Boneyard Tools

Extract IP Addresses From Text and Logs

Paste raw log output, a config file, or any block of text and pull every IP address out of it in one pass. IPv4 addresses are range-checked octet by octet so junk like a version number cannot slip through, and the common IPv6 forms including the compressed double-colon notation are recognised too. Results are split into IPv4 and IPv6 lists, de-duplicated, and ready to copy.

How to extract IP addresses

  1. Paste a log file, config, or any text containing IP addresses into the text box.
  2. Watch the results update instantly as you type or paste.
  3. Read the IPv4 list on the left and the IPv6 list on the right, each with its own count.
  4. Check the total found shown above the results.
  5. Click Copy all to copy every address as one newline-separated list.

Examples

Pull IPs from a log line and skip a bad octet

accepted 10.0.0.5, denied 999.1.1.1, via 2001:db8::1
10.0.0.5
2001:db8::1

Duplicates collapse to one entry

192.168.0.1 GET, 192.168.0.1 POST, loopback ::1 ok
192.168.0.1
::1

A timestamp is not mistaken for IPv6

2026-06-11 08:00:01 login from 172.16.254.1
172.16.254.1

Frequently asked questions

How are invalid IPv4 addresses rejected?

Every one of the four dotted groups must fall in the 0 to 255 range. That means a candidate like 999.1.1.1 or 256.0.0.1 is matched by the pattern but then discarded, so only genuine dotted-quad addresses reach the results.

Which IPv6 forms are detected?

Full eight-group addresses and the compressed double-colon forms, whether the :: sits at the start, the middle, or the end. That includes the loopback ::1 and the all-zeros :: address, plus mixed hex groups like 2001:db8::8a2e:370:7334.

Are duplicate addresses removed?

Yes. Each unique address is listed once. Comparison is case-insensitive, so fe80::1 and FE80::1 count as the same address, and the first spelling that appears in your text is the one kept.

Will a timestamp like 08:00:01 be read as an IPv6 address?

No. A plain colon-separated clock time has only three groups and no double colon, so it does not match the full eight-group form or any compressed form. The IPv6 pattern deliberately requires either eight groups or a :: shorthand.

Does it pull an IP out of the middle of a longer number?

No. The IPv4 matcher is anchored so a dotted-quad has to stand on its own, not sit inside a longer run of digits or dots. This keeps it from carving a fake address out of something like a build number.

Are ports, CIDR masks, or zone IDs included?

No. The tool returns the bare address only. A trailing :8080 port, a /24 CIDR suffix, or an %eth0 zone identifier is treated as surrounding text and left out of the extracted address.

In what order do the results appear?

Within each list, addresses appear in the order they were first seen in your text. The Copy all button concatenates the IPv4 list first and then the IPv6 list, joined by newlines.

Is there a limit on how much text I can paste?

There is no fixed cap. The scan runs in your browser, so the practical ceiling is your device's memory. Even multi-megabyte log dumps are processed in a single pass without a round trip to a server.

Is my text private?

Yes. Everything runs locally in your browser and nothing is uploaded, which matters when the logs you are scanning contain internal hostnames or customer traffic.

Learn more

Related tools