Question

Here is one line from a raw usb dump :

Id  Type                        Time        Length   Hex             Ascii

16  Out (USB URB Function: 45)  0.01513     2048     a3 e8 55 cc      correpondant ascii

Note that Id, Type, Time, Length change all the time, and that the the number of hex bytes is really huge.

What I want to do is erase everything except the hex bytes. I thought about using sed to replace everything which was not a pair of numbers/[letters from A to F] and between two spaces :

sed -E 's/([^ ][^a-f0-9][^a-f0-9][^ ])//g' <orig >new

But it gives me that :

1Uun)   0.015013    2048    a3 e8 55 cc  

and just some parts of the ascii is erased.

I tried some other sed commands based on the one above, but it doesn’t work either.

Any ideas ? Thanks.

Answer 1

sed may not be the best tool for this job. I would personally write a parser in Python or similar.

However, if you want to grab this using regular expressions from the Terminal, perhaps use grep:

% grep -o '\(\b[[:xdigit:]]\{2\}[[:space:]]\)\+' orig 
16 
a3 e8 55 cc 

Note that “16” is a hex pair.