Matches valid internet-routable IPv4 addresses (Not RFC1918, RFC5735, RFC3927) with optional port delimited by colon.
I wrote this specifically for Snort rules that look for hardcoded IPv4 addresses in the HTTP Host header field,
but I imagine this may have its uses aside from that.
This would have been much simpler to write using negative lookahead (NLA), but for kicks I did it without it.
I know that NLA is not always supported, so this should work. If non-capture groups aren't supported either,
you can just change (?: ) to ( ) and it should still work fine (\cough\Yara\cough\).
Just to be clear: This expression purposefully will not match:
Addresses that start with 0 (0.X.X.X)
Loopback addresses (127.0.0.0/8)
Addresses that start with 224 through 255 (Class D and E addresses)
Private IPs (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16)
APIPA (169.254.0.0/16)
The port expression will match ports from 1-65535.