By using sed change IP Address what ever it is in brackets and quotes as in Suricata.yaml

Question

I need to change IP address using sed in suricata.yaml file infront of HOME_NET.

HOME_NET: "[172.20.16.25]"

I can manage what ever IP address by using the following regex.

sed -i "s/[0-9]\{1,3\}.[0-9]\{1,3\}.[0-9]\{1,3\}.[0-9]\{1,3\}/"$IP"/g"

Problem is it will change all IP addresses in file. I just interested in that is in front of HOME_NET.

Answer 1

sed -i "/^ *HOME_NET/s/[0-9]\{1,3\}.[0-9]\{1,3\}.[0-9]\{1,3\}.[0-9]\{1,3\}/"$IP"/g"

To elaborate a bit: a single line of sed script is composed of a line matching rule (called address in the documentation) and an action to be executed (command). The /^ *HOME_NET/ part is a simple line matching rule, while the s/../../g part is the substitution command. If you don't specify a line matching rule, all lines are matched.

Try man sed to learn a bit more.