Figured it out:
FOR /F "TOKENS=3-6 DELIMS=.: " %%A IN ( 'netsh interface ipv4 show addresses ^| FIND "IP Address"' ) DO SET IPADDR=%%A.%%B.%%C.%%D ________________________________ From: Robertson, Chad [mailto:[email protected]] Sent: Tuesday, March 30, 2010 4:08 PM To: [email protected] Subject: [ossec-list] active response script for Windows Server 2008 and multiple IP addresses The current route-null.cmd file doesn't work on server 2008 assigned multiple IP addresses. C:\>FOR /F "TOKENS=2* DELIMS=:" %A IN ('IPCONFIG /ALL ^ | FIND "IP Address"') DO FOR %B IN (%A) DO SET IPADDR=%B C:\>echo %IPADDR% Does not return results. So, after realizing that server 2008 titles the IP address "IPv4 Address" I made that change and it didn't help (See below) C:\>IPCONFIG /ALL | FIND "IPv4 Address" IPv4 Address. . . . . . . . . . . : x.x.x.1(Preferred) Subnet Mask . . . . . . . . . . . : 255.255.255.0 IPv4 Address. . . . . . . . . . . : x.x.x.2(Preferred) Subnet Mask . . . . . . . . . . . : 255.255.255.0 IPv4 Address. . . . . . . . . . . : x.x.x.3(Preferred) Subnet Mask . . . . . . . . . . . : 255.255.255.0 IPv4 Address. . . . . . . . . . . : x.x.x.4(Preferred) Subnet Mask . . . . . . . . . . . : 255.255.255.0 IPv4 Address. . . . . . . . . . . : x.x.x.5(Preferred) Subnet Mask . . . . . . . . . . . : 255.255.255.0 IPv4 Address. . . . . . . . . . . : x.x.x.6(Preferred) Subnet Mask . . . . . . . . . . . : 255.255.255.0 IPv4 Address. . . . . . . . . . . : x.x.x.7(Preferred) Subnet Mask . . . . . . . . . . . : 255.255.255.0 IPv4 Address. . . . . . . . . . . : x.x.x.8(Preferred) Subnet Mask . . . . . . . . . . . : 255.255.255.0 It chains all kinds of junk to it that I don't need. Then, I tried netsh as an alternate. C:\>netsh interface ip show addresses |find "IP Address"" IP Address: x.x.x.1 IP Address: x.x.x.2 ... Which works except it echos each IP into the variable and only returns the last echo. The last IP in the list is 127.0.0.1. Server 2008 will not allow a route to be added to localhost. (127.0.0.1) C:\>for /F "tokens=1-6 delims=:. " %a in ('ipconfig ^| find "IPv4 Address"') do SET IPADDR=%c.%d.%e.%f which results in this: C:\>SET IPADDR=x.x.x.1 C:\>SET IPADDR=x.x.x.2 C:\>SET IPADDR=x.x.x.3 C:\>SET IPADDR=x.x.x.4 C:\>SET IPADDR=x.x.x.5 C:\>SET IPADDR=x.x.x.6 ... C:\>SET IPADDR=127.0.0.1 How do I stop the FOR loop so that only the first value is echoed into the variable? ________________________________ You should protect yourself when communicating electronically. IMG values your security and can assist in keeping your information protected. If you submit confidential or personal information to us via unsecured email, it could be exposed to internet hackers. If sending us confidential information, please request IMG's representative to send you instructions on how to do so securely. By following those instructions, your information will be safer, and so will you. All information in this Communication is strictly confidential. Please view the email confidentiality statement http://www.imglobal.com/common/pdf/emaildisclaimer.pdf You should protect yourself when communicating electronically. IMG values your security and can assist in keeping your information protected. If you submit confidential or personal information to us via unsecured email, it could be exposed to internet hackers. If sending us confidential information, please request IMG’s representative to send you instructions on how to do so securely. By following those instructions, your information will be safer, and so will you. All information in this Communication is strictly confidential. Please view the email confidentiality statement http://www.imglobal.com/common/pdf/emaildisclaimer.pdf -- To unsubscribe, reply using "remove me" as the subject.
