Using regular expressions with the ‘Show’ command

Do you remember the “Cisco regular expressions” tutorial? A regular expression is entered as part of a command and is a pattern made up of symbols, letters, and numbers that represent an input string for matching (or sometimes not matching). Matching the string to the specified pattern is called pattern matching. Pattern matching either succeeds or fails. If a regular expression can match two different parts of an input string, it will match the earliest part first.

In this tutorial, I will explain how to use the ‘show’ command with the regular expression.

Below some examples:

To check exactly an IP address use the backslash (\) before the dot (.) to remove the special meaning of the dot (.) character and the underscore (_) to check the space before/after the IP address. For example, to find the ip address 10.0.0.1 in the running configuration, use the command

show run | i _10\.0\.0\.1_

and not the command (it can match 10.0.0.1, 110.0.0.1, 10.1.1.11, …)

show run | i 10.0.0.1

To see all the VRF route:

sh ip route vrf *

and to eliminate the lines:

Codes: C - connected, S - static, R - RIP, M - mobile, B - BGP
D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area
N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
E1 - OSPF external type 1, E2 - OSPF external type 2
i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2
ia - IS-IS inter area, * - candidate default, U - per-user static route
o - ODR, P - periodic downloaded static route

Gateway of last resort is not set

try this regular expression (it is true when the line contains one number, one dot (.) or the word ‘Routing’:

sh ip route vrf * | i (([0-9]\.)|Routing)

To see all ‘administratively down’ fastethernet interfaces in the module #1 (it is true when the line starts with the character ‘F’ followed by ‘t1/’ and contains the word ‘administr’:

sh ip inter brie | i ^F.*t1/.*administr

To see all CDP entry:

sh cdp entry *

and to view only the device name and the IP address (it is true when the line starts with the string ‘Device’ or contains the string ‘IP address’:

sh cdp entry * | i (^Device|IP address)

To search a mac address that starts with ‘c800’:

sh mac-address-table | i ^c800\.

… and to find a mac ddress that end with ‘0000’:

sh mac-address-table | i (.*)\.(.*)\.0000

Below a good example of the RegEx with the ‘show’ command. The commands used are:

  • show run | i _10\.0\.0\.1_
  • sh ip inter brie | i ^F.*t1/.*administr
  • sh mac-address-table | i ^c800\.
  • sh mac-address-table | i (.*)\.(.*)\.0000

To better understand the example in the video, check the partial running-configuration:

hostname Ciscozine
!
!
interface Loopback0
ip address 10.0.0.1 255.255.255.0
!
interface Loopback1
ip address 10.0.10.1 255.255.255.0
!
interface Loopback2
ip address 10.10.0.1 255.255.255.0
!
interface Loopback3
ip address 10.10.10.1 255.255.255.0
!
interface Loopback4
ip address 110.0.0.1 255.255.255.0
!
interface Loopback5
ip address 210.0.0.11 255.255.255.0
!
interface FastEthernet0/0
no ip address
shutdown
duplex auto
speed auto
!
interface FastEthernet0/1
no ip address
shutdown
duplex auto
speed auto
!
interface FastEthernet1/0
shutdown
!
interface FastEthernet1/1
shutdown
!
interface FastEthernet1/2
shutdown
!
interface FastEthernet1/3
shutdown
!
interface FastEthernet1/4
shutdown
!
interface FastEthernet1/5
shutdown
!
interface FastEthernet1/6
shutdown
!
interface FastEthernet1/7
shutdown
!
interface FastEthernet1/8
!
interface FastEthernet1/9
!
interface FastEthernet1/10
!
interface FastEthernet1/11
!
interface FastEthernet1/12
!
interface FastEthernet1/13
!
interface FastEthernet1/14
!
interface FastEthernet1/15
!

and the show ip inter brief | exclude Vlan:

 

Ciscozine#sh ip interface brie | exclude Vla
Interface         IP-Address   OK? Method Status                Protocol
FastEthernet0/0   unassigned   YES NVRAM  administratively down down
FastEthernet0/1   unassigned   YES NVRAM  administratively down down
FastEthernet1/0   unassigned   YES unset  administratively down down
FastEthernet1/1   unassigned   YES unset  administratively down down
FastEthernet1/2   unassigned   YES unset  administratively down down
FastEthernet1/3   unassigned   YES unset  administratively down down
FastEthernet1/4   unassigned   YES unset  administratively down down
FastEthernet1/5   unassigned   YES unset  administratively down down
FastEthernet1/6   unassigned   YES unset  administratively down down
FastEthernet1/7   unassigned   YES unset  administratively down down
FastEthernet1/8   unassigned   YES unset  up                    down
FastEthernet1/9   unassigned   YES unset  up                    down
FastEthernet1/10  unassigned   YES unset  up                    down
FastEthernet1/11  unassigned   YES unset  up                    down
FastEthernet1/12  unassigned   YES unset  up                    down
FastEthernet1/13  unassigned   YES unset  up                    down
FastEthernet1/14  unassigned   YES unset  up                    down
FastEthernet1/15  unassigned   YES unset  up                    down
Loopback0         10.0.0.1     YES manual up                    up
Loopback1         10.0.10.1    YES manual up                    up
Loopback2         10.10.0.1    YES manual up                    up
Loopback3         10.10.10.1   YES manual up                    up
Loopback4         110.0.0.1    YES manual up                    up
Loopback5         210.0.0.11   YES manual up                    up

Remember: To negate an expression use ‘exclude’ instead of the ‘include’!
Remember: The RegEx ‘show’ can be saved with the alias feature! For instance, if you would create a shortcut to the command

sh ip route vrf * | i (([0-9]\.)|Routing)

define it in global configuration:

alias exec allvrfroute sh ip route vrf * | i (([0-9]\.)|Routing)

and use it (allvrfroute) in priviledge mode or (do allvrfroute) in global configuration!

2 COMMENTS

LEAVE A REPLY

Please enter your comment!
Please enter your name here

This site uses Akismet to reduce spam. Learn how your comment data is processed.