Regular Expressions 101

SRC=the literal text SRC= (case sensitive)

Group src_ip(?P<src_ip>[\d\.]*)

Character Class[\d\.]*

*matches any number of characters from the set below:

\da Unicode decimal digit

\.the literal . (46₁₀ / 56₈ / 2E₁₆)

.*?any Unicode character (except for line terminators), repeated any number of times

PROTO=the literal text PROTO= (case sensitive)

Group proto(?P<proto>\w*)

\w*a Unicode word character, repeated any number of times

.*?any Unicode character (except for line terminators), repeated any number of times

Group 3(SPT=(?P<src_port>\d*).*?DPT=(?P<dst_port>\d*)|TYPE=(?P<icmp_type>\d*).*?CODE=(?P<icmp_code>\d*))

1st AlternativeSPT=(?P<src_port>\d*).*?DPT=(?P<dst_port>\d*)

SPT=the literal text SPT= (case sensitive)

Group src_port(?P<src_port>\d*)

\d*a Unicode decimal digit, repeated any number of times

.*?any Unicode character (except for line terminators), repeated any number of times

DPT=the literal text DPT= (case sensitive)

Group dst_port(?P<dst_port>\d*)

\d*a Unicode decimal digit, repeated any number of times

2nd AlternativeTYPE=(?P<icmp_type>\d*).*?CODE=(?P<icmp_code>\d*)

TYPE=the literal text TYPE= (case sensitive)

Group icmp_type(?P<icmp_type>\d*)

\d*a Unicode decimal digit, repeated any number of times

.*?any Unicode character (except for line terminators), repeated any number of times

CODE=the literal text CODE= (case sensitive)

Group icmp_code(?P<icmp_code>\d*)

\d*a Unicode decimal digit, repeated any number of times

Global pattern flags

g modifier: global. Finds all matches instead of stopping after the first

Detailed match information will be displayed here automatically.

Search reference

Regular Expression

SRC=(?P<src_ip>[\d\.]*).*?PROTO=(?P<proto>\w*).*?(SPT=(?P<src_port>\d*).*?DPT=(?P<dst_port>\d*)|TYPE=(?P<icmp_type>\d*).*?CODE=(?P<icmp_code>\d*))

New

<4>Nov 25 12:00:13 ubuntu kernel: [  574.036758] iptableslogIN=enp0s3 OUT= MAC=44:85:00:ec:eb:2b:00:21:55:ef:8c:7f:08:00 SRC=10.24.136.232 DST=10.23.85.76 LEN=44 TOS=0x00 PREC=0x00 TTL=52 ID=5250 PROTO=TCP SPT=56325 DPT=55 WINDOW=1024 RES=0x00 SYN URGP=0