### Compile and Install grepcidr

Source: https://context7.com/jrlevine/grepcidr3/llms.txt

Build the grepcidr utility from source using make. Install it to standard locations or a custom prefix. The test suite can be run to verify the build.

```bash
# Compile
make

# Install to /usr/local/bin and /usr/local/man/man1
make install

# Optional: install to a custom prefix
make INSTALLDIR=/opt/grepcidr install

# Run the test suite (requires a compiled binary)
make test
# Output:
# Running test suite...
# Running tests/test_o_option.sh...
# All tests passed!
# All test suites passed!

# Debug build (prints hex representation of parsed IPs and matches to stderr)
make CFLAGS="-g -Wall -pedantic -DDEBUG=1"
```

--------------------------------

### Batch Processing Example

Source: https://github.com/jrlevine/grepcidr3/blob/main/tests/TEST_O_OPTION.md

Process multiple IP addresses from a file against a set of patterns using the -o option and redirect the classified patterns to an output file.

```bash
cat ips.txt | ./grepcidr -o -f patterns.txt > classifications.txt
```

--------------------------------

### Narrowest Match Example

Source: https://github.com/jrlevine/grepcidr3/blob/main/tests/TEST_O_OPTION.md

Demonstrates how the -o option selects the narrowest CIDR pattern when an IP matches multiple overlapping ranges. Ensure patterns.txt contains the specified CIDR ranges.

```bash
cat patterns.txt
192.168.0.0/16
192.168.1.0/24
192.168.1.128/25

echo "192.168.1.200" | ./grepcidr -o -f patterns.txt
# Output: 192.168.1.128/25
```

--------------------------------

### Show grepcidr version

Source: https://context7.com/jrlevine/grepcidr3/llms.txt

Display the version of the grepcidr tool using the -V flag. This is standard practice for verifying the installed version or for troubleshooting.

```bash
grepcidr -V
```

--------------------------------

### Anchor matches to the start of a line

Source: https://context7.com/jrlevine/grepcidr3/llms.txt

Use the -a flag to ensure that matched IP addresses appear at the beginning of a line, optionally preceded by whitespace. This is helpful for parsing structured log files where the IP is the first field.

```bash
grepcidr -a "192.168.0.0/16" /var/log/auth.log
```

```bash
# Combine with -v to find lines NOT starting with a private IP
grepcidr -av "10.0.0.0/8,192.168.0.0/16" iplist.txt
```

--------------------------------

### AWS IP Range Classification Example

Source: https://github.com/jrlevine/grepcidr3/blob/main/tests/TEST_O_OPTION.md

Classify a specific IP address against a set of AWS IP ranges using the -o option. The output will be the most specific matching AWS CIDR range.

```bash
# Create a pattern file with AWS IP ranges
cat > aws_ranges.txt <<EOF
52.94.0.0/16
52.95.0.0/16
54.239.0.0/16
EOF

# Classify an IP
echo "52.94.76.35" | ./grepcidr -o -f aws_ranges.txt
# Output: 52.94.0.0/16
```

--------------------------------

### Network Hierarchy Classification Examples

Source: https://github.com/jrlevine/grepcidr3/blob/main/tests/TEST_O_OPTION.md

Classify IP addresses within a network hierarchy using overlapping CIDR patterns and the -o option. Each IP is matched against the most specific pattern in the hierarchy.

```bash
# Create overlapping patterns representing network hierarchy
cat > network.txt <<EOF
10.0.0.0/8          # Corporate network
10.10.0.0/16        # Branch office
10.10.10.0/24       # Development subnet
10.10.10.128/25     # Production servers
EOF

# Classify IPs in different parts of the hierarchy
echo "10.50.1.1" | ./grepcidr -o -f network.txt
# Output: 10.0.0.0/8

echo "10.10.5.1" | ./grepcidr -o -f network.txt
# Output: 10.10.0.0/16

echo "10.10.10.50" | ./grepcidr -o -f network.txt
# Output: 10.10.10.0/24

echo "10.10.10.200" | ./grepcidr -o -f network.txt
# Output: 10.10.10.128/25
```

--------------------------------

### Load Patterns from a File with grepcidr (-f)

Source: https://context7.com/jrlevine/grepcidr3/llms.txt

Use the -f option to load CIDR patterns from a file, with one pattern per line. Lines starting with '#' are ignored, and inline comments are also supported. This is useful for managing large or reusable pattern sets.

```bash
# patterns.txt contents:
# 10.0.0.0/8       # Private class A
# 172.16.0.0/12    # Private class B
# 192.168.0.0/16   # Private class C
# 2001:db8::/32    # Documentation prefix

grepcidr -f patterns.txt /var/log/firewall.log

# Cross-reference two IP lists: output only IPs that appear in BOTH files
grepcidr -f list1.txt list2.txt

# Build a blocklist by removing whitelisted networks
some_script | grepcidr -vf whitelist.txt > blocklist.txt
```

--------------------------------

### Create New Test Script

Source: https://github.com/jrlevine/grepcidr3/blob/main/tests/README.md

Template for creating a new test script for a specific grepcidr option. Follow this pattern for creating executable test files.

```bash
make test

```

--------------------------------

### Run Comprehensive Test Suite

Source: https://github.com/jrlevine/grepcidr3/blob/main/tests/TEST_O_OPTION.md

Execute the automated test suite to cover all aspects of the -o option functionality.

```bash
./test_o_option.sh
```

--------------------------------

### Make Test Script Executable

Source: https://github.com/jrlevine/grepcidr3/blob/main/tests/README.md

Set execute permissions for a newly created test script. This is a required step before the script can be run.

```bash
chmod +x test_<option>.sh
```

--------------------------------

### Run All Tests

Source: https://github.com/jrlevine/grepcidr3/blob/main/tests/README.md

Execute the entire test suite for grepcidr. This command discovers and runs all test scripts automatically.

```bash
make test
```

--------------------------------

### AWS Real-World Range Sizes Pattern

Source: https://github.com/jrlevine/grepcidr3/blob/main/tests/AWS_TEST_VALIDATION.md

Uses a pattern file with a mix of realistic AWS CIDR block sizes, including /13, /15, /16, /21, and /22. Verifies correct handling of various range granularities.

```text
3.0.0.0/15	EC2
13.34.0.0/16	CLOUDFRONT
18.208.0.0/13	EC2
52.94.0.0/22	EC2
52.95.128.0/21	S3
54.239.0.0/16	CLOUDFRONT
```

--------------------------------

### Batch IP Classification with Named Networks

Source: https://context7.com/jrlevine/grepcidr3/llms.txt

Annotate a file of IP addresses (one per line) with their corresponding network names from a provided CIDR list. The `named_networks.txt` file should contain CIDR blocks and their associated names, separated by tabs.

```bash
cat ips.txt | grepcidr -o -f named_networks.txt > annotated.txt
```

--------------------------------

### Run Specific Option Test

Source: https://github.com/jrlevine/grepcidr3/blob/main/tests/README.md

Execute the test script for the '-o' option. This script verifies the functionality of printing matching CIDR patterns instead of the input line.

```bash
./tests/test_o_option.sh
```

--------------------------------

### Test Execution Script

Source: https://github.com/jrlevine/grepcidr3/blob/main/tests/AWS_TEST_VALIDATION.md

Shell script output showing the successful execution of all 33 tests, including the 5 specific AWS use case tests. Confirms the functionality passes.

```bash
$ ./test_o_option.sh
...
Test 29: AWS Use Case - Tab-delimited CIDR + Service Name
✓ Test 29: AWS IP with service name (EC2)
✓ Test 30: AWS multiple IPs with service names
✓ Test 31: AWS narrowest match with service metadata
✓ Test 32: AWS lsof workflow simulation
✓ Test 33: AWS real-world range sizes

=========================================
Test Summary
=========================================
Total tests: 33
Passed: 33
All tests passed!
```

--------------------------------

### Expected Output from Simulated lsof Workflow

Source: https://github.com/jrlevine/grepcidr3/blob/main/tests/AWS_TEST_VALIDATION.md

The expected sorted output after processing the simulated lsof data, identifying AWS services for each IP. This validates the complete pipeline.

```text
13.34.0.0/16	CLOUDFRONT
52.94.0.0/16	EC2
52.95.128.0/21	S3
54.239.0.0/16	CLOUDFRONT
```

--------------------------------

### Print Matching Pattern with grepcidr (-o)

Source: https://context7.com/jrlevine/grepcidr3/llms.txt

Use the -o option to print the specific CIDR pattern that matched an IP address, instead of the entire input line. When multiple patterns match, the narrowest (most specific) pattern is chosen. This is useful for hierarchical network classification.

```bash
# Identify which network a single IP belongs to
echo "192.168.1.200" | grepcidr -o -f patterns.txt
# Output: 192.168.1.128/25   (narrowest of 192.168.0.0/16, 192.168.1.0/24, 192.168.1.128/25)

# Hierarchical network classification
cat > network.txt <<'EOF'
10.0.0.0/8          # Corporate
10.10.0.0/16        # Branch office
10.10.10.0/24       # Dev subnet
10.10.10.128/25     # Prod servers
EOF

echo "10.10.10.200" | grepcidr -o -f network.txt
# Output: 10.10.10.128/25

echo "10.10.5.1" | grepcidr -o -f network.txt
# Output: 10.10.0.0/16
```

--------------------------------

### Quick mode to suppress rDNS false matches

Source: https://context7.com/jrlevine/grepcidr3/llms.txt

The -q flag activates 'Quick Mode', which prevents false positives from reverse DNS names by ignoring IPv4 addresses that are immediately preceded or followed by a dot. This is useful when analyzing logs that might contain rDNS entries.

```bash
# Analyze a log file that contains rDNS names without false matches
grepcidr -q "1.2.3.0/24" /var/log/dns_queries.log
```

--------------------------------

### Analyze Active Connections with grepcidr

Source: https://github.com/jrlevine/grepcidr3/blob/main/tests/AWS_TEST_VALIDATION.md

Processes active network connections, extracts IP addresses using `grep`, and then uses `grepcidr` with the prepared AWS CIDR file to identify services. This demonstrates the complete workflow.

```bash
lsof -i -nP | grep -oE '[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+' |
    grepcidr -o -f aws-cidrs.txt
```

--------------------------------

### Extract CIDR and Service Name from AWS JSON

Source: https://github.com/jrlevine/grepcidr3/blob/main/tests/AWS_TEST_VALIDATION.md

Uses `jq` to extract the IP prefix and service name from the downloaded AWS JSON file, formatting them as tab-delimited lines. This creates the pattern file for `grepcidr`.

```bash
jq -r '.prefixes[] | "\(.ip_prefix)\t\(.service)"' aws-ranges.json > aws-cidrs.txt
```

--------------------------------

### Multiple AWS IPs with Different Services Pattern

Source: https://github.com/jrlevine/grepcidr3/blob/main/tests/AWS_TEST_VALIDATION.md

Validates batch processing of multiple IP addresses, each mapping to different AWS services. The expected output is sorted by IP range.

```text
13.34.0.0/16	CLOUDFRONT
52.95.128.0/21	S3
54.239.0.0/16	CLOUDFRONT
```

--------------------------------

### Basic CIDR and Range Matching with grepcidr

Source: https://context7.com/jrlevine/grepcidr3/llms.txt

Filter log files or stdin for lines containing IP addresses that fall within specified CIDR blocks, IP ranges, or single IP addresses. Patterns can be combined with commas or whitespace.

```bash
# Match any loopback address (IPv4 or IPv6) in a log file
grepcidr 127.0.0.0/8,::1 /var/log/iplog

# Match an arbitrary IPv4 range
grepcidr "192.168.0.0/16" /var/log/access.log

# Match an IPv6 CIDR block
grepcidr "2001:3def:1234::/48" /var/log/iplog

# Match a single IPv4 address
grepcidr 10.0.0.1 /var/log/access.log

# Example output (lines from the file that contain a matching IP):
# 2024-01-15 08:23:11 127.0.0.1 GET /health 200
# 2024-01-15 08:24:05 192.168.5.42 POST /api/data 201
```

--------------------------------

### Extract and Classify Remote IPs from Open Connections

Source: https://context7.com/jrlevine/grepcidr3/llms.txt

Use this to extract all remote IP addresses from open network connections and classify them against a list of AWS CIDRs. Requires `lsof`, `grep`, and `grepcidr`.

```bash
lsof -i -nP | grep -oE '[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+' | \
    grepcidr -o -f aws-cidrs.txt | sort -u
```

--------------------------------

### Narrowest AWS Match with Service Metadata Pattern

Source: https://github.com/jrlevine/grepcidr3/blob/main/tests/AWS_TEST_VALIDATION.md

Tests the narrowest match selection logic with overlapping AWS IP ranges and detailed service metadata. Ensures the most specific match is chosen.

```text
52.95.0.0/16	S3_GLOBAL
52.95.128.0/21	S3_US_EAST_1
52.95.128.0/24	S3_US_EAST_1A
```

--------------------------------

### Download AWS IP Ranges

Source: https://github.com/jrlevine/grepcidr3/blob/main/tests/AWS_TEST_VALIDATION.md

Downloads the latest AWS IP ranges from the official source into a JSON file. This is the first step in preparing data for service identification.

```bash
curl -s https://ip-ranges.amazonaws.com/ip-ranges.json > aws-ranges.json
```

--------------------------------

### Match IPs against a CIDR file

Source: https://context7.com/jrlevine/grepcidr3/llms.txt

Reads CIDR ranges from a file and matches individual IP addresses from standard input against them. Useful for classifying IPs against predefined lists like AWS service ranges.

```bash
cat > aws-cidrs.txt <<'EOF'
52.94.0.0/16	EC2
52.95.128.0/21	S3
54.239.0.0/16	CLOUDFRONT
EOF

echo "52.94.76.35" | grepcidr -o -f aws-cidrs.txt
```

```bash
lsof -i -nP | grep -oE '[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+' | \
    grepcidr -o -f aws-cidrs.txt
```

--------------------------------

### Abuse detection pipeline

Source: https://context7.com/jrlevine/grepcidr3/llms.txt

Identifies customers (from 'ournetworks' CIDR list) appearing in an external 'blocklist.txt' file, redirecting the output to 'abuse.log' for further analysis.

```bash
# Find your own customers (CIDRs in ournetworks) appearing in an external blocklist
grepcidr -f ournetworks blocklist.txt > abuse.log
```

--------------------------------

### Filter Mail Server Connections with Partner CIDRs

Source: https://context7.com/jrlevine/grepcidr3/llms.txt

This script filters incoming mail server connections, accepting only those from known partner networks and rejecting others. It pipes the output of `postfix_ips.sh` to `grepcidr` for filtering against `partner_cidrs.txt`.

```bash
postfix_ips.sh | grepcidr -vf partner_cidrs.txt > reject_candidates.txt
```

--------------------------------

### Count matching lines with grepcidr

Source: https://context7.com/jrlevine/grepcidr3/llms.txt

Use the -c flag to count the number of lines that match the specified CIDR ranges. This is useful for summarizing occurrences of specific IP address blocks in log files.

```bash
grepcidr -c "10.0.0.0/8,172.16.0.0/12,192.168.0.0/16" /var/log/access.log
```

```bash
grepcidr -cv "10.0.0.0/8,172.16.0.0/12,192.168.0.0/16" /var/log/access.log
```

--------------------------------

### AWS service identification pipeline

Source: https://context7.com/jrlevine/grepcidr3/llms.txt

Downloads the latest AWS IP ranges JSON, converts it into a tab-delimited file mapping CIDR blocks to AWS services, and saves it as 'aws-cidrs.txt'. This file can then be used with grepcidr for IP classification.

```bash
# 1. Download AWS IP ranges and convert to tab-delimited CIDR + service file
curl -s https://ip-ranges.amazonaws.com/ip-ranges.json | \
    jq -r '.prefixes[] | "\(.ip_prefix)\t\(.service)"' > aws-cidrs.txt
```

--------------------------------

### AWS IP with Service Name Pattern

Source: https://github.com/jrlevine/grepcidr3/blob/main/tests/AWS_TEST_VALIDATION.md

Defines the tab-delimited format for AWS IP ranges and their associated services. Ensures the entire pattern line, including tabs and service names, is preserved.

```text
52.94.0.0/16	EC2
52.95.0.0/21	S3
54.239.0.0/16	CLOUDFRONT
```

--------------------------------

### Suppress misalignment warnings with -s

Source: https://context7.com/jrlevine/grepcidr3/llms.txt

The -s flag enables 'sloppy CIDR' mode, which silently corrects misaligned CIDRs (e.g., 192.168.1.1/24 instead of 192.168.1.0/24) without printing warnings to stderr. This is useful when working with blocklists that may contain such inaccuracies.

```bash
# Use a blocklist that contains misaligned CIDRs without noisy warnings
grepcidr -sf blocklist_raw.txt /var/log/access.log
```

--------------------------------

### Segment Combined Log into Internal and External Traffic

Source: https://context7.com/jrlevine/grepcidr3/llms.txt

Use these commands to split a combined log file into separate files for internal and external traffic based on private IP address ranges. The first command isolates internal traffic, and the second isolates external traffic.

```bash
grepcidr    "10.0.0.0/8,172.16.0.0/12,192.168.0.0/16" combined.log > internal.log
```

```bash
grepcidr -v "10.0.0.0/8,172.16.0.0/12,192.168.0.0/16" combined.log > external.log
```

--------------------------------

### Simulated lsof Output for AWS Service Identification

Source: https://github.com/jrlevine/grepcidr3/blob/main/tests/AWS_TEST_VALIDATION.md

Provides simulated lsof output containing IP addresses. This snippet is used to test the end-to-end workflow of extracting IPs and identifying AWS services.

```text
chrome    1234 user   42u  IPv4  52.94.76.35:443
firefox   5678 user   18u  IPv4  54.239.12.100:80
vscode    9012 user   25u  IPv4  13.34.78.90:443
node      3456 user   11u  IPv4  52.95.130.25:3000
```

--------------------------------

### Match CIDR ranges within input CIDR ranges

Source: https://context7.com/jrlevine/grepcidr3/llms.txt

Use -C to match input CIDR ranges that are fully contained within a specified range, or -D to match input ranges that overlap with a specified range. This is useful when your input file contains CIDR blocks instead of individual IPs.

```bash
cat > subnets.txt <<'EOF'
192.168.1.0/24
10.0.5.0/24
172.16.100.0/22
EOF

# -C: only print ranges that are fully inside 10.0.0.0/8
grepcidr -C 10.0.0.0/8 subnets.txt
```

```bash
# -D: print ranges that partially overlap with 172.16.0.0/12
grepcidr -D 172.16.0.0/12 subnets.txt
```

--------------------------------

### Invert Matching with grepcidr (-v)

Source: https://context7.com/jrlevine/grepcidr3/llms.txt

Use the -v option to select lines that do NOT contain IP addresses matching any of the specified patterns. Lines without any IP addresses are always suppressed, even with -v.

```bash
# Output all access log lines NOT from private networks
grepcidr -v "10.0.0.0/8,172.16.0.0/12,192.168.0.0/16" /var/log/access.log

# Remove known-good IPs and keep everything else
grepcidr -vf known_good.txt suspicious.log > review.log
```

--------------------------------

### Use inline pattern argument with -e

Source: https://context7.com/jrlevine/grepcidr3/llms.txt

The -e flag allows specifying the pattern argument directly on the command line, similar to grep's -e option. This improves clarity in scripts, especially when combining multiple patterns or file arguments.

```bash
# Explicit -e for scripting clarity
grepcidr -e "203.0.113.0/24" access.log error.log
```

```bash
# Multiple -e flags are not supported; use comma separation instead
grepcidr -e "198.51.100.0/24,203.0.113.0/24" access.log
```

--------------------------------

### Ignore invalid patterns with grepcidr

Source: https://context7.com/jrlevine/grepcidr3/llms.txt

The -i flag allows grepcidr to silently skip lines in pattern files that are not valid CIDRs, ranges, or IP addresses. This is useful for processing threat intelligence feeds or configuration files that may contain comments or mixed content.

```bash
# Use a raw threat-intel feed (may contain non-IP lines) as a pattern source
grepcidr -if threat_feed.txt /var/log/access.log
```

```bash
# Cross-reference with a file that has mixed content
grepcidr -if mixed_list.txt ips_to_check.txt
```

--------------------------------

### Suppress filename prefix with -h

Source: https://context7.com/jrlevine/grepcidr3/llms.txt

When searching across multiple files, the -h flag suppresses the default behavior of prefixing each matched line with its source filename. This is useful for cleaner output when filenames are not needed.

```bash
# Search multiple logs but omit filenames in output
grepcidr -h "10.0.0.0/8" /var/log/auth.log /var/log/access.log /var/log/syslog
```

=== COMPLETE CONTENT === This response contains all available snippets from this library. No additional content exists. Do not make further requests.