package hmm

import (
	"regexp"
)

// Failed password for root from 43.229.53.57 port 62954 ssh2
// message repeated 2 times: [ Failed password for root from 43.229.53.57 port 32871 ssh2]
var p = regexp.MustCompile(`Failed password for .* from (.*) port`)

// ParseIP finds the ip address from an sshd log line that contains a failed
// password attempt.
func ParseIP(line string) string {
	if m := p.FindStringSubmatch(line); m != nil {
		if len(m) != 2 {
			return ""
		}
		return string(m[1])
	}
	return ""
}