0

This question already has an answer here:

I've got a tcpdump file.

I want to remove certain packets. They are easy to spot because they have

0x0000: a6a6 a6a6 a6a6 a6a6 ........

as the first line of data.

The full packet looks (mutatis mutandis) like:

16:24:46.132673 00:35:1a:71:91:37 (oui Unknown) > 05:05:05:c5:05:05 (oui Unknown), ethertype Unknown (0x88be), length 60: 
    0x0000:  a6a6 a6a6 a6a6 a6a6 0101 2400 00b4 b83e
    0x0010:  931f 00be 7c80 545a 0202 0000 0000 00a5
    0x0020:  a5a5 a500 0000 0000 0000 0000 0000

So what I'd like to say is:

"Remove lines that contain this pattern, and the line before the pattern, and the two lines after it".

Sed or awk or grep would be good, e.g.

$ sed -i 'magic' file

Any ideas what goes in place of magic?

marked as duplicate by don_crissti, Romeo Ninov, Archemar, Sundeep, GAD3R Jul 26 '17 at 13:12

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

  • I think the answer to my question is 'grep can do this, see this question'. The hard bit is realising that grep is good enough and you don't have to do clever awk things. – John Lawrence Aspden Jul 26 '17 at 10:30
  • No, the hard bit is realising grep alone cannot do this. – don_crissti Jul 26 '17 at 10:31
  • Thanks! I thought the original had worked, but I was diffing the wrong files. – John Lawrence Aspden Jul 26 '17 at 10:55
0

Turns out the answer is 'use vim', and there are details here:

How to grep-inverse-match and exclude "before" and "after" lines

$ vim -Nes "+g/a6a6\ a6a6/.-1,.+2d" '+w !tee' '+q!' file >newfile

Not the answer you're looking for? Browse other questions tagged or ask your own question.