iocextract icon indicating copy to clipboard operation
iocextract copied to clipboard

IPv4 extraction doesn't recognize netstat command input

Open deadbits opened this issue 6 years ago • 0 comments

iocextract doesn't seem to recognize any IPv4 addresses from netstat output since they all end with .<port number> or the protocol. For example, 10.1.1.117.4222 and 10.1.1.117.https. It pulls out IPv6 adddresses just fine, though.

This would be a super useful addition to have when triaging host events from an DFIR standpoint :)

Any suggested work around or is there a possible patch that would cover this?

deadbits avatar Jun 03 '19 18:06 deadbits