Home/ Questions/Q 9146115
In Process

The Archive Base Latest Questions

Editorial Team
  • 0
Asked: 2026-06-17T10:40:41+00:00

I need help to get a substring from a file. I have two variable,

  • 0

I need help to get a substring from a file. I have two variable, the IP source and IP destination address. I need to validate lines in file containing the two IP’s and get the port of the source address.

This is the input file:

15:29:18.164566 IP (tos 0x0, ttl 1, id 2394, offset 0, flags [none], proto UDP (17), length 125)
    10.0.0.155.58363 > 239.255.255.254.1900: UDP, length 97
    0x0000:  4600 0024 0000 0000 0102 3ad3 0a00 0000  F..$......:.....
    0x0010:  e000 0001 9404 0000 1101 ebfe 0000 0000  ................
    0x0020:  0300 0000 0000 0000 0000 0000 0000       ..............
15:29:18.164566 IP (tos 0x0, ttl 128, id 2394, offset 0, flags [none], proto UDP (17), length 125)
    10.0.0.131.58363 > 239.255.255.250.1900: UDP, length 97
    0x0000:  4600 0024 0000 0000 0102 3ad3 0a00 0000  F..$......:.....
    0x0010:  e000 0001 9404 0000 1101 ebfe 0000 0000  ................
 15:29:18.164566 IP (tos 0x0, ttl 1, id 2394, offset 0, flags [none], proto UDP (17), length 125)
    10.0.0.155.58363 > 239.255.255.254.1900: UDP, length 97
    0x0000:  4600 0024 0000 0000 0102 3ad3 0a00 0000  F..$......:.....
    0x0010:  e000 0001 9404 0000 1101 ebfe 0000 0000  ................
    0x0020:  0300 0000 0000 0000 0000 0000 0000       ..............
15:29:18.164566 IP (tos 0x0, ttl 128, id 2394, offset 0, flags [none], proto UDP (17), length 125)
    10.0.0.131.58363 > 239.255.255.250.1900: UDP, length 97
    0x0000:  4600 0024 0000 0000 0102 3ad3 0a00 0000  F..$......:.....
    0x0010:  e000 0001 9404 0000 1101 ebfe 0000 0000  ................
    0x0020:  0300 0000 0000 0000 0000 0000 0000       ..............
   0x0020:  0300 0000 0000 0000 0000 0000 0000       ..............
15:29:18.164566 IP (tos 0x0, ttl 128, id 2394, offset 0, flags [none], proto UDP (17), length 125)
    10.0.0.155.80 > 239.255.255.250.1900: UDP, length 97
    0x0000:  4600 0024 0000 0000 0102 3ad3 0a00 0000  F..$......:.....
    0x0010:  e000 0001 9404 0000 1101 ebfe 0000 0000  ................
    0x0020:  0300 0000 0000 0000 0000 0000 0000       ..............
   0x0020:  0300 0000 0000 0000 0000 0000 0000       ..............

The two vars:

ips=10.0.0.155

ipd=239.255.255.254

The output result must be:

58363

This is the port of the IP source address 10.0.0.155.58363.

Share

Leave an answer

You must login to add an answer.

Need An Account,

1 Answer

  1. Editorial Team

    Using lookarounds with grep:

    $ ips=10.0.0.155

$ ipd=239.255.255.254

$ grep -Po "(?<=$ips\.)\d+(?= > $ipd)" file
58363
58363

    File has repeated line so pipe to uniq:

    $ grep -Po "(?<=$ips\.)\d+(?= > $ipd)" file | uniq
58363

    Or using a capture group with sed:

    $ sed -n '/'"$ipd"'/s/.*'"$ips"'\.\([0-9]\+\).*/\1/p' file
58363
58363

$ sed -n '/'"$ipd"'/s/.*'"$ips"'\.\([0-9]\+\).*/\1/p' file | uniq
58363

    Or in awk:

    $ awk -v s=$ips -v d=$ipd '$1~s && $3~d {sub(/.*\./,"",$1);print $1}' file
58363
58363

$ awk -v s=$ips -v d=$ipd '$1~s&&$3~d&&!u[$0]++{sub(/.*\./,"",$1);print $1}' file
58363
    • 0