查找文本文件中所有出现的模式

Question

I have a text file which looks like this

Nmap scan report for 192.168.2.1
Host is up (0.023s latency).
PORT     STATE  SERVICE
5001/tcp closed commplex-link
MAC Address: EC:1A:59:A2:84:80 (Belkin International)

Nmap scan report for 192.168.2.2
Host is up (0.053s latency).
PORT     STATE  SERVICE
5001/tcp closed commplex-link
MAC Address: 94:35:0A:F0:47:C2 (Samsung Electronics Co.)

Nmap scan report for 192.168.2.3  
Host is up (0.18s latency).  
PORT     STATE    SERVICE  
5001/tcp filtered commplex-link  
MAC Address: 00:13:CE:C0:E5:F3 (Intel Corporate)  

Nmap scan report for 192.168.2.6
Host is up (0.062s latency).
PORT     STATE  SERVICE
5001/tcp closed commplex-link
MAC Address: 90:21:55:7D:53:4F (HTC)

I want to find all the IPs with port 5001 closed (not filtered). I tried to use the following logic to find all such IPs

fp = open('nmap_op.txt').read()
ip = re.compile('([0-9]+\.[0-9]+\.[0-9]+\.[0-9]+)(.*)closed',re.S)
matched = ip.findall(fp)
for item in matched:
  print item

I was expecting the output to be

192.168.2.1

192.168.2.2

192.168.2.6

But I'm not getting the desired output. The output is just one item which looks like this:

('192.168.2.1', '\\nHost is up (0.023s latency).\\nPORT STATE SERVICE\\n5001/tcp closed commplex-link\\nMAC Address: EC:1A:59:A2:84:80 (Belkin International)\\n\\nNmap scan report for 192.168.2.2\\nHost is up (0.053s latency).\\nPORT STATE SERVICE\\n5001/tcp closed commplex-link\\nMAC Address: 94:35:0A:F0:47:C2 (Samsung Electronics Co.)\\n\\nNmap scan report for 192.168.2.3\\nHost is up (0.18s latency).\\nPORT STATE SERVICE\\n5001/tcp filtered commplex-link\\nMAC Address: 00:13:CE:C0:E5:F3 (Intel Corporate)\\n\\nNmap scan report for 192.168.2.6\\nHost is up (0.062s latency).\\nPORT STATE SERVICE\\n5001/tcp )

Where am I going wrong?

Solution: Below logic worked for me. If anyone has a better answer, please let me know.

fp = open('nmap_op.txt').read()
entries = re.split('\n\n',fp)  
ip = re.compile('([0-9]+\.[0-9]+\.[0-9]+\.[0-9]+).*?closed',re.S)
matched = []
for item in entries:
  if ip.search(item):
    matched.append(ip.search(item).group(1))

Answer 1

You don't need re.S here. The s modifier changes the meaning of the dot meta-character ( . ) from " match everything except newline characters " to " match everything including newline characters ". You don't need that here.

The second capturing group isn't required either. You can just remove it to have only the IPs returned:

>>> matched = re.findall('([0-9]+\.[0-9]+\.[0-9]+\.[0-9]+).*closed', fp)
>>> matched
['192.168.2.1', '192.168.2.2', '192.168.2.6']

Answer 2

Since the lines format seems to be always the same (the ip starts at offset 21 and ends at the next space), you can try this another way without regex:

for block in data.split("\n\n"):
    if block.find('5001/tcp closed')>0:
        print block[21:block.find('\n', 27)]

Answer 3

You can do:

>>> re.findall(r'^Nmap.*?(\d+\.\d+\.\d+\.\d+).*?5001\/tcp closed', fp, re.M)
# ['192.168.2.1', '192.168.2.2', '192.168.2.6']

Answer 4

Solution: Below logic worked for me.

fp = open('nmap_op.txt').read()
entries = re.split('\n\n',fp)  
ip = re.compile('([0-9]+\.[0-9]+\.[0-9]+\.[0-9]+).*?closed',re.S)
matched = []
for item in entries:
  if ip.search(item):
    matched.append(ip.search(item).group(1))