Regex to match Exact port number (netstat command)

Question

We have this regex:\\*.*?(.600[0-9]).*?.(LISTEN|ESTABLISHED)

OS = Solaris 10

The purpose of this regex is to match the ports in output of "netstat -an" and report if any ports between 6000-6009 are getting used. The only problem is if I have something like this (sample output as mentioned below), the regex matches everything with 6000 in it. It matches 46000, 60006 and 6000. Because of that we are getting faulty alerts. How can we fix this to just ONLY pick up ports (6000-6009)? Please help.

10.10.10.10.2055 10.10.4.10.60006 49552 0 49552 0 ESTABLISHED

10.10.10.10.6360 10.10.4.10.6000 65290 0 49640 0 LISTEN

10.10.10.10.2044 10.10.4.10.46000 49552 0 49552 0 ESTABLISHED

helloV · Accepted Answer · 2014-11-14 17:00:39Z

2

Your '.' before 600 is matching any character not just '.' (why you got 46000) and you need to match for a space after 600x (why you got 60006)

\\*.*?([.]600[0-9]) .*?.(LISTEN|ESTABLISHED)

answered Nov 14, 2014 at 17:00

helloV

52.9k7 gold badges146 silver badges151 bronze badges

Sign up to request clarification or add additional context in comments.

Comments

anubhava · Accepted Answer · 2014-11-14 16:57:39Z

1

You can use awk to match only field 2 for port number pattern and last field for status:

awk '$NF ~ /(LISTEN|ESTABLISHED)/ && $2 ~ /\.600[0-9]/

answered Nov 14, 2014 at 16:57

anubhava

790k67 gold badges603 silver badges671 bronze badges

2 Comments

sk2code Over a year ago

We are using Tripwire and regex is the only way out there.

anubhava Over a year ago

In that case try: \.600[0-9] .*?(LISTEN|ESTABLISHED) regex

Collectives™ on Stack Overflow

Regex to match Exact port number (netstat command)

2 Answers 2

Comments

2 Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

2 Answers 2

Comments

2 Comments

Your Answer

Sign up or log in

Post as a guest

Related