I'm trying to learn RegEx using ImmersiveLabs/LinkedInLearning and other web-based resources and things are going well. There's a small question to which I'm not sure how to even Google for an answer. Scenario, Azure ATP Query wherein I wanted to match Private Addressing Scheme

| where From_IP matches regex @'(^127\.)|(^10\.)|(^172\.1[6-9]\.)|(^172\.2[0-9]\.)|(^172\.3[0-1]\.)|(^192\.168\.)'

It works well! Matches what I want it to. The question is - why?! For e.g. (~172.2[0-9].) shouldn't this only match on the first two octets of the string 172.20.1.9 ? Why is then the entire IP matched successfully? Seems weird for me to question something that is working. Any tips are appreciated.

CodePudding user response：

There is no $ in your regex so your regex does not asserts position at the end of a line, so it basically doesn't care what comes after 172.20. , see for more info: regex101.com/r/TgjdVz/1

In addition to match all private IPv4 subnets use to following regex.

^(10(\.(25[0-5]|2[0-4][0-9]|1[0-9]{1,2}|[0-9]{1,2})){3}|((172\.(1[6-9]|2[0-9]|3[01]))|192\.168)(\.(25[0-5]|2[0-4][0-9]|1[0-9]{1,2}|[0-9]{1,2})){2})$