grep Patterns

grep patterns I’ve actually used. Every entry has a date and context.

2026-03-05: VLAN Interface Alternation

Problem: Match multiple VLAN subinterfaces at once

Context: VyOS troubleshooting, checking eth0.20, eth0.30, eth0.40

The Fix:

# Match any of several VLANs
show interfaces | grep -E 'eth0\.(20|30|40)'

# WRONG: unescaped dot matches any char
show interfaces | grep -E 'eth0.(20|30|40)'

Rule: Escape literal dots. Use (a|b|c) for alternation with -E (ERE).

Worklog: WRKLOG-2026-03-05

2026-03-05: Bridge Member Status

Problem: Find interface bound to specific bridge master

Context: VyOS bridge troubleshooting

The Fix:

bridge link show | grep -E "eno8.*master"

Worklog: WRKLOG-2026-03-05

2026-03-XX: IPv4 Address Extraction

Problem: Extract valid IPv4 addresses from log files

Context: Various log parsing tasks

The Fix:

# Basic (fast, not strict)
grep -oP '\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}' file

# Strict (validates 0-255 per octet)
grep -oP '\b(?:(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.){3}(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\b' file

Rule: Use -oP for PCRE extraction. -o prints only the match. -P enables lookaheads/lookbehinds.

2026-03-XX: MAC Address Formats

Problem: Extract MAC addresses across different vendor formats

Context: ISE log parsing, network troubleshooting

The Fix:

# Colon-separated (aa:bb:cc:dd:ee:ff)
grep -oiP '[0-9a-f]{2}(:[0-9a-f]{2}){5}' file

# Cisco format (aabb.ccdd.eeff)
grep -oiP '[0-9a-f]{4}(\.[0-9a-f]{4}){2}' file

Rule: Use -i for case-insensitive. Different vendors = different delimiters.

Template for New Entries