We were under attack - Now I need to grep some Logs

Yesterday our network was under distributed scan / DoS attack.

All attacks were targetted to port 80 with TCP protocol. Attacks came all over the world (korea, turkey, UK, USA ...).

Some ip spoofing was detected too.

How do i get the list of IP's used in attack? I am not very familiar in grepping of logs.

This thread was automatically locked due to age.