find whatever value is common to all of those (and hopefully nothing else) If interface 2 is 10.0.6.1 then grep for that value. If there are other interfaces on that device that would also match that (such as 10.0.6.10 or 10.0.6.100 ) then you can cat <filename> | grep �10.0.6.1 � >> <temp file> notice the space after the .1 and inside the quotes
I assume the grep is done on unix/linux, otherwise use "type <filename>" to throw its output into grep. That would at least get just those lines into a separate file I think. As far as accounting to see what is what maybe import that as space/tab delimited into excel or something similar? Then you can sort by IP address and get totals that way. I'm fairly clueless if it involves anything above simple :) M ________________________________________ From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of serge Sent: Saturday, May 29, 2004 1:03 PM To: [EMAIL PROTECTED] Subject: [Declude.JunkMail] OT: GREP Help Needed >From the grep expert Below is a sample log file (cisco netflow output) 1- how can we export the lines with interface number 2 (in red) to another smaller file 2- can we easily get bytes totals per ipadress, port #, ... � � � � � 216.226.209.180���� 202.59.119.218���� 10.0.6.1���� ��� ���� 2�4�6�304�2004-05-27 19:12:47.097�2004-05-27 19:12:57.097�5466�6346�3�6�0�0�0�24�0�208.154.200.5 192.36.125.2���� ���� 208.154.200.6������� 208.154.200.6��� 4�2�1�233�2004-05-27 19:12:43.109�2004-05-27 19:12:43.109�53�1090�16�17�0�0�0�0�25�208.154.200.5 208.154.200.6��������193.0.0.193���� ����� 10.0.6.1���� ��� ���� 2�4�1�69�2004-05-27 19:12:43.113�2004-05-27 19:12:43.113�1090�53�16�17�0�0�0�25�0�208.154.200.5 65.57.234.3���� ������ 216.226.209.154����216.226.209.154�1�2�1�40�2004-05-27 19:12:43.209�2004-05-27 19:12:43.209�6667�55790�16�6�0�0�0�0�24�208.154.200.5 216.226.209.144���� 213.30.182.60������ 10.0.6.1���� �������� 2�4�2�112�2004-05-27 19:12:42.545�2004-05-27 19:12:43.041�0�771�16�1�0�0�0�24�0�208.154.200.5 66.118.142.125������ 216.226.209.133��� 216.226.209.133�1�2�2�106�2004-05-27 19:12:41.285�2004-05-27 19:12:42.897�65475�1034�24�6�0�0�0�0�24�208.154.200.5 216.226.209.183���� 216.155.193.182��� 10.0.6.1�������������2�4�2�156�2004-05-27 19:12:41.493�2004-05-27 19:12:43.069�10784�119�24�6�0�0�0�24�0�208.154.200.5 216.226.209.183���� 68.96.10.174�������� 10.0.6.1���� ��� ���� 2�4�3�132�2004-05-27 19:12:39.081�2004-05-27 19:12:42.769�10728�60633�24�6�0�0�0�24�0�208.154.200.5 --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
