regex101: PCRE (Legacy) Match Workspace

.+any character (except for line terminators), repeated at least once

Group src_ip(?P<src_ip>\d*\.\d*\.\d*\.\d*)

\d*a digit, repeated any number of times

\.the literal . (46₁₀ / 56₈ / 2E₁₆)

\d*a digit, repeated any number of times

\.the literal . (46₁₀ / 56₈ / 2E₁₆)

\d*a digit, repeated any number of times

\.the literal . (46₁₀ / 56₈ / 2E₁₆)

\d*a digit, repeated any number of times

Non-Capturing Group(?:\.(?P<src_port>\d*))?

?repeats the group contents below at most once:

\.the literal . (46₁₀ / 56₈ / 2E₁₆)

Group src_port(?P<src_port>\d*)

\d*a digit, repeated any number of times

.any character (except for line terminators)

>the literal > (62₁₀ / 76₈ / 3E₁₆)

.any character (except for line terminators)

Group dst_ip(?P<dst_ip>\d*\.\d*\.\d*\.\d*)

\d*a digit, repeated any number of times

\.the literal . (46₁₀ / 56₈ / 2E₁₆)

\d*a digit, repeated any number of times

\.the literal . (46₁₀ / 56₈ / 2E₁₆)

\d*a digit, repeated any number of times

\.the literal . (46₁₀ / 56₈ / 2E₁₆)

\d*a digit, repeated any number of times

Non-Capturing Group(?:\.(?P<dst_port>\d*))?

?repeats the group contents below at most once:

\.the literal . (46₁₀ / 56₈ / 2E₁₆)

Group dst_port(?P<dst_port>\d*)

\d*a digit, repeated any number of times

:the literal : (58₁₀ / 72₈ / 3A₁₆)

\.*the literal . (46₁₀ / 56₈ / 2E₁₆) , repeated any number of times

Global pattern flags

g modifier: global. Finds all matches instead of stopping after the first

25 tokens

Regular Expression

.+(?P<src_ip>\d*\.\d*\.\d*\.\d*)(?:\.(?P<src_port>\d*))?.>.(?P<dst_ip>\d*\.\d*\.\d*\.\d*)(?:\.(?P<dst_port>\d*))?:\.*

New

10:14:48.983541 IP 10.242.136.232.34266 > 10.81.163.129.9200: Flags [S], seq 2294574211, win 29200, options [mss 1460,sackOK,TS val 22536912 ecr 0,nop,wscale 7], length 0
10:14:48.983541 IP 10.242.136.232 > 10.81.163.129.9200: fictional stuff
10:14:48.983541 IP 10.242.136.232 > 10.81.163.129: also fictional stuff

Extraction

10:14:48.983541 IP 10.242.136.232.34266 > 10.81.163.129.9200: Flags [S], seq 2294574211, win 29200, options [mss 1460,sackOK,TS val 22536912 ecr 0,nop,wscale 7], length 0
10:14:48.983541 IP 10.242.136.232 > 10.81.163.129.9200: fictional stuff
10:14:48.983541 IP 10.242.136.232 > 10.81.163.129: also fictional stuff