2

I'm trying to find a certain unknown 11 character sequence in a huge packet capture file. The one thing I do know is that the string I'm looking has format x.x-xxxxxxx. I've been looking for a while and cannot find the right grep statement to accomplish this, can anyone help?

5
  • What do the xs stand for - any character at all?
    – Guss
    Dec 19, 2016 at 19:43
  • yeah any character letters or numbers
    – s.gang
    Dec 19, 2016 at 19:43
  • OK, so alpha numeric - only a through z, A through Z and 0 through 9 ?
    – Guss
    Dec 19, 2016 at 19:44
  • yes sir! the string cannot contain anything other than alpha numeric characters
    – s.gang
    Dec 19, 2016 at 19:44
  • You have regex as a tag, why not give it a go?
    – phk
    Dec 19, 2016 at 19:50

1 Answer 1

4

The format for grep is what we call a "POSIX regular expression" (look it up) and it support some simple matching primitives. If you know you want just alpha-numeric characters, you can use a character class like this: [a-zA-Z0-9]. grep even has a shortcut for this specific class (because it is so useful) like this: [[:alnum:]]. man grep has a lot more information about that.

You can also use repetition counting to specify how many of these characters you want to match. In your case you want to match: 1 alpha-numeric character, then a period, then one more character, then a dash followed by 7 characters. In POSIX regular expression this looks like so:

[[:alnum:]]\.[[:alnum:]]-[[:alnum:]]{7}

Notes:

  1. I had to escape the period with a backslash, otherwise it will be resolved as the "catch all characters" regular expression.
  2. In order for the repetition clause (the curly braces) to work you'd need to enable "extended regular expression mode" using -e or by running egrep instead of the standard grep.

So the full command may look like this:

egrep '[[:alnum:]]\.[[:alnum:]]-[[:alnum:]]{7}' /some/file

The output will be the lines where that expression matched, possibly highlighted in color (depending on your terminal). If your packet file is not line delimited (maybe it is binary) expect a lot of mess on the screen.

1
  • this was it. I was having trouble finding the correct regex expression for it. Thanks so much!
    – s.gang
    Dec 19, 2016 at 19:57

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .