^start of line
Group 1((?P<mode>[^:]+):\s)? ?repeats the group contents below at most once:
Group mode(?P<mode>[^:]+) Negated Character Class[^:]+ +matches at least one character outside the set below:
:the literal : (5810 / 728 / 3A16)
:the literal : (5810 / 728 / 3A16)
\sany whitespace character
in:the literal text in: (case sensitive) Group InputInterface(?P<InputInterface>[^,]+) Negated Character Class[^,]+ +matches at least one character outside the set below:
,the literal , (4410 / 548 / 2C16)
\s+any whitespace character, repeated at least once
out:the literal text out: (case sensitive) Group OutputInterface(?P<OutputInterface>[^,]+) Negated Character Class[^,]+ +matches at least one character outside the set below:
,the literal , (4410 / 548 / 2C16)
,the literal , (4410 / 548 / 2C16)
\sany whitespace character
connection-state:the literal text connection-state: (case sensitive) Group ConnectionState(?P<ConnectionState>[^\s]+) Negated Character Class[^\s]+ +matches at least one character outside the set below:
\sany whitespace character
\s+any whitespace character, repeated at least once
Non-Capturing Group(?:src-mac\s+(?P<SourceMacAddress>[^,]+),\s+)? ?repeats the group contents below at most once:
src-macthe literal text src-mac (case sensitive) \s+any whitespace character, repeated at least once
Group SourceMacAddress(?P<SourceMacAddress>[^,]+) Negated Character Class[^,]+ +matches at least one character outside the set below:
,the literal , (4410 / 548 / 2C16)
,the literal , (4410 / 548 / 2C16)
\s+any whitespace character, repeated at least once
protothe literal text proto (case sensitive) \s+any whitespace character, repeated at least once
Group Protocol(?P<Protocol>\w+) \w+any word character, repeated at least once
Non-Capturing Group(?:\s+\((?P<Flags>[^)]+)\))? ?repeats the group contents below at most once:
\s+any whitespace character, repeated at least once
\(the literal ( (4010 / 508 / 2816)
Group Flags(?P<Flags>[^)]+) Negated Character Class[^)]+ +matches at least one character outside the set below:
)the literal ) (4110 / 518 / 2916)
\)the literal ) (4110 / 518 / 2916)
,the literal , (4410 / 548 / 2C16)
\s+any whitespace character, repeated at least once
\[?optionally matches the literal [ (9110 / 1338 / 5B16)
Group SourceAddress(?P<SourceAddress>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}|[a-f\d:]+) 1st Alternative\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3} \d{1,3}a digit, repeated between 1 and 3 times
\.the literal . (4610 / 568 / 2E16)
\d{1,3}a digit, repeated between 1 and 3 times
\.the literal . (4610 / 568 / 2E16)
\d{1,3}a digit, repeated between 1 and 3 times
\.the literal . (4610 / 568 / 2E16)
\d{1,3}a digit, repeated between 1 and 3 times
+matches at least one character from the set below:
a-fone character from a (9710) to f (10210) (case sensitive)
\da digit
:the literal : (5810 / 728 / 3A16)
\]?optionally matches the literal ] (9310 / 1358 / 5D16)
Non-Capturing Group(?::(?P<SourcePort>\d+))? ?repeats the group contents below at most once:
:the literal : (5810 / 728 / 3A16)
Group SourcePort(?P<SourcePort>\d+) \d+a digit, repeated at least once
\[?optionally matches the literal [ (9110 / 1338 / 5B16)
Group DestinationAddress(?P<DestinationAddress>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}|[a-f\d:]+) 1st Alternative\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3} \d{1,3}a digit, repeated between 1 and 3 times
\.the literal . (4610 / 568 / 2E16)
\d{1,3}a digit, repeated between 1 and 3 times
\.the literal . (4610 / 568 / 2E16)
\d{1,3}a digit, repeated between 1 and 3 times
\.the literal . (4610 / 568 / 2E16)
\d{1,3}a digit, repeated between 1 and 3 times
\]?optionally matches the literal ] (9310 / 1358 / 5D16)
Non-Capturing Group(?::(?P<DestinationPort>\d+))? ,the literal , (4410 / 548 / 2C16)
\sany whitespace character
Group 13(NAT\s?\[?(?P<NatSourceAddress>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}|[a-f\d:]+)\]?(?::(?P<NatSourcePort>\d+))?->\(\[?(?P<NatExternalAddress>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}|[a-f\d:]+)\]?(?::(?P<NatExternalPort>\d+))?->\[?(?P<NatInternalAddress>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}|[a-f\d:]+)\]?(?::(?P<NatInternalPort>\d+))?\),\s)? lenthe literal text len (case sensitive) \s+any whitespace character, repeated at least once
Group Length(?P<Length>\d+) g modifier: global. Finds all matches instead of stopping after the first
m modifier: multiline. Causes ^ and $ to match the start and end of each line, not only the start and end of the string