ip address record in sybase ASE auditing database?
The contents of the extrainfo column is populated in two ways:


automatically by the auditing system; the actual contents are pre-defined based on what exactly is being audited (eg, audited logins could include the ip address)
when the sp_addauditrecord proc is called (eg, by a user-defined proc, trigger, batch process)


In order to match an ip address with the various commands you'd have to use the audited login record (that contains the ip address) to obtain the associated spid/suid, then use these values to search follow-on auditing records with the same spid/suid; basically a self-join of the sysaudits table.

Keep in mind that you really don't want to be hitting the sysaudits tables very often with this type of activity as that's not what the tables are designed for.  Instead, you'd want to periodically pull the auditing data into some other database/table/repository (with appropriate indexes) where you could run your queries.