Alternative to Pastebin and replacing MAC Addresses with xx:xx:xx:xx:xx:xx automatically?

[jksmurf]

Hi,

I have two questions on the subject title, please:

Firstly, I need to post router logs occasionally, but for some reason pastebin doesn't like my IP (or maybe my ISP doesn't, I am not sure). Anyway, rather than getting my IP released as suggested, is there a recommended alternative that is relatively safe?

Secondly, I used to use pastebin.com a few years ago when posting Kodi logs for a PVR system and IIRC it used to automatically replace sensitive details such as MAC addresses with XX:XX:XX:XX:XX:XX. I am a wee bit nervous about publishing MAC addresses especially as there might be some from friends or guests that stay with my family (although I appreciate most e.g. iOS devices can mask these with made-up MAC address these days).

I tried https://pastecode.io/ with a "burn when read" option, but when I looked at the details in the generated link, the MAC addresses were unchanged. I could not find any documentation on this, when I did a limited google search, on how to enable such an option.

I did see some references to loading the log into a spreadsheet and running regex expressions etc but it seemed too complicated for the occasions I need to upload it.

If there are any suggestions for simple Windows (CMD Line/Batch/Exe is OK) software that does this, it would be great.

TIA

k.

 

[sfx2000]

I have two questions on the subject title, please:

Firstly, I need to post router logs occasionally, but for some reason pastebin doesn't like my IP (or maybe my ISP doesn't, I am not sure). Anyway, rather than getting my IP released as suggested, is there a recommended alternative that is relatively safe?

Any pastebin post is public...

If you need to provide logs to someone - I would zip them up with a PW, and either send them directly, or drop them into something like dropbox or similar...

 

[dosborne]

Notepad search and replace (CTRL-H Replace All) function can replace a portion or full MAC address (or any specified text) in a log file with whatever you want.

Easily scripted on a linux platform with standard commands ("grep", "sed" etc) as well.

Maybe one of those will solve your issue?

 

[jksmurf]

Notepad search and replace (CTRL-H Replace All) function can replace a portion or full MAC address (or any specified text) in a log file with whatever you want.

Easily scripted on a linux platform with standard commands ("grep", "sed" etc) as well.

Maybe one of those will solve your issue?

Thank you, I did think about search replace but when there are multiple MAC addresses it’s a bit cumbersome, hence the thought that there must be some regex expression which would find and replace a pattern; or better yet a Win utility that does the same, acting on a text file.

I actually found one but I don’t know which program to use it in (I’m primarily a windows user).

 

[XIII]

Visual Studio Code (an editor) can do that (search/replace regular expressions).

 

[jksmurf]

Visual Studio Code (an editor) can do that (search/replace regular expressions).

Thanks to @XIII I got it to do what I wanted to do.

Visual Studio Code (VSC) has a relatively easy way to handle regex for this particular example. I did a few screenshots if anyone wants to do this in future (in Windows), using VSC.

In VSC:

• The Find expression is: "..:..:..:..:..:.." (without quotes)
• The Replace expression is: "XX:XX:XX:XX:XX:XX" (without quotes)

Quick Steps

1. Install VSC. I installed VSC without any of the context menus etc. i.e unchecked all. After starting it, I suggest you get rid of the annoying welcome tab (just click the 'x').
2. Open the log file you downloaded from your Router with File, Open, then browse to Syslog.txt or whatever it is called.
3. Select Edit, Replace in Files; it will bring up two boxes, a Find Box and a Replace Box.
4. Copy paste "..:..:..:..:..:.." into the Find box (make sure the ".*" in the right of that box is selected first); then paste "XX:XX:XX:XX:XX:XX" into the Replace box; then click the little "ab to ac" symbol to the right of the Replace box. It should show some text that says "Replace All (Ctrl+Alt+Enter)".
5. You should get a prompt to do just that i.e. "Replace". Click that prompt.
6. It should now do the replacement and IIRC, will save the file automatically. If not, just save it.
7. If you need to do it again, select the clear search results symbol above the Find box first.

HTH

References:

• The Regex for MAC Addresses

Some hints on searching and replacing within VSC

• Hint 1
• Hint 2

 

[RMerlin]

A lighter option like Notepad++ would also work - it also supports regexp.

 

[jksmurf]

A lighter option like Notepad++ would also work - it also supports regexp.

Right you are, very simple too.

In Notepad++ (similar to in VSC):

• The Find expression is: "..:..:..:..:..:.." (without quotes)
• The Replace expression is: "XX:XX:XX:XX:XX:XX" (without quotes)

Quick Steps:

1. Install Notepad++. See download link below.
2. Open the log file you downloaded from your Router with File, Open, then browse to Syslog.txt or whatever it is called.
3. Select the Search, Replace menu.
4. Copy paste "..:..:..:..:..:.." into the "Find What" box; then paste "XX:XX:XX:XX:XX:XX" into the "Replace with" box; then select the "Regular Expression" option.
5. Then just click the "Replace All" button
6. It should now do the replacement. Save it as a new file.

HTH

References:

• Notepad++ Downloads
• The Regex for MAC Addresses

 

[jksmurf]

Was just mulling whether, for troubleshooting purposes, it would be more useful to add a regex that retains the FIRST 3 Octets of the MAC address and replaces only the LAST 3 Octets with 'XX' e.g.AA:22:CC:44:EE:66 becomes AA:22:CC:XX:XX:XX.

Would anyone know what the regex would be to achieve this please? I started to look into regex but my eyes just started rolling into the back of my head. I could probably do it but it'll take me forever to read up on it and then trial and error it out, so I thought there must be some clever person here who can answer it in a far shorter period of time

[EDIT1]

This works, but not sure how robust it is:

• The Find expression is: "..:..:..:" (without quotes)
• The Replace expression is: "XX:XX:XX:" (without quotes)

[EDIT2]

• See my post below for more robust solutions

k.

 

[sfx2000]

Was just mulling whether, for troubleshooting purposes, it would be more useful to add a regex that retains the FIRST 3 Octets of the MAC address and replaces only the LAST 3 Octets with

Do the inverse - the first three octets define the vendor, the rest are randomly assigned... That being said, the whole IEEE OUI masking thing, doesn't really matter with MAC randomization...

These days it's ephemeral at best, and can change at any time...

 

[jksmurf]

Do the inverse - the first three octets define the vendor, the rest are randomly assigned... That being said, the whole IEEE OUI masking thing, doesn't really matter with MAC randomization...

These days it's ephemeral at best, and can change at any time...

It's really just for posting logs TBH, so (maybe mistakenly?) I thought as the first 3 are vendor as you point out, it's nothing you need to hide, whereas all 6 make it specific?

 

[sfx2000]

It's really just for posting logs TBH, so (maybe mistakenly?) I thought as the first 3 are vendor as you point out, it's nothing you need to hide, whereas all 6 make it specific?

Maybe, maybe not - I've been tinkering about with MAC randomization at the AP layer - focus there was privacy protection for the home/business location (there's a bunch of services that have co-located MAC address and GPS location) - randomizing the WAN and WLAN MAC addresses actually helps preserve privacy...

In the past, folks had issues with MAC randomization on the client side with mobile phones and the like - it was for the same reason... to preserve privacy, and these days, IPv6 supports IP randomization as well, but preserves service availability.

 

[jksmurf]

To get a more robust regex solution than my simple "..:..:..:" effort, I asked the question on stackexchange and got a few different answers, summarised below. Just use the Find and Replace strings in Notepad++ per the post above.

Regex to replace the last three octets of a mac address with XX:XX:XX and retain the first three?

I have found a solution on stackoverflow to replace ALL the 6 Octets of a MAC address with XX. I use this when I post router logs, for privacy reasons. It uses 's/([0-9a-eA-E]{2}:){5}[0-9a-eA-E]{2}...

stackoverflow.com

SOLUTION 1 (Works)

FIND: (?<!:)\b((?:[[:xdigit:]]{2}:){3})(?:[[:xdigit:]]{2}:?\b){3}(?!:)
REPLACE: $1XX:XX:XX

SOLUTION 2 (Only Works with standalone MAC Addresses - the author noted to work with other test data it needs boundary markers)

FIND: [A-Fa-f0-9]{2}(?::[A-Fa-f0-9]{2}){2}$
REPLACE: XX:XX:XX

SOLUTION 3 (Works in https://regex101.com/ but oddly not in Notepad++; actually differentiates between 5 (incorrect as MAC) or 6 (MAC) or 7 (incorrect as MAC) OCTETS)

FIND:
(?<=                    # begin pos lookbehind
  (?<!:)                # neg lookbehind asserts preceeding
                        # char is not a colon
  (?:[[:xdigit:]]{2}:)  # match 2 hex digits then colon in a NC group
  {3}                   # execute above NC group 3 times
)                       # end neg lookbehind
(?:[[:xdigit:]]{2}:){2} # match 2 hex digits
[[:xdigit:]]{2}         # match 2 hex digits
(?!:)                   # neg lookahead asserts next char is not a colon
REPLACE: XX:XX:XX

NOTE: SOLUTION 3 RESOLVES TO

FIND: (?<=(?<!:)(?:[[:xdigit:]]{2}:){3})(?:[[:xdigit:]]{2}:){2}[[:xdigit:]]{2}(?!:)
REPLACE: XX:XX:XX

TEST DATA USED:

SOLUTION 1 TEST DATA

bliblo 00:11:aa AA:22:CC:44:DD:66 blobla
bliblo 00:11:aa AA:11:CC:DD:EE:FF blobla

SOLUTION 2 TEST DATA [DOES NOT WORK WITH MORE RIGOROUS TEST DATA, SEE TEST DATA 1 or 3]

AA:22:CC:44:DD:66
AA:11:CC:DD:EE:FF

SOLUTION 3 TEST DATA

bliblo 00:11:aa AA:22:CC:XX:XX:XX blobla
bliblo 00:11:aa AA:22:CC:44:DD blobla
bliblo 00:11:aa AA:22:CC:33:44:DD:66 blobla

I checked them in Notepad++ against my syslog.txt, which is where I picked up solution 2 only does MAC Addresses that have no trailing text and that whilst solution 3 works in the regex101 tester it does not work in Notepad++, throwing an error message "Invalid Regular Expression".

So Solution 1 seems the best bet for now, for the partial (last 3 Octets XX:XX:XX) replacement.

I will amend this post if the solutions get updated.