remove the /32 from ip string

user_13063142 0
Viewed 128

I'm trying to remove the /32 from a list of IPs The list is export with 14 columns. The IP address is in column 9 & 11

I tried with sed: sed 's_/32__' filename but this leaves a large amount of x.x.x.x/32 lines left. like;172.16.16.160/32;22;TCP

So I was thinking of using awk to select column 9 & 11 and pipe it thru sed, but this ends up in a mess and errors.

Just cut everything behind a / will not work, since there are also urls in the list.

Any help would be appreciated.

An (anonymized) data sample below where sed already ran on:

timestamp (UTC);ID;Threat Level;Category;Exporter IP address;Observation domain ID (ODID);Source MAC;Manufacturer;Source IP;Source Port;Destination IP;Destination Port;Protocol;Description
2020-03-14 13:54:10;20810;5;Ingress Traffic;::ffff:ac8:c8d0/128;101;00:10:8c:f0:cx:c0;Intel;8.8.8.8/32;49420;10.0.0.1/32;22;TCP;Ingress connection to common SSH port:  100% CertaintyHigh Severity Category: SSH Description: Shh
sed awk bash
3 Answers

The substitution you are using only substitutes the first occurrence. You have more than one occurrence in each line, so you will have to do another substitution like the previous one or, easier, do a global substitution:

sed 's_/32__g' filename

In any case, take into account that these substitutions act on the whole file, not only on the contents of columns 9 and 11.

user_30006290

You may accomplish this with awk only:

awk 'BEGIN{FS=OFS=";"} {sub(/\/32/, "", $9);sub(/\/32/, "", $11);}1' file

See the online demo

Details

  • BEGIN{FS=OFS=";"} - sets input and output field separator to ;
  • sub(/\/32/,"", $9);sub(/\/32/,"", $11); - remove first instances of /32 from Field 9 and 11
  • 1 - triggers default print action.
user_38329700

You can try:

gawk '{gsub("/32",""); print}' file

gsub removes all occurences of /32 on the entire input record ($0) and print outputs it.

user_51891200
Related