Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a one-line command that lists the top 10 most active IP addresses from a web server access log:

cat access.log | awk '{print $1}' | sort | uniq -c | sort -n | tail -n10

A sample result set (with only 3 entries for simplicity) would be:


As you can see, the count precedes the IP address, with the two separated by a blank space. There are actually blank spaces preceding the count too but I can't get them to show here.

I like to do a reverse DNS lookup of the IP addresses so that it will look like this:

20 (
22 (
29 (

How can I do this without resorting to a script (that is, sticking to a one-line command)? Any advice is much appreciated.

share|improve this question
up vote 8 down vote accepted

You can use dig +noall +answer -x <IP> to look up an IP address.

To simply loop over a file that contains a list of IP addresses:

while read ip; do dig +noall +answer -x $ip; done < ips.txt

Or, pipe the output of your counting command. This time we get the count and the IP addresses separately and then print them on one line:

cat access.log | awk '{print $1}' | sort | 
uniq -c | sort -n | tail -n10 |
while read count ip; do printf "%d " $count; printf "%s " $ip; dig +noall +answer -x $ip; done

Example (sorry for the UUOC):

cat test | while read count ip; do printf "%d " $count; printf "%s " $ip; dig +noall +answer -x $ip; done
20    52767   IN  PTR
22    61369   IN  PTR

You can further pipe dig's output into awk to just get the host name:

cat test | while read count ip; do printf "%d " $count; printf "%s " $ip; echo $(dig +noall +answer -x $ip | awk '{ print $(NF) }'); done
share|improve this answer
Thanks for the prompt response! However, this time I get only the output from dig and I lost the count. The desired output would be: <count> <IP address> <reverse DNS lookup> – GooDoo Sep 24 '13 at 9:13
That's quite easy to change since while splits the input based on whitespace, so you can read count and IP address separately. See my update. You can play with dig's options to change the output—I haven't used it really. – slhck Sep 24 '13 at 9:30
Thanks! I've made some modifications and now it's what I'm looking for: cat access.log | awk '{print $1}' | sort | uniq -c | sort -n | sed "s/^[ \t]*//" | tail -n10 | while read count ip ; do echo "$count " "$ip" "( $(dig +noall +answer -x $ip | awk '{ print $(NF) }') )"; done Appreciate your kind help! – GooDoo Sep 25 '13 at 5:27
for i in `cat input.txt` ; do dig +noall +answer -x $i ; done >> output.txt – user395949 Dec 4 '14 at 12:43
+1 but btw, using xargs ("xargs - build and execute command lines from standard input") would be an alternative to while loops cat file | xargs -n1 dig +noall +answer -x – sfussenegger Mar 13 '15 at 9:06

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .