How to find all files containing a specific string within directory and all subdirectories on a BusyBox v1.4.2? I need to find string "AA:CC:DD:00:EE:55" or "AACCDD00EE55"

BusyBox v1.4.2 (2012-06-01 11:17:34 CST) Built-in shell (ash)
Enter 'help' for a list of built-in commands.

Built-in commands:
        . : [ [[ bg break cd chdir continue echo eval exec exit export
        false fg getopts hash help jobs kill local pwd read readonly
        return set shift source test times trap true type ulimit umask
        unset wait

# busybox --help
BusyBox v1.4.2 (2012-06-01 11:17:34 CST) multi-call binary

Usage: busybox [function] [arguments]...
   or: [function] [arguments]...

Currently defined functions:
        [, [[, adduser, ash, awk, cat, chmod, chroot, cp, cut,
        date, dd, deluser, dmesg, echo, false, free, getopt, grep,
        halt, hexdump, hostname, htxsnmptelnet, ifconfig, init,
        insmod, kill, killall, ln, login, ls, lsmod, mkdir, mknod,
        mount, mv, netstat, passwd, ping, ping6, poweroff, ps,
        pwd, reboot, renice, rm, rmmod, route, sh, sleep, tar,
        test, tftp, top, umount, wget
  • busybox grep --help will show you grep's options. – cas Nov 14 '15 at 21:24

grep has a recursive flag -r, and allows specifying multiple search patters with -e flag. Also, from the format you seem to be looking for a mac address, so that could be upper or lower case.

Knowing that you could do

grep -ir -e "AA:CC:DD:00:EE:55" -e "AACCDD00EE55" /directory

Notice that you have to specify sudo in case you don't have read permissions for files/folders, such as /etc folder.

For instance,

xieerqi:$ grep -iR "string" /etc/cups                                                                              
grep: /etc/cups/subscriptions.conf: Permission denied
grep: /etc/cups/classes.conf: Permission denied
grep: /etc/cups/printers.conf.O: Permission denied
grep: /etc/cups/subscriptions.conf.O: Permission denied
grep: /etc/cups/ssl: Permission denied
grep: /etc/cups/printers.conf: Permission denied

That happens because permissions of all items in /etc/cups and the directory itself have read-write permissions only for root user, and read permissions for lp group. For other users - no read permissions. For instance,

-rw-r----- 1 root lp     92 11月  6 09:15 subscriptions.conf

That's why you need sudo access.

Additionally, grep may complain about not being able to read an entry, so you may need to specify 2> /dev/null redirection

For instance, I get the following error because /etc/blkid.tab is a symlink, not an actual file.

xieerqi:$ sudo grep -iR "b4:82:fe:d3:85:56" /etc                                                                  
[sudo] password for xieerqi: 
grep: /etc/blkid.tab: No such file or directory

To make the error disappear from the output, I'd do sudo grep -iR "b4:82:fe:d3:85:56" 2> /dev/null, which redirects error stream to /dev/null device, basically black-hole for any output

| improve this answer | |
  • busybox's version of grep doesn't support -R. It does support -r. – cas Nov 14 '15 at 21:21
  • On some directories grep complains grep: Permission denied. Please clarify about 2> /dev/null redirection, where this need be specified? Also, the target strings need be inside quotation marks? – minto Nov 15 '15 at 0:49
  • As i said permission denied means you need sudo to read those directories. So append sudo before grep command. 2> /dev/null sends errors to null device ,ie they wont be displayed. Example, compare ls thisfiledoesnt exist and ls thisfie doesn't exist >/dev/null – Sergiy Kolodyazhnyy Nov 15 '15 at 0:53
  • It's hard to edit my answer on mobile. Ill edit it in 15 mins when i get to my laptop – Sergiy Kolodyazhnyy Nov 15 '15 at 0:57
  • Edited answer, please review – Sergiy Kolodyazhnyy Nov 15 '15 at 1:47

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.