# help using awk

**URL:** <https://community.unix.com/t/help-using-awk/182073>\
**Category:** Shell Programming and Scripting\
**Created:** [January 17, 2008, 5:27am UTC](https://community.unix.com/t/help-using-awk/182073 "2008-01-17T05:27:17Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![phamp008](https://community.unix.com/letter_avatar/phamp008/32/6_22734026db12803ebb3e059622ac3534.png) [@phamp008](https://community.unix.com/u/phamp008)\
**Post date:** [January 17, 2008, 5:27am UTC](https://community.unix.com/t/help-using-awk/182073/1 "2008-01-17T05:27:17Z")

</div>

Hi I have an output of the nmap command scan for port 22 as below

Interesting ports on 172.29.143.221:  
PORT STATE SERVICE  
22/tcp open ssh

Interesting ports on 172.29.143.240:  
PORT STATE SERVICE  
22/tcp closed ssh

Interesting ports on 172.29.143.243:  
PORT STATE SERVICE  
22/tcp open ssh

I would like to print out the ip address with STATE "open" only.

Thank.

---

<div class="post-metadata">

**Author:** ![ennstate](https://community.unix.com/user_avatar/community.unix.com/ennstate/32/514_2.png) [@ennstate](https://community.unix.com/u/ennstate)\
**Post date:** [January 17, 2008, 5:52am UTC](https://community.unix.com/t/help-using-awk/182073/2 "2008-01-17T05:52:14Z")

</div>

Please try this,

```nohighlight
sed -nf /tmp/OpenIp.sed /tmp/YourInputFile

```

cat /tmp/OpenIp.sed

```nohighlight
/Interesting/{
N
N
/open/{
P
}
}

```

Thanks  
Nagarajan G

---

<div class="post-metadata">

**Author:** ![Tytalus](https://community.unix.com/user_avatar/community.unix.com/tytalus/32/87_2.png) [@Tytalus](https://community.unix.com/u/Tytalus)\
**Post date:** [January 17, 2008, 6:01am UTC](https://community.unix.com/t/help-using-awk/182073/3 "2008-01-17T06:01:16Z")

</div>

```nohighlight
awk '/Interesting/{r[NR+2]=$4}/open/{print r[NR]}' file | tr -d :

```

should work.

---

<div class="post-metadata">

**Author:** ![radoulov](https://community.unix.com/user_avatar/community.unix.com/radoulov/32/489_2.png) [@radoulov](https://community.unix.com/u/radoulov)\
**Post date:** [January 17, 2008, 6:08am UTC](https://community.unix.com/t/help-using-awk/182073/4 "2008-01-17T06:08:16Z")

</div>

Or:

```nohighlight
awk '/^Interesting/{ip=$4}/open/{print ip}' FS="[:]" filename

```

---

<div class="post-metadata">

**Author:** ![phamp008](https://community.unix.com/letter_avatar/phamp008/32/6_22734026db12803ebb3e059622ac3534.png) [@phamp008](https://community.unix.com/u/phamp008)\
**Post date:** [January 17, 2008, 10:00pm UTC](https://community.unix.com/t/help-using-awk/182073/5 "2008-01-17T22:00:32Z")

</div>

Thank you to radoulov. It works well just one single command.

Is it possible if i can take this output and insert this into an array?  
If so, would you please advise the code ?

---

<div class="post-metadata">

**Author:** ![radoulov](https://community.unix.com/user_avatar/community.unix.com/radoulov/32/489_2.png) [@radoulov](https://community.unix.com/u/radoulov)\
**Post date:** [January 18, 2008, 4:30am UTC](https://community.unix.com/t/help-using-awk/182073/6 "2008-01-18T04:30:58Z")

</div>

Yes,  
but the implementation depends on the shell you're using.  
Some examples:

[bash]

```nohighlight
bash 3.2.25(1)$ cat file
Interesting ports on 172.29.143.221:
PORT STATE SERVICE
22/tcp open ssh

Interesting ports on 172.29.143.240:
PORT STATE SERVICE
22/tcp closed ssh

Interesting ports on 172.29.143.243:
PORT STATE SERVICE
22/tcp open ssh
bash 3.2.25(1)$ a=($(awk '/^Interesting/{ip=$4}/open/{print ip}' FS="[:]" file))
bash 3.2.25(1)$ echo ${a[0]}
172.29.143.221
bash 3.2.25(1)$ echo ${a[1]}
172.29.143.243

```

[ksh]

```nohighlight
$ # ksh88 doesn't support this syntax 
$ a=($(awk '/^Interesting/{ip=$4}/open/{print ip}' FS="[:]" file))
$ print ${a[0]}
172.29.143.221
$ # or
$ set -A a $(awk '/^Interesting/{ip=$4}/open/{print ip}' FS="[:]" file)
$ print ${a[1]}
172.29.143.243

```

[zsh]

```nohighlight
% a=($(awk '/^Interesting/{ip=$4}/open/{print ip}' FS="[:]" file)) 
% print $a[1]
172.29.143.221
% print $a[2]
172.29.143.243

```

Or just:

[sh]

```nohighlight
$ set -- `awk '/^Interesting/{ip=$4}/open/{print ip}' FS="[:]" file`
$ echo $1
172.29.143.221
$ echo $2
172.29.143.243

```