Question

Possible Duplicate:
i need get a substring from a file shell script

I need a little help. I just have a file with contains a capture from command.

tcpdump -Xvv -n proto \tcp -c 10 > capture.txt 2>/dev/null

The result of the output capture.txt is some like this:

15:29:18.164566 IP (tos 0x0, ttl 1, id 2394, offset 0, flags [none], proto TCP (6), length 125)
    10.0.0.243.61908 > 10.0.0.184.80: Flags [S], cksum 0x3d53 (correct), seq 1831050442, win 8192, options [mss 1460,nop,wscale 8,nop,nop,sackOK], length 0
    0x0000:  4600 0024 0000 0000 0102 3ad3 0a00 0000  F..$......:.....
    0x0010:  e000 0001 9404 0000 1101 ebfe 0000 0000  ................
   ..............
15:29:18.164567 IP (tos 0x0, ttl 128, id 2394, offset 0, flags [none], proto TCP (6), length 125)
    10.0.0.184.80 > 10.0.0.243.61908: Flags [S.], cksum 0x135e (correct), seq 2906424792, ack 1831050443, win 5840, options [mss 1460,nop,nop,sackOK,nop,wscale 7], length 0
    0x0000:  4600 0024 0000 0000 0102 3ad3 0a00 0000  F..$......:.....
    0x0010:  e000 0001 9404 0000 1101 ebfe 0000 0000  ................
    0x0020:  0000 0000 0000 0000 2323 2332 2323
    0x0030:  0300 0000 0000 0000 0000 0000 0000       ..............
15:29:18.164569 IP (tos 0x0, ttl 1, id 2394, offset 0, flags [none], proto TCP (6), length 125)
    10.0.0.243.61908 > 10.0.0.184.80: Flags [S], cksum 0x3d53 (correct), seq 1831050442, win 8192, options [mss 1460,nop,wscale 8,nop,nop,sackOK], length 0
    0x0000:  4600 0024 0000 0000 0102 3ad3 0a00 0000  F..$......:.....
    0x0010:  e000 0001 9404 0000 1101 ebfe 0000 0000  ................
    0x0020:  0300 0000 0000 0000 0000 0000 0000       ..............

I’m trying to use a grep command : grep -A but I can’t make it work.

I need get the destination port locate after the ip destination address.

The output must be:

80

61908

80

Any suggestions?

Answer 1

This seems to work here.

tcpdump -Xvv -i wlan1 -n -nn proto \TCP -c 10 > capture.txt

sed -n 's/.*\.\(.*\): Flags.*/\1/p' capture.txt
443
35673
443
35071
80