MS ISA Server confusion.

August 10, 2007 9:45 AM

OK, I'll put all of the relevant information below the cut, but the general issue is how do I convert a dotted quad IP address (xxx.xxx.xxx.xxx) to the integers stored in Microsoft ISA Server logs?

The guy who usually manages the server and who probably knows how to do this is out of town and my boss is needing me to search for entries in the logs.
I'd love a link to a resource on how to do this, but all I can find anywhere are information on how to convert the integers in the ISA server logs to IP addresses, not the other way around.

The MS reference for the Int->IP is at:
http://support.microsoft.com/kb/891223

posted by Ikazuchi to Computers & Internet (8 answers total)

(256 * 256 * 256) * 1st quad
+ (256 * 256) * 2nd quad
+ 256 * 3rd quad
+ 4th quad
posted by smackfu at 9:49 AM on August 10, 2007

Best answer: Or this tool will do it.
posted by procrastination at 9:50 AM on August 10, 2007

If you have an IP address A.B.C.D, then you can use one of these equivalent formulas:

256 × (256 × ((256 × A) + B) + C) + D

or

256³ × A + 256² × B + 256 × C + D

or

16,777,216 × A + 65,536 × B + 256 × C + D
posted by Khalad at 9:52 AM on August 10, 2007

You want a "resource"? Write something. Do you have any programming know-how?

In Python,

n = your_number
q = []
quad = 256 * 256 * 256
while quad > 0:
octet, n = divmod(n, quad)
q.append(str(octet))
quad = quad/256
return '.'.join(q)


You could do this in a spreadsheet, if you're not feeling too programmy today.
posted by cmiller at 9:56 AM on August 10, 2007

/me curses MeFi input boxes.
posted by cmiller at 9:56 AM on August 10, 2007

Or cmiller, you could just do:

from socket import inet_aton
from struct import unpack

print unpack("!i", inet_aton("xxx.xxx.xxx.xxx")[0]
posted by grouse at 10:15 AM on August 10, 2007

I meant

print unpack("!i", inet_aton("xxx.xxx.xxx.xxx"))[0]
posted by grouse at 10:30 AM on August 10, 2007

Response by poster: Thanks a lot folks. AskMeFi to the rescue!
posted by Ikazuchi at 11:00 AM on August 10, 2007