This website is just great – i’ve learned so much in the last days!

Answer 1

Masking IP-Address can be better achieved with perl. You can take a look here for using already available modules so that you won’t have to re-invent the wheel. Unfortunately I don’t know perl, so I can only offer sed solution.

You can use something like this for replacing all ip-address in your file.

sed 's/\([0-9]\{1,3\}\.\)\{3\}[0-9]\{1,3\}/**masked ip**/g' < yourfile > newfile

---

Your file:

[jaypal:~/Temp] cat fmp
this is 12.34.55.222 and 
21.3.34.5
also there is 133.42.55.23

Step 1: Identify IP-Addresses:

[jaypal:~/Temp] sed 's/\([0-9]\{1,3\}\.\)\{3\}[0-9]\{1,3\}/**&**/g' fmp
this is **12.34.55.222** and 
**21.3.34.5**
also there is **133.42.55.23**

Step 2: Replace IP-Address with your mask

[jaypal:~/Temp] sed 's/\([0-9]\{1,3\}\.\)\{3\}[0-9]\{1,3\}/**&**/g' fmp | sed '/\*\*.*\\*\*/s//**masked ip**/'
this is **masked ip** and 
**masked ip**
also there is **masked ip**

You can either make sed -i (in-line) substitution or use > to re-direct your output to another file.

---

Obviously this can be reduced to the following. The above would be useful for debugging as you can view what is being changed before making the change.

[jaypal:~/Temp] sed 's/\([0-9]\{1,3\}\.\)\{3\}[0-9]\{1,3\}/** masked ip **/g' fmp
this is ** masked ip ** and 
** masked ip **
also there is ** masked ip **

Good Luck!!

Update:

As posted by Mark in the comments, a perl variant would be –

perl -pe 's/\([0-9]\{1,3\}\.\)\{3\}[0-9]\{1,3\}/** masked ip **/g' < inputfile > outputfile

Update II:

As requested by OP, the following one-liner will find the files and perform the substitution.

find /path/to/dir/ -type f -name "*.html" -exec perl -ibak -pe 's/\([0-9]\{1,3\}\.\)\{3\}[0-9]\{1,3\}/** masked ip **/g' {} \;