Regular Expressions 101

Save & Share

Flavor

  • PCRE2 (PHP >=7.3)
  • PCRE (PHP <7.3)
  • ECMAScript (JavaScript)
  • Python
  • Golang
  • Java 8

Function

  • Match
  • Substitution
  • List
  • Unit Tests
`
^(?P<RuleNumber>[\d]+)\s+(?P<Chain>[^\s]+):\s+in:(?P<InputInterface>[^,]+)\s+out:(?P<OutputInterface>[^,]+),\s+(?:src-mac\s+(?P<SourceMacAddress>[^,]+),\s+)?proto\s+(?P<Protocol>\w+)(?:\s+\((?P<Flags>[^)]+)\))?,\s+\[?(?P<SourceAddress>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}|[a-f\d:]+)\]?(?::(?P<SourcePort>\d+))?->\[?(?P<DestinationAddress>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}|[a-f\d:]+)\]?(?::(?P<DestinationPort>\d+))?,\s+len\s+(?P<Length>\d+)$
`
gm
^ asserts position at start of a line
Named Capture Group RuleNumber
(?P<RuleNumber>[\d]+)
Match a single character present in the list below
[\d]
+ matches the previous token between one and unlimited times, as many times as possible, giving back as needed (greedy)
\d matches a digit (equivalent to [0-9])
\s
matches any whitespace character (equivalent to [\r\n\t\f\v ])
+ matches the previous token between one and unlimited times, as many times as possible, giving back as needed (greedy)
Named Capture Group Chain
(?P<Chain>[^\s]+)
Match a single character not present in the list below
[^\s]
+ matches the previous token between one and unlimited times, as many times as possible, giving back as needed (greedy)
\s matches any whitespace character (equivalent to [\r\n\t\f\v ])
: matches the character : with index 5810 (3A16 or 728) literally (case sensitive)
\s
matches any whitespace character (equivalent to [\r\n\t\f\v ])
+ matches the previous token between one and unlimited times, as many times as possible, giving back as needed (greedy)
in:
matches the characters in: literally (case sensitive)
Named Capture Group InputInterface
(?P<InputInterface>[^,]+)
Match a single character not present in the list below
[^,]
+ matches the previous token between one and unlimited times, as many times as possible, giving back as needed (greedy)
, matches the character , with index 4410 (2C16 or 548) literally (case sensitive)
\s
matches any whitespace character (equivalent to [\r\n\t\f\v ])
+ matches the previous token between one and unlimited times, as many times as possible, giving back as needed (greedy)
out:
matches the characters out: literally (case sensitive)
Named Capture Group OutputInterface
(?P<OutputInterface>[^,]+)
Match a single character not present in the list below
[^,]
+ matches the previous token between one and unlimited times, as many times as possible, giving back as needed (greedy)
, matches the character , with index 4410 (2C16 or 548) literally (case sensitive)
, matches the character , with index 4410 (2C16 or 548) literally (case sensitive)
\s
matches any whitespace character (equivalent to [\r\n\t\f\v ])
+ matches the previous token between one and unlimited times, as many times as possible, giving back as needed (greedy)
Non-capturing group
(?:src-mac\s+(?P<SourceMacAddress>[^,]+),\s+)?
? matches the previous token between zero and one times, as many times as possible, giving back as needed (greedy)
src-mac
matches the characters src-mac literally (case sensitive)
\s
matches any whitespace character (equivalent to [\r\n\t\f\v ])
Named Capture Group SourceMacAddress
(?P<SourceMacAddress>[^,]+)
, matches the character , with index 4410 (2C16 or 548) literally (case sensitive)
\s
matches any whitespace character (equivalent to [\r\n\t\f\v ])
proto
matches the characters proto literally (case sensitive)
\s
matches any whitespace character (equivalent to [\r\n\t\f\v ])
Named Capture Group Protocol
(?P<Protocol>\w+)
Non-capturing group
(?:\s+\((?P<Flags>[^)]+)\))?
, matches the character , with index 4410 (2C16 or 548) literally (case sensitive)
\s
matches any whitespace character (equivalent to [\r\n\t\f\v ])
\[
matches the character [ with index 9110 (5B16 or 1338) literally (case sensitive)
Named Capture Group SourceAddress
(?P<SourceAddress>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}|[a-f\d:]+)
\]
matches the character ] with index 9310 (5D16 or 1358) literally (case sensitive)
Non-capturing group
(?::(?P<SourcePort>\d+))?
->
matches the characters -> literally (case sensitive)
\[
matches the character [ with index 9110 (5B16 or 1338) literally (case sensitive)
Named Capture Group DestinationAddress
(?P<DestinationAddress>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}|[a-f\d:]+)
\]
matches the character ] with index 9310 (5D16 or 1358) literally (case sensitive)
Non-capturing group
(?::(?P<DestinationPort>\d+))?
, matches the character , with index 4410 (2C16 or 548) literally (case sensitive)
\s
matches any whitespace character (equivalent to [\r\n\t\f\v ])
len
matches the characters len literally (case sensitive)
\s
matches any whitespace character (equivalent to [\r\n\t\f\v ])
Named Capture Group Length
(?P<Length>\d+)
$ asserts position at the end of a line
Global pattern flags
g modifier: global. All matches (don't return after first match)
m modifier: multi line. Causes ^ and $ to match the begin/end of each line (not only begin/end of string)
Your regular expression does not match the subject string.

Regular Expression
No Match

`
`
gm

Test String