Text File Pattern Mattching

Shell Programming and Scripting
1

If you have a text file where the word 'src:' appears in every line just different fields. What shell command is best to search for 'src:' and then print the next field. Same for 'dst:'

Text file would contain the following string on every line just at different fields locations.

'src: x.x.x.x; dst: x.x.x.x;'

In the past I was able to just use awk w/ print because the field was constant.

Thank you very much

2

See if this works with little modification

sed -n 's/\(src:\)\(.*\)\(;\)\(dst:\)\(.*\)/\2  \5/p' filename

If you could post some testdata, it would be a great help.

3

Here is a line in one place

8:15:30 accept 10.1.5.252 >eth-s1/s1p1c0 rule: 165; rule_uid: {A67EC623-96B2-4606-9759-3BA602966892}; service_id: http; src: 0.0.0.0; dst: 0.0.0.0; proto: tcp; xlatedst: 10.3.132.26; NAT_rulenum: 305; NAT_addtnl_rulenum: 0; product: VPN-1 & FireWall-1; service: 80; s_port: 11945;

Here is a line in another place

14:38:51 accept 30.146.28.4 >eth2c0 src: 0.0.0.0; dst: 0.0.0.0; proto: tcp; xlatedst: 10.85.92.65; NAT_rulenum: 50; NAT_addtnl_rulenum: 0; rule: 30; product: VPN-1 & FireWall-1; service: tcp-8000-30000; s_port: 55479;

4

A little involved try - be very careful about each space

sed -f sedfile ipfilename  --where sedfile contains

s/^.*\(src: \)\([0-9][0-9]*\.[0-9][0-9]*\.[0-9][0-9]*\.[0-9][0-9]*\);\( dst: \)\([0-9][0-9]*\.[0-9][0-9]*\.[0-9][0-9]*\.[0-9][0-9]*\
);.*$/\1 \2 \3 \4/

See if it works.

5

or using awk.

nawk -f barney.awk myFile.txt
nawk -v pat='dst:' -f barney.awk myFile.txt

barney.awk:

BEGIN {
  FS=";"
  # IP is a kind of lame regex, but.....
  IP="[0-9][0-9]*.[0-9][0-9]*.[0-9][0-9]*.[0-9][0-9]*"
  pat = (( pat == "")  ? "src: " : pat " ") IP
}

$0 ~ pat {
   for(i=1; i <=NF; i++)
      if ($i ~ pat)
         print $(i+1)
}
6

Both sed and awk worked in thoes formats. Saved 6 yrs of my life thank you thank you thank you

7

How would I get service: bla also. I tried several 100 things since my last post but I am evidently and ID10T and cant seem to get it to pull service: bla in cordinance w/ src and dest.

8

Try...

awk -v tags='(service:|src:|dst:)' '{
    while(match($0,"[^a-z]" tags "[^;]*;")){
        printf substr($0,RSTART+1,RLENGTH)
        $0=substr($0,RSTART+RLENGTH)}
    printf ORS}' file1

...gives...

src: 0.0.0.0; dst: 0.0.0.0; service: 80;
src: 0.0.0.0; dst: 0.0.0.0; service: tcp-8000-30000;
9

Python alternative:

#!/usr/bin/python
import re #reg expression module
s = """14:38:51 accept 30.146.28.4 >eth2c0 src: 0.0.0.0; dst: 0.0.0.0; proto: tcp; xlatedst: 10.85.92.65; NAT_rulenum: 50; NAT_addtnl_rulenum: 0; rule: 30; product: VPN-1 & FireWall-1; service: tcp-8000-30000; s_port: 55479;"""

s_ip = re.findall(" src: (.*?);",s)
d_ip = re.findall(" dst: (.*?);",s)
service = re.findall(" service: (.*?);",s)

print "Source IP: " , s_ip[0]
print "Destination IP: ",d_ip[0]
print "Service: ", service[0]

output:

jupiter:/home/#  ./test.py
Source IP:  0.0.0.0
Destination IP:  0.0.0.0
Service:  tcp-8000-30000
10

Thank you all very much simply awsome