Grep

1
Grep

• Searches for text in a file
• Can search for simple words chair
• Can look for regular expressions more complex
  character strings such as chair followed by any
  number of spaces, followed by a digit or
  lowercase letter.

2
Grep usage

• grep something somefile.txt returns all
  lines with the word something from somefile.txt
• grep -v something something.txt returns all
  lines that don't have the word something in them
• grep -i something something.txt returns all
  lines with a mixed upper and lowercase something
  in them.

3
Simple regular expressions

• 0-9 look for any digit
• a-zA-Z look for one upper or lowercase letter
• . look for one character
• . any number of characters
• \. a literal decimal point
• \.161 dot, then 161, then colon
• \.161 dot, then 161, then colon or space

4
Advanced regular expressions

• Look for lines that hold either dog or cat
• grep -e '(dogcat)' animalfarm.txt
• Lines that have cat followed by dog on the same
  line, but possibly with other characters in
  between
• grep 'cat.dog' animalfarm.txt
• cat has to be at the beginning of the line
• grep 'cat' animalfarm.txt
• Look for it at the end of the line
• grep 'cat' animalfarm.txt

5
Ways to use it

• Three identical ways to search in a file
• grep promiscuous messages
• cat messages grep promiscuous
• grep promiscuous ltmessages
• Look for something in multiple files
• (zcat /var/log/messages..gz cat
  /var/log/messages ) grep 'promiscuous' less

6
Lab answers

• SNMP probes 161,162
• Grep \.1612 .udp firewall.log gtsnmp.txt
• Inbound Unix traceroute
• grep \.33450-90-9 .udp firewall.log
  gttraceroute.txt
• FW-1
• 256-259, 260-261, 264-265, 900, 18207
• grep -e (\.256-9 \.260145 \.900
  \.18207 ) firewall.log gtfw1.txt
• Half-life
• grep \.27015 .udp firewall.log
  gthalflife.txt
• AIX/broken PMTU
• Size 1500 icmp echo request DF
• grep icmp echo request (DF).len 1500
  firewall.log gtaix.txt
• Note we only get one of these (fw1?)

7
firewall.log answers

• 197,128 lines
• \.4040 CipherIM 11M!
• \.(80\8080) Web 10.5M
• \.53 DNS 0.16M
• \.22 .( S \ack) ssh 202K
• \.25 30K
• arp 26K
• ripv1 4K
• 148\.64\.147\.168 118K
• \.123 4K
• Result 5K, 150 lines