Jump to content
Sadikhov IT Certification forums
Sign in to follow this  
MarkinManchester

Using the power of regular expressions with Show commands

Recommended Posts

This is an advanced topic, so get your ready...

 

We have covered some basic regular expressions in our "Cool IOS Commands" EBook. Here I want to show you more complicated examples of how to use the power of regular expressions to filter output. This will allow the router to do the searching for text, rather than us doing it manually.

 

Regular expressions are used in many places in the IOS including BGP AS paths and Voice number translations. They are also used in other languages like Perl and TCL. Here however, we are going to concentrate on regular expressions with IOS show commands. We are going to use them to search for specific sets of strings.

 

A regular expression is a pattern (for example a phrase or a number) that can be used very effectively to filter output. Regular expressions are case-sensitive and allow for complex matching requirements.

 

I start with some simple examples so that you can learn each regular expression character individually and then we will combine them into complicated strings. As always with programming, there are many ways to do things, so use your imagination:

 

^ Regular Expression

Use this to look for text at the beginning of a string.

 

For Example: ^123 matches 1234, but not 01234 or 91234

 

On a router we can demonstrate this as follows: (without any regular expressions)

 

Router#show run | include ip

ip cef

no ip dhcp use vrf connected

ip dhcp pool ITS

option 150 ip 10.1.1.1

no ip domain lookup

voice service voip

allow-connections h323 to sip

allow-connections sip to h323

allow-connections sip to sip

ip address 192.168.10.1 255.255.255.0

ip address 192.168.11.1 255.255.255.0

ip address 192.168.12.1 255.255.255.0

ip address 192.168.13.1 255.255.255.0

ip address 192.168.14.1 255.255.255.0

<MORE>

 

However, if we use the following:

Router#show run | include ^ip

 

The output is:

Router#show run | include ^ip

ip cef

ip dhcp pool ITS

ip http server

 

Note - as expected, every line begins with "ip", string we matched on

 

 

$ Regular Expression:

Use this to look for text at the end of a string

 

For Example123$ matches 0123, but not 1234

 

On a router we can demonstrate this as follows: (without any regular expressions)

 

Router#show run | include 1

Current configuration : 5174 bytes

! Last configuration change at 15:27:21 UTC Wed Jan 24 2007

! NVRAM config last updated at 14:25:01 UTC Wed Jan 24 2007

version 12.4

network 10.1.1.0 255.255.255.0

option 150 ip 10.1.1.1

default-router 10.1.1.1

source-address 10.1.1.1 port 5060

create profile sync 0002381328447096

voice register dn 1

number 1100

number 1101

voice register pool 1

id mac 0003.6B8B.174A

number 1 dn 1

codec g711ulaw

ip address 192.168.10.1 255.255.255.0

interface Loopback1

ip address 192.168.11.1 255.255.255.0

ip address 192.168.12.1 255.255.255.0

ip address 192.168.13.1 255.255.255.0

 

but if we change it to

Router#show run | include 1$

 

The output is:

Router#show run | include 1$

voice register dn 1

number 1101

voice register pool 1

number 1 dn 1

interface Loopback1

interface Loopback11

interface Loopback21

interface FastEthernet0/1

session target ipv4:10.1.1.1

session target ipv4:10.1.1.11

session target ipv4:10.1.1.21

session target ipv4:10.1.1.31

session target ipv4:10.1.1.41

session target ipv4:10.1.1.51

session target ipv4:10.1.1.61

number 1001

ephone 1

button 1:1

 

Note - as expected, every line ends "1", string we matched on.

 

 

. Regular Expression:

The "." matches any single character.

 

For example:

0.0 matches 0x0 and 020

t..t matches strings such as test, text, and tart

 

On a router, let’s look for all lines that end in 0 and another single character:

 

Router#sh run | include 0.$

! Last configuration change at 15:27:21 UTC Wed Jan 24 2007

! NVRAM config last updated at 14:25:01 UTC Wed Jan 24 2007

load 7960-7940 P0S3-07-4-00

number 1100

number 1101

clock rate 2000000

destination-pattern 1000

load 7910 P00405000700

ip source-address 10.1.1.1 port 2000

number 1000

number 1001

scheduler allocate 20000 1000

 

Note: All the lines end with 0 and another single character.

 

 

_ Regular Expression:

This replaces a long regular expression list by matching a comma (,), left brace ({), right brace (}), the beginning of the input string, the end of the input string, or a space.

 

The characters _1400_ can match any of the following strings:

^1400$

^1400space

space1400

{1400,

,1400,

{1400}

,1400,

 

We are going to use it looking for a space - in the following example, we are looking for loopback interfaces with 2:

 

Router#show ip route | include k2

C 192.168.12.0/24 is directly connected, Loopback2

C 192.168.31.0/24 is directly connected, Loopback21

C 192.168.30.0/24 is directly connected, Loopback20

C 192.168.32.0/24 is directly connected, Loopback22

 

If however, we use the "_" character we see the following:

 

Router#show ip route | include k2_

C 192.168.12.0/24 is directly connected, Loopback2

 

Note: Only loopback interface 2 is displayed.

 

 

[ ] Regular Expression:

This matches the characters or a range of characters separated by a hyphen, within left and right square brackets.

[02468w] matches for example 0, 4, and w, but not 1, 9, or K

 

On a router we can demonstrate as follows:

 

Router#show ip route | include k[1-9]

C 192.168.12.0/24 is directly connected, Loopback2

C 192.168.29.0/24 is directly connected, Loopback19

C 192.168.28.0/24 is directly connected, Loopback18

C 192.168.13.0/24 is directly connected, Loopback3

C 192.168.14.0/24 is directly connected, Loopback4

C 192.168.31.0/24 is directly connected, Loopback21

C 192.168.30.0/24 is directly connected, Loopback20

C 192.168.15.0/24 is directly connected, Loopback5

C 192.168.25.0/24 is directly connected, Loopback15

C 192.168.24.0/24 is directly connected, Loopback14

C 192.168.27.0/24 is directly connected, Loopback17

C 192.168.26.0/24 is directly connected, Loopback16

C 192.168.11.0/24 is directly connected, Loopback1

C 192.168.21.0/24 is directly connected, Loopback11

C 192.168.20.0/24 is directly connected, Loopback10

C 192.168.23.0/24 is directly connected, Loopback13

C 192.168.22.0/24 is directly connected, Loopback12

C 192.168.17.0/24 is directly connected, Loopback7

C 192.168.16.0/24 is directly connected, Loopback6

C 192.168.19.0/24 is directly connected, Loopback9

C 192.168.32.0/24 is directly connected, Loopback22

C 192.168.18.0/24 is directly connected, Loopback8

 

However, if we combine this with the "_" character:

 

Router#show ip route | include k[1-9]_

C 192.168.12.0/24 is directly connected, Loopback2

C 192.168.13.0/24 is directly connected, Loopback3

C 192.168.14.0/24 is directly connected, Loopback4

C 192.168.15.0/24 is directly connected, Loopback5

C 192.168.11.0/24 is directly connected, Loopback1

C 192.168.17.0/24 is directly connected, Loopback7

C 192.168.16.0/24 is directly connected, Loopback6

C 192.168.19.0/24 is directly connected, Loopback9

C 192.168.18.0/24 is directly connected, Loopback8

 

 

| Regular Expression:

Use the | as a logical or statement.

Matches one of the characters or character patterns on either side of the vertical bar.

A(B|C)D matches ABD and ACD, but not AD, ABCD, ABBD, or ACCD

 

As an example, if you want to look for a route in the routing table that contains routes with 10 or 20 in it:

Router#show ip route | include 10|20

C 192.168.10.0/24 is directly connected, Loopback0

C 192.168.20.0/24 is directly connected, Loopback10

 

 

\ Regular Expression:

Use this if the following character is not a wildcard, but an actual character you are looking for.

 

As an example, if you do the following:

 

Router#show running-config | include 10..

 

The result you get is:

 

network 10.1.1.0 255.255.255.0

option 150 ip 10.1.1.1

default-router 10.1.1.1

source-address 10.1.1.1 port 5060

ip address 10.1.1.1 255.255.255.0

destination-pattern 10..

session target ipv4:10.1.1.1

session target ipv4:10.1.1.6

session target ipv4:10.1.1.11

session target ipv4:10.1.1.16

session target ipv4:10.1.1.21

session target ipv4:10.1.1.26

session target ipv4:10.1.1.31

session target ipv4:10.1.1.36

session target ipv4:10.1.1.41

dial-peer voice 10 voip

session target ipv4:10.1.1.46

session target ipv4:10.1.1.51

session target ipv4:10.1.1.56

session target ipv4:10.1.1.61

session target ipv4:10.1.1.66

registrar ipv4:10.1.1.1 expires 60

load 7910 P00405000700

--More--

 

If you changed it to the following:

 

Router#show running-config | include 10..$

 

The result is:

 

destination-pattern 10..

number 1000

number 1001

scheduler allocate 20000 1000

 

But if we now change it to use the "\" character, we can tell the router that we are actually looking for a ".", not using it as a wildcard:

 

Router#show running-config | include 10\.\.

 

The result now is:

 

destination-pattern 10..

 

Here is another example:

 

Router#sh ip route | include \.20|\.10

 

This will look for anything entries in the routing table that contain a . followed by 20 or 10 (looking for the . in the IP address)

 

The result is:

 

C 192.168.10.0/24 is directly connected, Loopback0

C 192.168.20.0/24 is directly connected, Loopback10

 

 

? Regular Expression:

This matches zero or one occurrence of the pattern. (Remember to precede the question mark with Ctrl-V sequence to prevent it from being interpreted as a help command.)

ba?b matches bb and bab

 

route-views.oregon-ix.net>show ip route | include 25?5

B 216.221.5.0/24 [20/2954] via 208.51.134.254, 1w1d <========= 25 is matched

B 210.51.225.0/24 [20/0] via 203.62.252.186, 2w3d

B 204.255.51.0/24 [20/4294967294] via 144.228.241.81, 3w5d <========= 255 is matched

B 203.34.233.0/24 [20/0] via 203.62.252.186, 3w5d

B 192.68.132.0/24 [20/0] via 216.218.252.145, 3w5d

B 222.35.252.0/24 [20/559] via 64.125.0.137, 1w0d

B 212.205.24.0/24 [20/7549] via 64.125.0.137, 2d05h

B 212.103.178.0/24 [20/0] via 216.218.252.145, 2w3d

B 209.50.226.0/24 [20/124] via 64.125.0.137, 3w5d

B 208.50.227.0/24 [20/3107] via 208.51.134.254, 1d22h

B 203.254.52.0/24 [20/0] via 213.140.32.146, 1w1d

B 203.1.203.0/24 [20/0] via 203.62.252.186, 3d03h

B 202.171.96.0/24 [20/361] via 129.250.0.11, 5d19h

 

 

+ Regular Expression:

This matches one or more sequences of the character preceding the plus sign.

5+ requires there to be at least one number 5 in the string to be matched

 

In this example we are searching for 0 followed by one or more 0's:

 

Router#sh run | i 00+

load 7960-7940 P0S3-07-4-00

create profile sync 0002381328447097

number 1100

id mac 0003.6B8B.174A

clock rate 2000000

tftp-server flash:P0S3-07-4-00.bin

tftp-server flash:P003-07-4-00.bin

tftp-server flash:P0S3-07-4-00.loads

tftp-server flash:P003-07-4-00.sbn

tftp-server flash:P0S3-07-4-00.sb2

tftp-server flash:P00405000700.bin

tftp-server flash:P00405000700.sbn

tftp-server flash:P0030702T023.bin

tftp-server flash:P0030702T023.loads

tftp-server flash:P0030702T023.sb2

tftp-server flash:P0030702T023.sbn

load 7910 P00405000700

load 7960-7940 P0030702T023

ip source-address 10.1.1.1 port 2000

create cnf-files version-stamp 7960 Jan 28 2007 14:22:09

number 1000

number 1001

 

[] Regular Expression:

Nest characters for matching. Separate endpoints of a range with a dash (-).

(18)* matches any number of the two-character string 18

([A-Za-z][0-9])+ matches one or more instances of letter-digit pairs: b8 and W4, as examples

 

Router#sh run | i ([A-Za-z][0-9])+

allow-connections h323 to sip

allow-connections sip to h323

load 7960-7940 P0S3-07-4-00

id mac 0003.6B8B.174A

codec g711ulaw

interface Loopback0

interface Loopback1

interface Loopback2

interface Loopback3

interface Loopback4

interface Loopback5

interface Loopback6

interface Loopback7

interface Loopback8

interface Loopback9

interface Loopback10

interface Loopback11

interface Loopback12

interface Loopback13

interface Loopback14

interface Loopback15

 

* Regular Expression:

Matches zero or more sequences of the character preceding the asterisk. Also acts as a wildcard for matching any number of characters.

0* matches any occurrence of the number 0 including none

 

10\..* matches the characters 10. and any characters that follow 10.

 

 

Router#sh run | i 10\..*

network 10.1.1.0 255.255.255.0

option 150 ip 10.1.1.1

default-router 10.1.1.1

source-address 10.1.1.1 port 5060

ip address 192.168.10.1 255.255.255.0

ip address 10.1.1.1 255.255.255.0

destination-pattern 10..

session target ipv4:10.1.1.1

session target ipv4:10.1.1.6

session target ipv4:10.1.1.11

session target ipv4:10.1.1.16

session target ipv4:10.1.1.21

session target ipv4:10.1.1.26

session target ipv4:10.1.1.31

session target ipv4:10.1.1.36

session target ipv4:10.1.1.41

session target ipv4:10.1.1.46

session target ipv4:10.1.1.51

session target ipv4:10.1.1.56

session target ipv4:10.1.1.61

session target ipv4:10.1.1.66

Share this post


Link to post
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now
Sign in to follow this  

×