Regular Expressions 101

.+any character (except for line terminators), repeated at least once

the literal (32₁₀ / 40₈ / 20₁₆)

Group src_ip(?P<src_ip>\d+\.\d+\.\d+\.\d+)

\d+a digit, repeated at least once

\.the literal . (46₁₀ / 56₈ / 2E₁₆)

\d+a digit, repeated at least once

\.the literal . (46₁₀ / 56₈ / 2E₁₆)

\d+a digit, repeated at least once

\.the literal . (46₁₀ / 56₈ / 2E₁₆)

\d+a digit, repeated at least once

Non-Capturing Group(?:\.(?P<src_port>\d+))?

?repeats the group contents below at most once:

\.the literal . (46₁₀ / 56₈ / 2E₁₆)

Group src_port(?P<src_port>\d+)

\d+a digit, repeated at least once

\s*any whitespace character, repeated any number of times

>the literal > (62₁₀ / 76₈ / 3E₁₆)

\s*any whitespace character, repeated any number of times

Group dst_ip(?P<dst_ip>\d+\.\d+\.\d+\.\d+)

\d+a digit, repeated at least once

\.the literal . (46₁₀ / 56₈ / 2E₁₆)

\d+a digit, repeated at least once

\.the literal . (46₁₀ / 56₈ / 2E₁₆)

\d+a digit, repeated at least once

\.the literal . (46₁₀ / 56₈ / 2E₁₆)

\d+a digit, repeated at least once

Non-Capturing Group(?:\.(?P<dst_port>\d+))?

?repeats the group contents below at most once:

\.the literal . (46₁₀ / 56₈ / 2E₁₆)

Group dst_port(?P<dst_port>\d+)

\d+a digit, repeated at least once

:the literal : (58₁₀ / 72₈ / 3A₁₆)

Global pattern flags

g modifier: global. Finds all matches instead of stopping after the first

Detailed match information will be displayed here automatically.

Search reference

Regular Expression

.+ (?P<src_ip>\d+\.\d+\.\d+\.\d+)(?:\.(?P<src_port>\d+))?\s*>\s*(?P<dst_ip>\d+\.\d+\.\d+\.\d+)(?:\.(?P<dst_port>\d+))?:

New

10:14:48.983541 IP 10.242.136.232.34266 > 10.81.163.129.9200: Flags [S], seq 2294574211, win 29200, options [mss 1460,sackOK,TS val 22536912 ecr 0,nop,wscale 7], length 0
10:14:48.983541 IP 10.242.136.232 > 10.81.163.129.9200: fictional stuff
10:14:48.983541 IP 10.242.136.232 > 10.81.163.129: also fictional stuff

Regular Expression

Extraction