grep mac address - 2 consecutive lines

Question

My file consists of scan results. Each result can have 4-20 lines

I want to filter only MAC addresses for Successful (Passed scans)

My file:

FAIL user1 OS-Anti-Virus-Check     Mac OS X 10.10.5

        PASSED Operating-System :: OS X 10.10 Yosemite
        PASSED Operating-System :: OS X 10.10 Yosemite Update
        FAILED Anti-Virus :: Sophos
        E0:AC:CB:82:C3:F2 - en0
FAIL user2 OS-Anti-Virus-Check     Windows Vista (TM) Home Premium 6.0 Service Pack 2

        PASSED Operating-System :: Windows Vista
        PASSED Operating-System :: Vista Service Pack
        PASSED Operating-System :: Windows Vista Edition
        PASSED Operating-System :: Vista Critical and Security Updates
        PASSED Operating-System :: Windows Vista AutoUpdates Label
        FAILED Anti-Spyware :: Microsoft Windows Defender
        FAILED Anti-Virus :: Microsoft Windows Defender
        00:23:4D:E2:8E:03 - Atheros AR928x Wireless Network Adapter
        00:1D:BA:AF:D4:35 - Marvell Yukon 88E8055 PCI-E Gigabit Ethernet Controller
PASS user3 OS-Anti-Virus-Check     Windows 8 China 6.2

        PASSED Anti-Spyware :: Avast! Premier
        PASSED Anti-Virus :: Avast! Premier
        PASSED Anti-Virus :: Avast! Premier Definitions
        PASSED Operating-System :: Windows 8 x64
        PASSED Operating-System :: Windows 8 x64 Service Pack
        PASSED Operating-System :: Windows 8 x64 Edition
        PASSED Operating-System :: Windows 8 x64 Critical and Security Updates
        PASSED Operating-System :: Windows 8 x64 AutoUpdates Label
        28:D2:44:D2:7A:2E - Intel(R) Ethernet Connection I218-V
        7C:7A:91:73:88:09 - Intel(R) Wireless-N 7260
        7C:7A:91:73:88:0A - Microsoft Wi-Fi Direct ����������
        7C:7A:91:73:88:0D - Bluetooth �?(����������
PASS user4 OS-Anti-Virus-Check     Mac OS X 10.10.5

        PASSED Anti-Virus :: Sophos
        PASSED Anti-Virus :: Sophos Definitions
        PASSED Operating-System :: OS X 10.10 Yosemite
        PASSED Operating-System :: OS X 10.10 Yosemite Update
        E0:AC:CB:82:C3:F2 - en0

I would like to extract list of mac addressees that Passed scans.

So in example

if line contains "PASSED" and next line or 2 contain mac address ... print mac addresses.

I would be grateful if someone could point me in the right direction...

Answer 1

You could use grep twice:

• first time to identify "PASSED" lines, followed by a MAC addresses
• second time to extract the MAC address from the result

Exemple:

grep -Pzo 'PASSED.*?\s+([0-9A-F]{2}(\:[0-9A-F]{2}){5})' d.txt | grep -Po '[0-9A-F]{2}(\:[0-9A-F]{2}){5}'

You can check the two next lines with the following command (I still can't find a way to make it to work for both cases):

grep -Pzo 'PASSED.*?(\s+([0-9A-F]{2}(\:[0-9A-F]{2}){5}).*?){2}' 3.txt | grep -Po '[0-9A-F]{2}(\:[0-9A-F]{2}){5}'

Answer 2

This is trivial with Awk.

awk '$1 ~ /^[0-9a-f][0-9a-f]:/ && p { print; next; }
    /PASSED/ { p=1; next }
    { p=0 }'

The first line prints if the first field looks like a MAC address and p is non-zero (indicating that we saw PASSED on a previous line). The next two lines examine the input for PASSED ; when it's seen, we set p to one, otherwise, to zero. The script then continues from the top with the next input line.