SED: delete and print the only exact matched pattern

Shell Programming and Scripting
1

I am really need help with the regular expression in SED. From input file, I need to extract lines that have the port number (sport or dport) as defined. The input file is something like this

time=1209515280-1209515340 dst=192.168.133.202 src=208.70.8.23  bytes=2472 proto=6  sport=80 dport=1447
time=1209515280-1209515340 dst=192.168.133.202 src=208.70.8.23  bytes=2526 proto=6  sport=80 dport=1811
time=1209515280-1209515340 dst=192.168.133.202 src=72.14.217.189  bytes=270 proto=6  sport=80 dport=3145
time=1209515280-1209515340 dst=192.168.133.202 src=78.136.25.50  bytes=610 proto=6  sport=80 dport=3158

How can I possibly define the pattern if I only want the exact pattern match. If I only wanted port 4501, is it correct the way I defined in the first line of the sed file below?
The example of patterns in file p2pport-delete.sed are here:

/port=[4][5][0][1]/d
/port=[4][6][6-7][1-4]/d
/port=[4][6][7][7]/d
.....

Apart from that, I need to have copy of those deleted lines in different file. I am using pattern/p instead. Here is file p2pport-print.sed

/port=[4][5][0][1]/p
/port=[4][6][6-7][1-4]/p
/port=[4][6][7][7]/p
.....

However, from the output, I found out that the total lines deleted from p2pport-delete.sed and printed from p2pport-print.sed is different. This assure that my sed file is wrong.
I hope that I could get help from anyone that could help me.
Many thanks

2

Use the -n option to delete lines with the pattern:

sed -n '/port=4501/p'

Regards

3

Actually, I forgot to mention that I am using sed file.
So my command for delete the pattern is

sed -f p2pport-delete.sed

And my command to print the pattern is

sed -n -f p2pport-print.sed

However, I am not so sure about the way I am defining the port number. I had tried using /port=4501/p. But still, it print port 45.

4

How bout awk '{print substr($0,83,19)}' filename ..

5

Hi c0mrade. Please explain what do 83 and 19 are for. I am not so sure how can it help to grep only the exact pattern.

6

Sorry, is this what you want :

cat filename.txt

time=1209515280-1209515340 dst=192.168.133.202 src=208.70.8.23  bytes=2472 proto=6  sport=80 dport=1447
time=1209515280-1209515340 dst=192.168.133.202 src=208.70.8.23  bytes=2526 proto=6  sport=80 dport=1811
time=1209515280-1209515340 dst=192.168.133.202 src=72.14.217.189  bytes=270 proto=6  sport=80 dport=3145
time=1209515280-1209515340 dst=192.168.133.202 src=78.136.25.50  bytes=610 proto=6  sport=80 dport=3158

awk '{print substr($0,85,19)}' filename.txt

sport=80 dport=1447
sport=80 dport=1811
 sport=80 dport=314
sport=80 dport=3158

awk '{print substr($0,85,19)}' filename.txt | grep -o '[^=]*$' (getting dport numbers)

1447
1811
314
3158

Getting 1st line of output
awk 'NR==1 {print substr($0,85,19)}' filename.txt | grep -o '[^=]*$'

1447

if that is what you seek .. if not google is wonder you can find loads of scripts there :=)

7

Thanks c0mrade. Actually, I want lines that have the defined port number from source file that have 148171 lines. Now I had already get the solution. Here is how I defined the p2pport-delete.sed

\<[sd]port=2323\>/d
\<[sd]port=46[6-7][1-4]/d
...
...

Same lines go to sed file p2pport-print.sed, only replace /d with /p. I get two output where the files that do not contain p2pport (nonp2pport) and the file that have only p2pport (p2pport). Here are some example:
For nonp2pport:

time=1209515280-1209515340 src=78.136.25.50 dst=192.168.133.202 bytes=610 proto=6 sport=80 dport=3159
time=1209515280-1209515340 src=89.1.65.142 dst=192.168.133.202 bytes=184 proto=6 sport=43954 dport=1153
time=1209515280-1209515340 src=72.14.217.189 dst=192.168.133.202 bytes=270 proto=6 sport=80 dport=3145
time=1209515280-1209515340 src=78.136.25.50 dst=192.168.133.202 bytes=610 proto=6 sport=80 dport=3158
time=1209515280-1209515340 src=208.70.8.23 dst=192.168.133.202 bytes=2472 proto=6 sport=80 dport=1447
....

Lines in p2pport

time=1209518700-1209518760 src=78.136.25.50 dst=192.168.133.202 bytes=610 proto=6 sport=80 dport=3306
time=1209523680-1209523740 src=195.5.116.238 dst=192.168.1.220 bytes=62 proto=6 sport=19289 dport=1080
time=1209524460-1209524520 src=78.136.25.50 dst=192.168.133.202 bytes=610 proto=6 sport=80 dport=3531
time=1209525660-1209525720 src=203.110.221.240 dst=192.168.1.220 bytes=62 proto=6 sport=17745 dport=22
time=1209542220-1209542280 src=66.249.93.19 dst=192.168.133.202 bytes=5874 proto=6 sport=80 dport=4242
time=1209544140-1209544200 src=78.136.25.50 dst=192.168.133.202 bytes=610 proto=6 sport=80 dport=4329
.......

However, the print command in sed will print the line twice if it match for sport and dport. For example, in nonp2pport file, the lines deleted are 2175 but lines printed in p2pport are 2176. What can I do if I just want it print once? Hpe anyone could help me with this.