Assistance required to decode sed search using /1

UNIX for Beginners Q & A
1

Hi,

I am trying to extract line number (first number), as well as everything from TSVal onwards.

 4   1.474005 172.18.124.142 -> 74.125.228.46 TCP 2450940617 74 44021 > https [SYN] Seq=0 Win=5840 Len=0 MSS=1380 SACK_PERM=1 TSval=2450940617 TSecr=0 WS=64
  6   1.488149 172.18.124.142 -> 74.125.228.46 TCP 2450940637 66 44021 > https [ACK] Seq=1 Ack=1 Win=5888 Len=0 TSval=2450940637 TSecr=1834617706

The following sed regex accomplishes this, but I have a few questions around the expression.

$ cat tcp_timestamps.txt | sed 's/\([0-9]\) .*TSval/\1 TSval/'
 4 TSval=2450940617 TSecr=0 WS=64
  6 TSval=2450940637 TSecr=1834617706

1> Why does [0-9] need to be grouped into brackers?
2> What is the purpose of \1 TSval? If /1 denotes the last element which is remembered, how does it apply here?

Thanks,

2

something along these lines:

sed 's/^ *\([0-9][0-9]*\).*\(TSval.*\)/\1 \2/' myFile

1> Why does [0-9] need to be grouped into brackers?
[0-9] - signifies the character rang - in this case numbers

2> What is the purpose of \1 TSval? If /1 denotes the last element which is remembered, how does it apply here?
From man sed or man ed ...

   The REPLACEMENT can contain '\N' (N being a number from 1 to 9,
inclusive) references, which refer to the portion of the match which is
contained between the Nth '\(' and its matching '\)'.  Also, the
REPLACEMENT can contain unescaped '&' characters which reference the
whole matched portion of the pattern space.
1 Like