Regular Expressions 101

Positive Lookbehind(?<=source\s)

sourcethe literal text source (case sensitive)

\sa Unicode whitespace character

Group 1(.*)

.*any Unicode character (except for line terminators), repeated any number of times

:the literal : (58₁₀ / 72₈ / 3A₁₆)

Group 2(.*)

.*any Unicode character (except for line terminators), repeated any number of times

\sa Unicode whitespace character

dthe literal d (100₁₀ / 144₈ / 64₁₆) (case sensitive)

Global pattern flags

g modifier: global. Finds all matches instead of stopping after the first

m modifier: multiline. Causes ^ and $ to match the start and end of each line, not only the start and end of the string

Detailed match information will be displayed here automatically.

Search reference

Regular Expression

(?<=source\s)(.*):(.*)\sd

New

TCP source 12.168.189.167:32806 destination 1.78.5.128:65247, idle 0:00:00, bytes 74, flags UIO
TCP source 192.168.189.167:80 destination 137.78.5.128:65233, idle 0:00:03, bytes 334516, flags UIO