Truman BoyesZeros & Ones

archive · Ipv6

Using grep to find IPv6 connections in postfix logs

By Truman Boyes · · 1 min read

The following grep and egrep commands will match on IPv6 address blocks that have been assigned so far ( I updated this to match on the AFRINIC block ) :

grep smtp /var/log/maillog| egrep “(\[2[0,4,6,8]0[1-3]:|\[2A00:|\[2C00:)"

Which shows logs like the following:

May 28 05:00:50 inanna postfix/smtpd[25029]: connect from mout4.freenet.de[2001:748:100:40::2:6]
May 28 05:00:50 inanna postfix/smtpd[25029]: setting up TLS connection from mout4.freenet.de[2001:748:100:40::2:6]
May 28 05:00:50 inanna postfix/smtpd[25029]: TLS connection established from mout4.freenet.de[2001:748:100:40::2:6]: TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)
May 28 05:00:50 inanna postfix/smtpd[25029]: NOQUEUE: reject: RCPT from mout4.freenet.de[2001:748:100:40::2:6]: 450 <[email protected]>: Recipient address rejected: Greylisted for 300 seconds (see http://isg.ee.ethz.ch/tools/postgrey/help/suspicious.org.html); from=<[email protected]> to=<[email protected]> proto=ESMTP helo=<mout4.freenet.de>
May 28 05:00:51 inanna postfix/smtpd[25029]: disconnect from mout4.freenet.de[2001:748:100:40::2:6]
May 28 06:19:02 inanna postfix/smtpd[25551]: connect from mout4.freenet.de[2001:748:100:40::2:6]
May 28 06:19:03 inanna postfix/smtpd[25551]: setting up TLS connection from mout4.freenet.de[2001:748:100:40::2:6]
May 28 06:19:03 inanna postfix/smtpd[25551]: TLS connection established from mout4.freenet.de[2001:748:100:40::2:6]: TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)

Originally published on truman.net. See the archived copy.