Matches valid internet-routable IPv4 addresses (Not RFC1918, RFC5735, RFC3927) with optional port delimited by colon.

I wrote this specifically for Snort rules that look for hardcoded IPv4 addresses in the HTTP Host header field, but I imagine this may have its uses aside from that.

This would have been much simpler to write using negative lookahead (NLA), but for kicks I did it without it. I know that NLA is not always supported, so this should work. If non-capture groups aren't supported either, you can just change (?: ) to ( ) and it should still work fine (*cough*Yara*cough*).

Just to be clear: This expression purposefully will not match:

• Addresses that start with 0 (0.X.X.X)
• Loopback addresses (127.0.0.0/8)
• Addresses that start with 224 through 255 (Class D and E addresses)
• Private IPs (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16)
• APIPA (169.254.0.0/16)

The port expression will match ports from 1-65535.