awk — IP Extraction & Classification

Extract all IPv4 addresses from any text

printf 'server 10.50.1.1 responded\ngateway 10.50.1.50 via 192.168.1.1\n' | \
  awk '{while(match($0,/[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+/)){print substr($0,RSTART,RLENGTH); $0=substr($0,RSTART+RLENGTH)}}'

Count unique IPs with frequency

cat <<'EOF' > /tmp/traffic.log
request from 10.50.1.20 to 10.50.1.1
request from 10.50.1.42 to 10.50.1.1
request from 10.50.1.20 to 8.8.8.8
request from 10.50.1.50 to 10.50.1.1
request from 10.50.1.20 to 1.1.1.1
EOF
awk '{while(match($0,/[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+/)){ip[substr($0,RSTART,RLENGTH)]++; $0=substr($0,RSTART+RLENGTH)}} END{for(i in ip) printf "%-16s %d\n",i,ip[i]}' /tmp/traffic.log | sort -k2 -rn

Classify IPs as private (RFC 1918) or public

cat <<'EOF' > /tmp/ips.txt
10.50.1.1
10.50.1.20
172.16.0.5
192.168.1.100
8.8.8.8
1.1.1.1
151.101.1.140
EOF
awk '{
    split($1,o,".")
    if(o[1]==10 || (o[1]==172 && o[2]>=16 && o[2]<=31) || (o[1]==192 && o[2]==168))
        priv++
    else
        pub++
} END{printf "private=%d public=%d\n",priv,pub}' /tmp/ips.txt

Extract IPs from ip addr — skip loopback

ip -4 -o addr show | awk '{split($4,a,"/"); if($2!="lo") print $2, a[1]}'

Parse ip route output into structured table

ip route | awk '{printf "%-20s via %-16s dev %-8s\n",$1,$3,$5}'