Output Filtering IOS Commands with Regular Expressions

Want to navigate Cisco IOS, IOS-XR, and IOS-XE routers faster?  Don’t search though tons of text visually to find specific information.  View just the relevant information by expanding your | include usage to include regex (regular expressions).

Cisco IOS and IOS-XR support filtering output using regular expressions.  Cisco’s documentation on their regular expression format is available here, but we’ll go through some of the fundamentals and some useful tricks.  Regex can be used to find just the specific information you’re looking for from usually long output.

Correct Use of .s

You’ve probably been using regular expressions in Cisco IOS without realizing it – ever notice that once in a long while you’ll see lines through a ”| include” filter that you didn’t expect to see?  For example, say we’re looking for an interface on this router that has the assigned IP of 10.1.4.1 and try to filter ”show ip int brief” to obtain this info:

Router1#sh ip int bri | i 10.1.4.1      
Loopback0              10.1.4.1        YES NVRAM  up                    up
Loopback4              10.104.120.40   YES NVRAM  up                    up
Port-channel1          10.104.120.24   YES manual up                    up
Port-channel2          10.104.120.32   YES manual up                    up
Vlan100                10.104.120.9    YES NVRAM  up                    up

This showed a lot of interfaces that we weren’t looking for!  This is because the . in the include statement is not interpreted literally – we inputted a regular expression, and IOS interpreted it as such.  In regular expressions, . means “any character”, so they match any characters, including . and 4 in the above extra interfaces.  For example, in the Loopback4 line, the regular expression 10.1.4.1 matched against 10.104.1 (the characters matched against the . in the regex are bold and red).  If we wanted to match only the exact output 10.1.4.1, we need to escape the .s by placing a \ before them:

Router1#sh ip int bri | i 10\.1\.4\.1      
Loopback0              10.1.4.1        YES NVRAM  up                    up

Now, the .s are interpreted literally and we only see only the interface we wanted.

Filter on Multiple Components of a Line

As mentioned above, the . character means “any character”.  The * character means “the previous character can exist 0 or more times”.  Therefore, if we use .* within a regular expression, it reads like “any character can exist 0 or more times”.  If we wanted to search for all TenGigabit interfaces that are up, this is easy using .*:

Router1#show int desc | i Te.*up
Te2/0/0                        up             up       Router2
Te3/0/1                        up             up       Router3
Te4/0/0                        up             up       Router4

Filter from Multiple Choices

We can allow multiple patterns to match using the | character, and we can group these using parenthesis. Want to list all routes in 10.0.0.0/23? We could use this regex: 10\.0\.0\.|10\.0\.1\.
This filters literally for anything that begins with 10.0.0. or 10.0.1.. This is not the most efficient way of searching for this, as we can reuse “Te” by grouping the OR statement using |.
Here’s an example of filtering a search for any line including either Te2/0/0 or Te3/0/1 – note that in the regex “Te” only occurs once but we use parenthesis to group the “or” statement:

Router1#show int desc | i Te(2/0/0|3/0/1)
Te2/0/0                        up             up       Router2
Te3/0/1                        up             up       Router3

Note that for IOS-XR and IOS-XE, because they can accept multiple output filters (ie. show int desc | include Te | exclude down), you must encapsulate any regular expressions that use | with “”s.

That’s it for this tutorial on the basics. Come back for information on some advanced Cisco regular expression output filtering techniques.

Post a Comment