- 03/15
- 2017
Cisco Regular expression
We have covered some basic regular expressions in our "Cool IOS Commands" EBook. Here I want to show you more complicated examples of how to use the power of regular expressions to filter output. This will allow the router to do the searching for text, rather than us doing it manually.
Regular expressions are used in many places in the IOS including BGP AS paths and Voice number translations. They are also used in other languages like Perl and TCL. Here however, we are going to concentrate on regular expressions with IOS show commands. We are going to use them to search for specific sets of strings.
A regular expression is a pattern (for example a phrase or a number) that can be used very effectively to filter output. Regular expressions are case-sensitive and allow for complex matching requirements.
I start with some simple examples so that you can learn each regular expression character individually and then we will combine them into complicated strings. As always with programming, there are many ways to do things, so use your imagination:
^ Regular Expression
Use this to look for text at the beginning of a string.
For Example: ^123 matches 1234, but not 01234 or 91234
On a router we can demonstrate this as follows: (without any regular expressions)
Router#show run | include ip
ip cef
no ip dhcp use vrf connected
ip dhcp pool ITS
option 150 ip 10.1.1.1
no ip domain lookup
voice service voip
allow-connections h323 to sip
allow-connections sip to h323
allow-connections sip to sip
ip address 192.168.10.1 255.255.255.0
ip address 192.168.11.1 255.255.255.0
ip address 192.168.12.1 255.255.255.0
ip address 192.168.13.1 255.255.255.0
ip address 192.168.14.1 255.255.255.0
<MORE>
However, if we use the following:
Router#show run | include ^ip
The output is:
Router#show run | include ^ip
ip cef
ip dhcp pool ITS
ip http server
Note - as expected, every line begins with "ip", string we matched on
$ Regular Expression:
Use this to look for text at the end of a string
For Example123$ matches 0123, but not 1234
On a router we can demonstrate this as follows: (without any regular expressions)
Router#show run | include 1
Current configuration : 5174 bytes
! Last configuration change at 15:27:21 UTC Wed Jan 24 2007
! NVRAM config last updated at 14:25:01 UTC Wed Jan 24 2007
version 12.4
network 10.1.1.0 255.255.255.0
option 150 ip 10.1.1.1
default-router 10.1.1.1
source-address 10.1.1.1 port 5060
create profile sync 0002381328447096
voice register dn 1
number 1100
number 1101
voice register pool 1
id mac 0003.6B8B.174A
number 1 dn 1
codec g711ulaw
ip address 192.168.10.1 255.255.255.0
interface Loopback1
ip address 192.168.11.1 255.255.255.0
ip address 192.168.12.1 255.255.255.0
ip address 192.168.13.1 255.255.255.0
but if we change it to
Router#show run | include 1$
The output is:
Router#show run | include 1$
voice register dn 1
number 1101
voice register pool 1
number 1 dn 1
interface Loopback1
interface Loopback11
interface Loopback21
interface FastEthernet0/1
session target ipv4:10.1.1.1
session target ipv4:10.1.1.11
session target ipv4:10.1.1.21
session target ipv4:10.1.1.31
session target ipv4:10.1.1.41
session target ipv4:10.1.1.51
session target ipv4:10.1.1.61
number 1001
ephone 1
button 1:1
Note - as expected, every line ends "1", string we matched on.
. Regular Expression:
The "." matches any single character.
For example:
0.0 matches 0x0 and 020
t..t matches strings such as test, text, and tart
On a router, let’s look for all lines that end in 0 and another single character:
Router#sh run | include 0.$
! Last configuration change at 15:27:21 UTC Wed Jan 24 2007
! NVRAM config last updated at 14:25:01 UTC Wed Jan 24 2007
load 7960-7940 P0S3-07-4-00
number 1100
number 1101
clock rate 2000000
destination-pattern 1000
load 7910 P00405000700
ip source-address 10.1.1.1 port 2000
number 1000
number 1001
scheduler allocate 20000 1000
Note: All the lines end with 0 and another single character.
_ Regular Expression:
This replaces a long regular expression list by matching a comma (,), left brace ({), right brace (}), the beginning of the input string, the end of the input string, or a space.
The characters _1400_ can match any of the following strings:
^1400$
^1400space
space1400
{1400,
,1400,
{1400}
,1400,
We are going to use it looking for a space - in the following example, we are looking for loopback interfaces with 2:
Router#show ip route | include k2
C 192.168.12.0/24 is directly connected, Loopback2
C 192.168.31.0/24 is directly connected, Loopback21
C 192.168.30.0/24 is directly connected, Loopback20
C 192.168.32.0/24 is directly connected, Loopback22
If however, we use the "_" character we see the following:
Router#show ip route | include k2_
C 192.168.12.0/24 is directly connected, Loopback2
Note: Only loopback interface 2 is displayed.
[ ] Regular Expression:
This matches the characters or a range of characters separated by a hyphen, within left and right square brackets.
[02468w] matches for example 0, 4, and w, but not 1, 9, or K
On a router we can demonstrate as follows:
Router#show ip route | include k[1-9]
C 192.168.12.0/24 is directly connected, Loopback2
C 192.168.29.0/24 is directly connected, Loopback19
C 192.168.28.0/24 is directly connected, Loopback18
C 192.168.13.0/24 is directly connected, Loopback3
C 192.168.14.0/24 is directly connected, Loopback4
C 192.168.31.0/24 is directly connected, Loopback21
C 192.168.30.0/24 is directly connected, Loopback20
C 192.168.15.0/24 is directly connected, Loopback5
C 192.168.25.0/24 is directly connected, Loopback15
C 192.168.24.0/24 is directly connected, Loopback14
C 192.168.27.0/24 is directly connected, Loopback17
C 192.168.26.0/24 is directly connected, Loopback16
C 192.168.11.0/24 is directly connected, Loopback1
C 192.168.21.0/24 is directly connected, Loopback11
C 192.168.20.0/24 is directly connected, Loopback10
C 192.168.23.0/24 is directly connected, Loopback13
C 192.168.22.0/24 is directly connected, Loopback12
C 192.168.17.0/24 is directly connected, Loopback7
C 192.168.16.0/24 is directly connected, Loopback6
C 192.168.19.0/24 is directly connected, Loopback9
C 192.168.32.0/24 is directly connected, Loopback22
C 192.168.18.0/24 is directly connected, Loopback8
However, if we combine this with the "_" character:
Router#show ip route | include k[1-9]_
C 192.168.12.0/24 is directly connected, Loopback2
C 192.168.13.0/24 is directly connected, Loopback3
C 192.168.14.0/24 is directly connected, Loopback4
C 192.168.15.0/24 is directly connected, Loopback5
C 192.168.11.0/24 is directly connected, Loopback1
C 192.168.17.0/24 is directly connected, Loopback7
C 192.168.16.0/24 is directly connected, Loopback6
C 192.168.19.0/24 is directly connected, Loopback9
C 192.168.18.0/24 is directly connected, Loopback8
| Regular Expression:
Use the | as a logical or statement.
Matches one of the characters or character patterns on either side of the vertical bar.
A(B|C)D matches ABD and ACD, but not AD, ABCD, ABBD, or ACCD
As an example, if you want to look for a route in the routing table that contains routes with 10 or 20 in it:
Router#show ip route | include 10|20
C 192.168.10.0/24 is directly connected, Loopback0
C 192.168.20.0/24 is directly connected, Loopback10
\ Regular Expression:
Use this if the following character is not a wildcard, but an actual character you are looking for.
As an example, if you do the following:
Router#show running-config | include 10..
The result you get is:
network 10.1.1.0 255.255.255.0
option 150 ip 10.1.1.1
default-router 10.1.1.1
source-address 10.1.1.1 port 5060
ip address 10.1.1.1 255.255.255.0
destination-pattern 10..
session target ipv4:10.1.1.1
session target ipv4:10.1.1.6
session target ipv4:10.1.1.11
session target ipv4:10.1.1.16
session target ipv4:10.1.1.21
session target ipv4:10.1.1.26
session target ipv4:10.1.1.31
session target ipv4:10.1.1.36
session target ipv4:10.1.1.41
dial-peer voice 10 voip
session target ipv4:10.1.1.46
session target ipv4:10.1.1.51
session target ipv4:10.1.1.56
session target ipv4:10.1.1.61
session target ipv4:10.1.1.66
registrar ipv4:10.1.1.1 expires 60
load 7910 P00405000700
--More--
If you changed it to the following:
Router#show running-config | include 10..$
The result is:
destination-pattern 10..
number 1000
number 1001
scheduler allocate 20000 1000
But if we now change it to use the "\" character, we can tell the router that we are actually looking for a ".", not using it as a wildcard:
Router#show running-config | include 10\.\.
The result now is:
destination-pattern 10..
Here is another example:
Router#sh ip route | include \.20|\.10
This will look for anything entries in the routing table that contain a . followed by 20 or 10 (looking for the . in the IP address)
The result is:
C 192.168.10.0/24 is directly connected, Loopback0
C 192.168.20.0/24 is directly connected, Loopback10
? Regular Expression:
This matches zero or one occurrence of the pattern. (Remember to precede the question mark with Ctrl-V sequence to prevent it from being interpreted as a help command.)
ba?b matches bb and bab
route-views.oregon-ix.net>show ip route | include 25?5
B 216.221.5.0/24 [20/2954] via 208.51.134.254, 1w1d <========= 25 is matched
B 210.51.225.0/24 [20/0] via 203.62.252.186, 2w3d
B 204.255.51.0/24 [20/4294967294] via 144.228.241.81, 3w5d <========= 255 is matched
B 203.34.233.0/24 [20/0] via 203.62.252.186, 3w5d
B 192.68.132.0/24 [20/0] via 216.218.252.145, 3w5d
B 222.35.252.0/24 [20/559] via 64.125.0.137, 1w0d
B 212.205.24.0/24 [20/7549] via 64.125.0.137, 2d05h
B 212.103.178.0/24 [20/0] via 216.218.252.145, 2w3d
B 209.50.226.0/24 [20/124] via 64.125.0.137, 3w5d
B 208.50.227.0/24 [20/3107] via 208.51.134.254, 1d22h
B 203.254.52.0/24 [20/0] via 213.140.32.146, 1w1d
B 203.1.203.0/24 [20/0] via 203.62.252.186, 3d03h
B 202.171.96.0/24 [20/361] via 129.250.0.11, 5d19h
+ Regular Expression:
This matches one or more sequences of the character preceding the plus sign.
5+ requires there to be at least one number 5 in the string to be matched
In this example we are searching for 0 followed by one or more 0's:
Router#sh run | i 00+
load 7960-7940 P0S3-07-4-00
create profile sync 0002381328447097
number 1100
id mac 0003.6B8B.174A
clock rate 2000000
tftp-server flash:P0S3-07-4-00.bin
tftp-server flash:P003-07-4-00.bin
tftp-server flash:P0S3-07-4-00.loads
tftp-server flash:P003-07-4-00.sbn
tftp-server flash:P0S3-07-4-00.sb2
tftp-server flash:P00405000700.bin
tftp-server flash:P00405000700.sbn
tftp-server flash:P0030702T023.bin
tftp-server flash:P0030702T023.loads
tftp-server flash:P0030702T023.sb2
tftp-server flash:P0030702T023.sbn
load 7910 P00405000700
load 7960-7940 P0030702T023
ip source-address 10.1.1.1 port 2000
create cnf-files version-stamp 7960 Jan 28 2007 14:22:09
number 1000
number 1001
[] Regular Expression:
Nest characters for matching. Separate endpoints of a range with a dash (-).
(18)* matches any number of the two-character string 18
([A-Za-z][0-9])+ matches one or more instances of letter-digit pairs: b8 and W4, as examples
Router#sh run | i ([A-Za-z][0-9])+
allow-connections h323 to sip
allow-connections sip to h323
load 7960-7940 P0S3-07-4-00
id mac 0003.6B8B.174A
codec g711ulaw
interface Loopback0
interface Loopback1
interface Loopback2
interface Loopback3
interface Loopback4
interface Loopback5
interface Loopback6
interface Loopback7
interface Loopback8
interface Loopback9
interface Loopback10
interface Loopback11
interface Loopback12
interface Loopback13
interface Loopback14
interface Loopback15
* Regular Expression:
Matches zero or more sequences of the character preceding the asterisk. Also acts as a wildcard for matching any number of characters.
0* matches any occurrence of the number 0 including none
10\..* matches the characters 10. and any characters that follow 10.
Router#sh run | i 10\..*
network 10.1.1.0 255.255.255.0
option 150 ip 10.1.1.1
default-router 10.1.1.1
source-address 10.1.1.1 port 5060
ip address 192.168.10.1 255.255.255.0
ip address 10.1.1.1 255.255.255.0
destination-pattern 10..
session target ipv4:10.1.1.1
session target ipv4:10.1.1.6
session target ipv4:10.1.1.11
session target ipv4:10.1.1.16
session target ipv4:10.1.1.21
session target ipv4:10.1.1.26
session target ipv4:10.1.1.31
session target ipv4:10.1.1.36
session target ipv4:10.1.1.41
session target ipv4:10.1.1.46
session target ipv4:10.1.1.51
session target ipv4:10.1.1.56
session target ipv4:10.1.1.61
session target ipv4:10.1.1.66
In this section we learnt about the different regular expressions and saw some examples. In the next section, let’s use regular expressions on an Internet Backbone router.
Comments