IP Address Extractor — IPv4 + IPv6 from Logs & Text
Extract IPv4 and IPv6 addresses from logs, text, or HTML. Validates octets, deduplicates. Free, in-browser.
About IP Address Extractor
An IP address extractor scans text — server logs, firewall reports, packet dumps, support tickets — and pulls out every valid IPv4 (e.g. 192.168.1.1) and IPv6 address (e.g. 2001:db8::1), validating each against the address format and deduplicating the result. The ZTools IP Address Extractor runs entirely in the browser, supports both protocol versions, drops obvious non-IPs (invalid octets, malformed IPv6), and exports a clean list for use in firewalls, allow / deny lists, geo-IP lookup, or incident response.
Use cases
- Log analysis. Paste a 10MB nginx access log; extractor pulls every client IP. Feed list into geo-IP lookup or rate-limiting rules.
- Incident response. Suspect IPs from intrusion alerts collected in a single pass. Pipe to threat-intelligence lookup before blocking.
- Firewall rule generation. List of trusted IPs scattered across a config doc. Extract once, format as iptables / Cloudflare allow-list rules.
- Traffic-source audit. Application logs with embedded IPs. Extract + group by /24 subnet to identify large source clusters or potential abuse.
How it works
- Paste source text. Logs, configs, JSON dumps. No size limit other than browser memory.
- Match IPv4 pattern. Four octets 0-255 separated by dots. Strict octet validation drops "999.999.999.999" and similar garbage.
- Match IPv6 pattern. 8 hex groups separated by colons; supports compressed (::) and embedded IPv4 (::ffff:1.2.3.4) forms.
- Deduplicate + sort. Exact dedup; optional: numeric sort (groups identical /24 subnets together).
- Export. Plain list or CSV with version column (v4/v6) and frequency count.
Examples
Input: nginx log: "192.168.1.1 - - [date] GET /…"
Output: 192.168.1.1
Input: Mixed: "Client 10.0.0.1, server 2001:db8::1, fail 999.1.1.1"
Output: 10.0.0.1, 2001:db8::1 (the 999. address rejected by octet validation)
Input: Frequency analysis on 10k log lines
Output: Top 10 IPs sorted by request count.
Frequently asked questions
Does it handle IPv6 compressed notation?
Yes — "::1", "fe80::", "2001:db8:0:0:0:0:0:1" all parse correctly. Output is normalised to standard form unless raw mode requested.
What about CIDR blocks (10.0.0.0/24)?
Optional CIDR mode extracts both the IP and prefix length. Default extracts only the IP portion.
Why are some "valid-looking" IPs dropped?
Octet validation: each must be 0-255. "256.1.1.1" is rejected. Heuristics also drop version strings (1.2.3.4 inside "version 1.2.3.4 build 5") if explicit context is detected.
Can I extract MAC addresses?
No — different format. Use a regex or a dedicated MAC-extractor tool. (MAC = 00:1A:2B:3C:4D:5E hex pattern.)
Is the input uploaded?
No — client-side only. Logs may contain sensitive info; tool processes locally.
Should I trust the extracted list?
Always validate before acting (block, allow, charge). Logs can contain spoofed IPs; geo-IP lookups beat raw extraction for accuracy.
Pro tips
- Sort by /24 prefix to spot subnet-level patterns (a single source spreading across many client IPs).
- For abuse / fraud analysis, combine with geo-IP and threat-intel lookups — raw IPs alone are limited.
- Strip private (RFC1918) ranges if extracting from external-traffic logs to focus on real internet sources.
- Use frequency counts to spot top talkers; then drill into their full requests, not just IP.
- Be careful before adding IPs to deny lists — false positives lock out legitimate users behind shared NAT or proxies.
Reviewed by Ahsan Mahmood · Last updated 2026-05-05 · Part of ZTools.
For the full,
formatted version of this page, please enable JavaScript and reload
https://ztools.zaions.com/ip-address-extractor.