$re = '/[0-9]{1,3} [0-9]{1,3}\.[0-9]{6} 192\.168\.200\.1 ([0-9]{1,3}\.){3}[0-9]{1,3} HTTP .*?1\.1/m';
$str = '3
2 0.000040 10.65.170.58 192.168.200.1 TCP 54 80 56978 [RST] Seq=1 Win=0 Len=0\\n8 17.900574 192.168.200.1 10.65.170.58 HTTP 374 HEAD //web-console/ServerInfo.jsp HTTP/1.1\\n12 17.923315 192.168.200.1 10.65.170.58 HTTP 425 HEAD //jmx-console/HtmlAdaptor?action=inspectMBean&name=jboss.system:type=ServerInfo HTTP/1.1\\n23 39.938431 fe:ff:ff:ff:ff:ff 22:00:0a:41:aa:3a ARP 42 Who has 10.65.170.58? Tell 10.65.170.1\\n35 46.183360 192.168.200.1 10.65.170.58 HTTP 340 HEAD //invoker/JMXInvokerServlet HTTP/1.1\\n80 64.435331 10.65.170.58 69.89.27.239 TCP 74 51361 80 [SYN] Seq=0 Win=14600 Len=0 MSS=1460 SACK_PERM=1 TSval=1299648 TSecr=0 WS=16\\n79 64.378104 172.16.0.23 10.65.170.58 DNS 108 Standard query response 0xe1e0 A www.joaomatosf.com CNAME joaomatosf.com A 192.168.200.1\\n115 79.377537 192.168.200.1 10.65.170.58 HTTP 286 GET //jbossass/jbossass.jsp?ppp=uname+-a HTTP/1.1
2 0.000040 10.65.170.58 192.168.200.1 TCP 54 80 56978 [RST] Seq=1 Win=0 Len=0\\n8 17.900574 192.168.200.1 10.65.170.58 HTTP 374 HEAD //web-console/ServerInfo.jsp HTTP/1.1\\n12 17.923315 192.168.200.1 10.65.170.58 HTTP 425 HEAD //jmx-console/HtmlAdaptor?action=inspectMBean&name=jboss.system:type=ServerInfo HTTP/1.1\\n23 39.938431 fe:ff:ff:ff:ff:ff 22:00:0a:41:aa:3a ARP 42 Who has 10.65.170.58? Tell 10.65.170.1\\n35 46.183360 192.168.200.1s 10.65.170.58 HTTP 340 HEAD //invoker/JMXInvokerServlet HTTP/1.1\\n80 64.435331 10.65.170.58 69.89.27.239 TCP 74 51361 80 [SYN] Seq=0 Win=14600 Len=0 MSS=1460 SACK_PERM=1 TSval=1299648 TSecr=0 WS=16\\n79 64.378104 172.16.0.23 10.65.170.58 DNS 108 Standard query response 0xe1e0 A www.joaomatosf.com CNAME joaomatosf.com A 192.168.200.1\\n115 79.377537 192.168.200.1 10.65.170.58 HTTP 286 GET //jbossass/jbossass.jsp?ppp=uname+-a HTTP/1.1
2 0.000040 10.65.170.58 192.168.200.1 TCP 54 80 56978 [RST] Seq=1 Win=0 Len=0\\n8 17.900574 192.168.200.1a 10.65.170.58 HTTP 374 HEAD //web-console/ServerInfo.jsp HTTP/1.1\\n12 17.923315 192.168.200.1 10.65.170.58 HTTP 425 HEAD //jmx-console/HtmlAdaptor?action=inspectMBean&name=jboss.system:type=ServerInfo HTTP/1.1\\n23 39.938431 fe:ff:ff:ff:ff:ff 22:00:0a:41:aa:3a ARP 42 Who has 10.65.170.58? Tell 10.65.170.1\\n35 46.183360 192.168.200.1 10.65.170.58 HTTP 340 HEAD //invoker/JMXInvokerServlet HTTP/1.1\\n80 64.435331 10.65.170.58 69.89.27.239 TCP 74 51361 80 [SYN] Seq=0 Win=14600 Len=0 MSS=1460 SACK_PERM=1 TSval=1299648 TSecr=0 WS=16\\n79 64.378104 172.16.0.23 10.65.170.58 DNS 108 Standard query response 0xe1e0 A www.joaomatosf.com CNAME joaomatosf.com A 192.168.200.1\\n115 79.377537 192.168.200.1 1a0.65.170.58 HTTP 286 GET //jbossass/jbossass.jsp?ppp=uname+-a HTTP/1.1
';
preg_match_all($re, $str, $matches, PREG_SET_ORDER, 0);
// Print the entire match result
var_dump($matches);
Please keep in mind that these code samples are automatically generated and are not guaranteed to work. If you find any syntax errors, feel free to submit a bug report. For a full regex reference for PHP, please visit: http://php.net/manual/en/ref.pcre.php