IP Address Filter / Extractor

Every access log tells you who was talking to your server. IP Filter/Extractor lists the unique IP addresses in any log — with per-IP counts — or filters the log down to (or away from) a set of addresses you choose.

Handy for spotting scanners, isolating a known-good client, or proving a botnet pattern across a day of traffic.

Extract mode scans every line for both IPv4 addresses (validated octet-by-octet, so a stray 3-digit number is never mistaken for an IP unless every octet is 0–255) and IPv6 addresses in compressed :: form, then tallies how many times each one appears and lists them most-frequent first. Filter mode instead compares the IPs found on each line against a list you supply — one entry per line — using a prefix match, so a partial address like 192.168. matches any IP that starts with those octets, letting you keep or drop an entire subnet without listing every host in it. "Keep matching lines" retains only lines that contain at least one listed IP; "Remove matching lines" does the opposite, which is the faster way to strip a known-good address out of a log before hunting for the actual anomaly.

• Extract mode — unique IPs with per-address counts, ranked by frequency.
• Filter mode — keep or remove lines whose IP matches your list.
• Subnet support — partial IP prefixes match whole ranges, e.g. 10.0. matches every host in that /16.
• IPv4 + IPv6 — both address families are detected, including compressed IPv6 notation.
• Ranked output — most frequent address first, so the noisiest talker is always at the top.
• Live stats — total lines, unique IPs, kept and removed counts update with every run.

1. Paste your log lines — any format where IP addresses appear as plain text.
2. Pick a mode — extract to see every unique address, or filter to keep/remove lines by address.
3. Optional — paste one IP or subnet prefix per line in the match box when filtering.
4. Run. Review the counts, then copy the result for further analysis or a report.

Example 1 — Scanner hunt. Extract all IPs from nginx access logs; an address with a very high request count and mostly 401/403/404 responses (rather than 200s) is a strong brute-force or scanning signal.

Example 2 — Vendor isolation. Filter a log to only your monitoring vendor’s IP range to audit exactly what its uptime checks are hitting and how often.

Example 3 — Exclude noise. Remove your own office or VPN egress IP before analyzing a suspected attack, so your own testing traffic does not inflate the picture.

Example 4 — Subnet triage. If several source IPs from the same /24 show up in an extract, filter with that subnet’s prefix (e.g. 203.0.113.) to see every request from that range in one pass.

• Instant visibility — see who is talking to your server without writing a regex.
• Actionable filter — keep or drop lists let you isolate exactly the traffic you care about.
• Subnet-aware — prefix matching covers a whole range with one line.
• Ranked — frequency ordering surfaces the busiest addresses first.
• Private — all matching happens in-browser, addresses are never sent anywhere.