From owner-freebsd-questions@FreeBSD.ORG Wed Aug 27 07:20:36 2008 Return-Path: Delivered-To: freebsd-questions@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34]) by hub.freebsd.org (Postfix) with ESMTP id F05C3106566B for ; Wed, 27 Aug 2008 07:20:36 +0000 (UTC) (envelope-from ws@au.dyndns.ws) Received: from ipmail05.adl2.internode.on.net (ipmail05.adl2.internode.on.net [203.16.214.145]) by mx1.freebsd.org (Postfix) with ESMTP id 5C5C18FC0C for ; Wed, 27 Aug 2008 07:20:35 +0000 (UTC) (envelope-from ws@au.dyndns.ws) X-IronPort-Anti-Spam-Filtered: true X-IronPort-Anti-Spam-Result: AhMBAKqbtEiWZWdv/2dsb2JhbAAIuTyBZ4Mv X-IronPort-AV: E=Sophos;i="4.32,277,1217773800"; d="scan'208";a="191409006" Received: from ppp103-111.static.internode.on.net (HELO [192.168.1.157]) ([150.101.103.111]) by ipmail05.adl2.internode.on.net with ESMTP; 27 Aug 2008 16:50:33 +0930 From: Wayne Sierke To: Martin McCormick In-Reply-To: <200808270312.m7R3CJNk076060@dc.cis.okstate.edu> References: <200808270312.m7R3CJNk076060@dc.cis.okstate.edu> Content-Type: text/plain Date: Wed, 27 Aug 2008 16:50:31 +0930 Message-Id: <1219821631.49053.205.camel@predator-ii.buffyverse> Mime-Version: 1.0 X-Mailer: Evolution 2.22.2 FreeBSD GNOME Team Port Content-Transfer-Encoding: 7bit Cc: freebsd-questions@freebsd.org Subject: Re: Regular Expression Trouble X-BeenThere: freebsd-questions@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: User questions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 27 Aug 2008 07:20:37 -0000 On Tue, 2008-08-26 at 22:12 -0500, Martin McCormick wrote: > I am trying to isolate only the MAC addresses that appear in > dhcpd logs. > For anyone who is interested, the sed construct that should do > this looks like: > > sed 's/.*\([[ your regular expression ]]\).*/\1/' > > The \1 tells sed to only print what matched and skip all the rest. > > I am doing something wrong with the regular expression > that is supposed to recognise a MAC address. MAC addresses look > like 5 pairs of hex digits followed by :'s and then a 6TH pair > to end the string. > > I have tried: > > [[:xdigit:][:xdigit:][:punct:] > > Sorry. It won't all fit on a line, but there should be a string > of 5 pairs and the : and then the 6TH pair followed by the > closing ] so the expression ends with ]] > > One should also be able to put: > > [[:xdigit:][:xdigit:][:punct:]]\{5,5\}[[:xdigit:][:xdigit]] > > Any ideas as to what else I can try? > There have already been good suggestions for you to choose from. I'll just add my bucketful to the TIMTOWTDI pool: Since you weren't specific about the format of the log data that you're attempting to parse (keep that in mind for future questions): # ifconfig | grep ether ether 02:00:20:75:43:34 ether 00:40:05:10:b9:79 # ifconfig | sed -nE 's/.*ether (([[:xdigit:]]{2}:){5}[[:xdigit:]]{2}).*/\1/p' 02:00:20:75:43:34 00:40:05:10:b9:79 # ifconfig | sed -nE 's/.*ether ([[:xdigit:]:]+).*/\1/p' 02:00:20:75:43:34 00:40:05:10:b9:79 # ifconfig | sed -nE 's/.*ether ([0-9a-f:]+).*/\1/p' 02:00:20:75:43:34 00:40:05:10:b9:79 # ifconfig | sed -nE '/ether/s/.*([0-9a-f:]{17}).*/\1/p' 02:00:20:75:43:34 00:40:05:10:b9:79 And then there's: # ifconfig | grep ether | cut -d" " -f 2 02:00:20:75:43:34 00:40:05:10:b9:79 But my preference would be: # ifconfig | awk '/ether/ {print $2}' 02:00:20:75:43:34 00:40:05:10:b9:79 Wayne