Infoblox’s global team of threat hunters uncovers a DNS operation with the ability to bypass traditional security measures and control the Great Firewall of China. Read about “Muddling Meerkat” and the many other threat actors discovered by Infoblox Threat Intel here.

Network Automation and Compliance (NetMRI)


Stumped over CCS double pattern match

Posts: 70
987     0

I'm stumped at how to get the following CCS pattern capture to work as desired.

regex_test in NetMRI does a double capture of a match.


I need to capture the interface name, the descripion (which may be blank), the interface status and the SFP type at the end.
Sample device outputs:
Gi6/0/47     P_C320             notconnect   1            full   1000 1000BaseSX SFP
Twe1/0/17                       disabled     routed       full    10G SFP-10GBase-SR
Twe1/0/1     asROUTR1 Te2/0/5   notconnect   routed       full    10G SFP-10GBase-SR
Twe1/0/18                       disabled     routed       full    10G SFP-10GBase-SR
Te3/0/6      Testing Netbackup  notconnect   750          full    10G SFP-10GBase-SR
Eth1/32       --                disabled     routed    auto    auto    10Gbase-LR


$Interface /^[\w/\s]{11}/
$Description /[\w\s-]{18}/
$Int_status /(disabled|notconnec(t)?)/
$Transceiver /((SFP-)?\d+(G)?Base[-A-Z]+)/

[[$Interface]] [[$Description]] [[$Int_status]] \s(\d+|routed)\s+(full|auto)\s+\w+ [[$Transceiver]]


The NetMRI regex_test produces:
(Tw1/0/17 ) (...............) (disabled) (disabled)

Regex101 pattern:
(disabled|notconnec(t)?) \s(\d+|routed)\s+(full|auto)\s+\w+ ((SFP-)?\d+(G)?[Bb]ase[-A-Z]+)
Regex101 result:
Match 1 32-84 disabled routed full 10G SFP-10GBase-SR
Group 1 32-40 disabled
Group 3 45-51 routed
Group 4 58-62 full
Group 5 70-84 SFP-10GBase-SR
Group 6 70-74 SFP-


I've tried plenty of tweaks, including adding a variable called $Filler to just capture the exact number of characters to ignore.


Showing results for 
Search instead for 
Did you mean: 

Recommended for You