[英]get a substring from a file shell script
I need a little help with this shell script. 我需要这个shell脚本一些帮助。 I have a variable, represents a IP/TCP header. 我有一个变量,代表一个IP / TCP标头。 I need filter a traffic capture by the header selected. 我需要按所选标题过滤流量捕获。
> var=ttl 128
>
> tcpdump -Xvv -n -i eth0 -c 300 > capture.txt 2>/dev/null
>
> grep -i "$var" capture.txt > resultGrep.txt
The result of the tcpdump command is some like this tcpdump命令的结果如下所示
15:29:18.164566 IP (tos 0x0, ttl 1, id 2394, offset 0, flags [none], proto UDP (17), length 125)
10.0.0.155.58363 > 239.255.255.254.1900: UDP, length 97
0x0000: 4600 0024 0000 0000 0102 3ad3 0a00 0000 F..$......:.....
0x0010: e000 0001 9404 0000 1101 ebfe 0000 0000 ................
0x0020: 0300 0000 0000 0000 0000 0000 0000 ..............
15:29:18.164566 IP (tos 0x0, ttl 128, id 2394, offset 0, flags [none], proto UDP (17), length 125)
10.0.0.131.58363 > 239.255.255.250.1900: UDP, length 97
0x0000: 4600 0024 0000 0000 0102 3ad3 0a00 0000 F..$......:.....
0x0010: e000 0001 9404 0000 1101 ebfe 0000 0000 ................
0x0020: 0300 0000 0000 0000 0000 0000 0000 ..............
I need have ip address source and ip address destination, in the example the output result must be 我需要IP地址源和IP地址目标,在示例中,输出结果必须为
10.0.0.131.58363 > 239.255.255.250.1900 10.0.0.131.58363> 239.255.255.250.1900
Try doing this directly in a Unix pipe
over tcpdump
: 尝试通过tcpdump
在Unix pipe
直接执行此操作:
tcpdump -Xvv -n -i eth0 -c 300 |
grep -oP "\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}.\d{1,5}\s+>\s+\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}.\d{1,5}"
This is rock solid ;) 这是坚如磐石的;)
well my understanding of the question is, you want to extract things from your resultGrep.txt
, not capture.txt
我对这个问题的理解是,您想从resultGrep.txt
提取内容,而不是capture.txt
then: 然后:
grep -oP '[\d\.]*\s*>\s*[\d\.]*' resultGrep.txt
see test: 查看测试:
kent$ echo "15:29:18.164566 IP (tos 0x0, ttl 1, id 2394, offset 0, flags [none], proto UDP (17), length 125)
dquote> 10.0.0.131.58363 > 239.255.255.250.1900: UDP, length 97
dquote> 0x0000: 4600 0024 0000 0000 0102 3ad3 0a00 0000 F..$......:.....
dquote> 0x0010: e000 0001 9404 0000 1101 ebfe 0000 0000 ................
dquote> 0x0020: 0300 0000 0000 0000 0000 0000 0000 .............."|grep -oP '[\d\.]*\s*>\s*[\d\.]*'
10.0.0.131.58363 > 239.255.255.250.1900
声明:本站的技术帖子网页,遵循CC BY-SA 4.0协议,如果您需要转载,请注明本站网址或者原文地址。任何问题请咨询:yoyou2525@163.com.