Posts

  • Home -
  • news -
  • Cisco Regular expression
research
  • 03/14
  • 2017

Cisco Regular expression

We have covered some basic regular expressions in our "Cool IOS Commands" EBook. Here I want to show you more complicated examples of how to use the power of regular expressions to filter output. This will allow the router to do the searching for text, rather than us doing it manually. 

Regular expressions are used in many places in the IOS including BGP AS paths and Voice number translations. They are also used in other languages like Perl and TCL. Here however, we are going to concentrate on regular expressions with IOS show commands. We are going to use them to search for specific sets of strings. 

A regular expression is a pattern (for example a phrase or a number) that can be used very effectively to filter output. Regular expressions are case-sensitive and allow for complex matching requirements. 

I start with some simple examples so that you can learn each regular expression character individually and then we will combine them into complicated strings. As always with programming, there are many ways to do things, so use your imagination:

^ Regular Expression 
Use this to look for text at the beginning of a string.

For Example: ^123 matches 1234, but not 01234 or 91234 

On a router we can demonstrate this as follows: (without any regular expressions)

          Router#show run | include ip
          ip cef
          no ip dhcp use vrf connected
          ip dhcp pool ITS
          option 150 ip 10.1.1.1
          no ip domain lookup
          voice service voip
          allow-connections h323 to sip
          allow-connections sip to h323
          allow-connections sip to sip
          ip address 192.168.10.1 255.255.255.0
          ip address 192.168.11.1 255.255.255.0
          ip address 192.168.12.1 255.255.255.0
          ip address 192.168.13.1 255.255.255.0
          ip address 192.168.14.1 255.255.255.0
          <MORE>

However, if we use the following:
          Router#show run | include ^ip

          The output is:
          Router#show run | include ^ip
          ip cef
          ip dhcp pool ITS
          ip http server

Note - as expected, every line begins with "ip", string we matched on


$ Regular Expression:
Use this to look for text at the end of a string

For Example123$ matches 0123, but not 1234 

On a router we can demonstrate this as follows: (without any regular expressions)

          Router#show run | include 1
          Current configuration : 5174 bytes
          ! Last configuration change at 15:27:21 UTC Wed Jan 24 2007
          ! NVRAM config last updated at 14:25:01 UTC Wed Jan 24 2007
          version 12.4
          network 10.1.1.0 255.255.255.0
          option 150 ip 10.1.1.1
          default-router 10.1.1.1
          source-address 10.1.1.1 port 5060
          create profile sync 0002381328447096
          voice register dn 1
          number 1100
          number 1101
          voice register pool 1
          id mac 0003.6B8B.174A
          number 1 dn 1
          codec g711ulaw
          ip address 192.168.10.1 255.255.255.0
          interface Loopback1
          ip address 192.168.11.1 255.255.255.0
          ip address 192.168.12.1 255.255.255.0
          ip address 192.168.13.1 255.255.255.0

but if we change it to 
          Router#show run | include 1$

The output is:
          Router#show run | include 1$
          voice register dn 1
          number 1101
          voice register pool 1
          number 1 dn 1
          interface Loopback1
          interface Loopback11
          interface Loopback21
          interface FastEthernet0/1
          session target ipv4:10.1.1.1
          session target ipv4:10.1.1.11
          session target ipv4:10.1.1.21
          session target ipv4:10.1.1.31
          session target ipv4:10.1.1.41
          session target ipv4:10.1.1.51
          session target ipv4:10.1.1.61
          number 1001
          ephone 1
          button 1:1

Note - as expected, every line ends "1", string we matched on.


. Regular Expression:
The "." matches any single character. 

For example:
0.0 matches 0x0 and 020 
t..t matches strings such as test, text, and tart 

On a router, let’s look for all lines that end in 0 and another single character:

          Router#sh run | include 0.$
          ! Last configuration change at 15:27:21 UTC Wed Jan 24 2007
          ! NVRAM config last updated at 14:25:01 UTC Wed Jan 24 2007
          load 7960-7940 P0S3-07-4-00
          number 1100
          number 1101
          clock rate 2000000
          destination-pattern 1000
          load 7910 P00405000700
          ip source-address 10.1.1.1 port 2000
          number 1000
          number 1001
          scheduler allocate 20000 1000
          
Note: All the lines end with 0 and another single character.


_ Regular Expression:
This replaces a long regular expression list by matching a comma (,), left brace ({), right brace (}), the beginning of the input string, the end of the input string, or a space. 

The characters _1400_ can match any of the following strings: 
          ^1400$ 
          ^1400space 
          space1400 
          {1400, 
          ,1400, 
          {1400} 
          ,1400, 

We are going to use it looking for a space - in the following example, we are looking for loopback interfaces with 2:

          Router#show ip route | include k2
          C 192.168.12.0/24 is directly connected, Loopback2
          C 192.168.31.0/24 is directly connected, Loopback21
          C 192.168.30.0/24 is directly connected, Loopback20
          C 192.168.32.0/24 is directly connected, Loopback22
          
If however, we use the "_" character we see the following:

          Router#show ip route | include k2_
          C 192.168.12.0/24 is directly connected, Loopback2

Note: Only loopback interface 2 is displayed.


[ ] Regular Expression:
This matches the characters or a range of characters separated by a hyphen, within left and right square brackets. 
[02468w] matches for example 0, 4, and w, but not 1, 9, or K 

On a router we can demonstrate as follows:

          Router#show ip route | include k[1-9]
          C 192.168.12.0/24 is directly connected, Loopback2
          C 192.168.29.0/24 is directly connected, Loopback19
          C 192.168.28.0/24 is directly connected, Loopback18
          C 192.168.13.0/24 is directly connected, Loopback3
          C 192.168.14.0/24 is directly connected, Loopback4
          C 192.168.31.0/24 is directly connected, Loopback21
          C 192.168.30.0/24 is directly connected, Loopback20
          C 192.168.15.0/24 is directly connected, Loopback5
          C 192.168.25.0/24 is directly connected, Loopback15
          C 192.168.24.0/24 is directly connected, Loopback14
          C 192.168.27.0/24 is directly connected, Loopback17
          C 192.168.26.0/24 is directly connected, Loopback16
          C 192.168.11.0/24 is directly connected, Loopback1
          C 192.168.21.0/24 is directly connected, Loopback11
          C 192.168.20.0/24 is directly connected, Loopback10
          C 192.168.23.0/24 is directly connected, Loopback13
          C 192.168.22.0/24 is directly connected, Loopback12
          C 192.168.17.0/24 is directly connected, Loopback7
          C 192.168.16.0/24 is directly connected, Loopback6
          C 192.168.19.0/24 is directly connected, Loopback9
          C 192.168.32.0/24 is directly connected, Loopback22
          C 192.168.18.0/24 is directly connected, Loopback8
          
However, if we combine this with the "_" character:

          Router#show ip route | include k[1-9]_
          C 192.168.12.0/24 is directly connected, Loopback2
          C 192.168.13.0/24 is directly connected, Loopback3
          C 192.168.14.0/24 is directly connected, Loopback4
          C 192.168.15.0/24 is directly connected, Loopback5
          C 192.168.11.0/24 is directly connected, Loopback1
          C 192.168.17.0/24 is directly connected, Loopback7
          C 192.168.16.0/24 is directly connected, Loopback6
          C 192.168.19.0/24 is directly connected, Loopback9
          C 192.168.18.0/24 is directly connected, Loopback8
          

| Regular Expression: 
Use the | as a logical or statement.
Matches one of the characters or character patterns on either side of the vertical bar. 
A(B|C)D matches ABD and ACD, but not AD, ABCD, ABBD, or ACCD 

As an example, if you want to look for a route in the routing table that contains routes with 10 or 20 in it:
          Router#show ip route | include 10|20
          C 192.168.10.0/24 is directly connected, Loopback0
          C 192.168.20.0/24 is directly connected, Loopback10


\ Regular Expression:
Use this if the following character is not a wildcard, but an actual character you are looking for. 

As an example, if you do the following:

          Router#show running-config | include 10..

The result you get is:

          network 10.1.1.0 255.255.255.0
          option 150 ip 10.1.1.1
          default-router 10.1.1.1
          source-address 10.1.1.1 port 5060
          ip address 10.1.1.1 255.255.255.0
          destination-pattern 10..
          session target ipv4:10.1.1.1
          session target ipv4:10.1.1.6
          session target ipv4:10.1.1.11
          session target ipv4:10.1.1.16
          session target ipv4:10.1.1.21
          session target ipv4:10.1.1.26
          session target ipv4:10.1.1.31
          session target ipv4:10.1.1.36
          session target ipv4:10.1.1.41
          dial-peer voice 10 voip
          session target ipv4:10.1.1.46
          session target ipv4:10.1.1.51
          session target ipv4:10.1.1.56
          session target ipv4:10.1.1.61
          session target ipv4:10.1.1.66
          registrar ipv4:10.1.1.1 expires 60
          load 7910 P00405000700
          --More--

If you changed it to the following:

          Router#show running-config | include 10..$

The result is:

          destination-pattern 10..
          number 1000
          number 1001
          scheduler allocate 20000 1000

But if we now change it to use the "\" character, we can tell the router that we are actually looking for a ".", not using it as a wildcard:

          Router#show running-config | include 10\.\.

The result now is:

          destination-pattern 10..

Here is another example:

          Router#sh ip route | include \.20|\.10

This will look for anything entries in the routing table that contain a . followed by 20 or 10 (looking for the . in the IP address)

The result is:

          C 192.168.10.0/24 is directly connected, Loopback0
          C 192.168.20.0/24 is directly connected, Loopback10


? Regular Expression:
This matches zero or one occurrence of the pattern. (Remember to precede the question mark with Ctrl-V sequence to prevent it from being interpreted as a help command.) 
ba?b matches bb and bab 

          route-views.oregon-ix.net>show ip route | include 25?5

          B     216.221.5.0/24 [20/2954] via 208.51.134.254, 1w1d          <========= 25 is matched
          B     210.51.225.0/24 [20/0] via 203.62.252.186, 2w3d
          B     204.255.51.0/24 [20/4294967294] via 144.228.241.81, 3w5d           <========= 255 is matched
          B     203.34.233.0/24 [20/0] via 203.62.252.186, 3w5d
          B     192.68.132.0/24 [20/0] via 216.218.252.145, 3w5d
          B     222.35.252.0/24 [20/559] via 64.125.0.137, 1w0d
          B     212.205.24.0/24 [20/7549] via 64.125.0.137, 2d05h
          B     212.103.178.0/24 [20/0] via 216.218.252.145, 2w3d
          B     209.50.226.0/24 [20/124] via 64.125.0.137, 3w5d
          B     208.50.227.0/24 [20/3107] via 208.51.134.254, 1d22h
          B     203.254.52.0/24 [20/0] via 213.140.32.146, 1w1d
          B     203.1.203.0/24 [20/0] via 203.62.252.186, 3d03h
          B     202.171.96.0/24 [20/361] via 129.250.0.11, 5d19h


+ Regular Expression:
This matches one or more sequences of the character preceding the plus sign. 
5+ requires there to be at least one number 5 in the string to be matched 

In this example we are searching for 0 followed by one or more 0's:

          Router#sh run | i 00+

          load 7960-7940 P0S3-07-4-00
          create profile sync 0002381328447097
          number 1100
          id mac 0003.6B8B.174A
          clock rate 2000000
          tftp-server flash:P0S3-07-4-00.bin
          tftp-server flash:P003-07-4-00.bin
          tftp-server flash:P0S3-07-4-00.loads
          tftp-server flash:P003-07-4-00.sbn
          tftp-server flash:P0S3-07-4-00.sb2
          tftp-server flash:P00405000700.bin
          tftp-server flash:P00405000700.sbn
          tftp-server flash:P0030702T023.bin
          tftp-server flash:P0030702T023.loads
          tftp-server flash:P0030702T023.sb2
          tftp-server flash:P0030702T023.sbn
          load 7910 P00405000700
          load 7960-7940 P0030702T023
          ip source-address 10.1.1.1 port 2000
          create cnf-files version-stamp 7960 Jan 28 2007 14:22:09
          number 1000
          number 1001

[] Regular Expression:
Nest characters for matching. Separate endpoints of a range with a dash (-). 
(18)* matches any number of the two-character string 18 
([A-Za-z][0-9])+ matches one or more instances of letter-digit pairs: b8 and W4, as examples 

          Router#sh run | i ([A-Za-z][0-9])+

          allow-connections h323 to sip
          allow-connections sip to h323
          load 7960-7940 P0S3-07-4-00
          id mac 0003.6B8B.174A
          codec g711ulaw
          interface Loopback0
          interface Loopback1
          interface Loopback2
          interface Loopback3
          interface Loopback4
          interface Loopback5
          interface Loopback6
          interface Loopback7
          interface Loopback8
          interface Loopback9
          interface Loopback10
          interface Loopback11
          interface Loopback12
          interface Loopback13
          interface Loopback14
          interface Loopback15 

* Regular Expression:
Matches zero or more sequences of the character preceding the asterisk. Also acts as a wildcard for matching any number of characters. 
0* matches any occurrence of the number 0 including none 

10\..* matches the characters 10. and any characters that follow 10. 


          Router#sh run | i 10\..*

          network 10.1.1.0 255.255.255.0
          option 150 ip 10.1.1.1
          default-router 10.1.1.1
          source-address 10.1.1.1 port 5060
          ip address 192.168.10.1 255.255.255.0
          ip address 10.1.1.1 255.255.255.0
          destination-pattern 10..
          session target ipv4:10.1.1.1
          session target ipv4:10.1.1.6
          session target ipv4:10.1.1.11
          session target ipv4:10.1.1.16
          session target ipv4:10.1.1.21
          session target ipv4:10.1.1.26
          session target ipv4:10.1.1.31
          session target ipv4:10.1.1.36
          session target ipv4:10.1.1.41
          session target ipv4:10.1.1.46
          session target ipv4:10.1.1.51
          session target ipv4:10.1.1.56
          session target ipv4:10.1.1.61
          session target ipv4:10.1.1.66

In this section we learnt about the different regular expressions and saw some examples. In the next section, let’s use regular expressions on an Internet Backbone router.