Skip to content
Universal perl script for anonymizing IP addresses and text within arbitrary text files
Branch: master
Clone or download
Fetching latest commit…
Cannot retrieve the latest commit at this time.
Type Name Latest commit message Commit time
Failed to load latest commit information.

IP anonymizer - replace IP addresses with anonymized IPs as well as text with anonymized text in plain text files

SYNOPSIS ./ [-txt-subst-file=/var/tmp/strings.txt] [-net=""] config-file1 config-file2 ...


This is a script for

a) replacing IP addresses in plain text with anonymized equivalents from the network range supplied.

b) replacing strings in a file with anonymized strings

Input is a number of ASCII files (all parameters not starting with -) IP addresses as well as strings are replaced one-for-one throughout all text files, so once an IP address has an anonymized equivalent, it stays that way.

This is useful if you need to use production configuration data for testing. E.g. from firewalls but do not want to expose the production data on a test system. This way you can protect an organization's identity at the same time.


  • currently only implemented for IPv4

  • beware of anonymizing common strings; e.g. "INT" when handling database dumps is part of keyword CONSTRAINT use slightly longer strings like "INT_" instead


  • The network range used for replacement, is set to "" if omitted.

  • For each file supplied an anonymized file called .anonymized is created.

The second argument is a network address, which should be given in CIDR notation, and really represents a range of IP addresses from which we can draw from while doing the IP address substitutions (Note that the use of NetAddr::IP means that we will never overflow this range - but it will wrap around if we increment it enough). Using an RFC1918 private address range is a good idea.

Note that the script tries to handle network addresses so that network address and netmask (both given in 255.255.255.x notation as well as a.b.c.d/xy notation) will match by simply setting all netmasks to /32.


a) ./ -net= -txt-subst-file=/var/tmp/strings.txt /var/tmp/fw.cfg /var/tmp/router9.cfg

b) -txt-subst-file=strings.txt /tmp/netscreen1.cfg

no net specified, using default net
anonymizing: /var/tmp/netscreen1.cfg ... result file = /var/tmp/netscreen1.cfg.anonymized
Anonymized 20197 ip addresses and 150 strings in 31.1 seconds (0.46 Mbytes/second).

c) Anonymizing a whole (ASCII) Postgresql database:

 creating an ASCII dump of the database:
   pg_dump -U dbadmin -d isodb -W >/var/tmp/iso_db.dump.sql

 or as postgres user:
   pg_dump -d isodb >/var/tmp/iso_db.dump.sql

 turn binary .Fc dump into ascii (only necessary if you do not already have an ascii dump):
   pg_restore /var/tmp/iso_db.dump.Fc >/var/tmp/iso_db.dump.sql

 anonymizing: -txt-subst-file=/var/tmp/strings.txt /var/tmp/iso_db.dump.sql

 restoring anonymized database:
   psql --set ON_ERROR_STOP=on targetdb </var/tmp/iso_db.dump.sql


  • reliably replace network address by networks with consistent netmasks (currently all networks are reduced to a /32 netmask)


Tim Purschke


Copyright (C) 2016 by Cactus eSecurity GmbH


You can’t perform that action at this time.