Regular Expression for MAC Address

Hi I have log files that look like this

Mar 14 14:54:13 10.70.204.11 Draper-1-01-office-01 (Info): Station [re
+snet204-011.wireless]00022d33a500 Authenticated
Mar 14 14:54:13 10.70.204.11 Draper-1-01-office-01 (Info): Station [re
+snet204-011.wireless]00022d33a500 Reassociated
Mar 14 14:58:14 10.70.204.11 Draper-1-01-office-01 (Info): Deauthentic
+ating [resnet204-034.wireless]00022d250968, reason "Must Authenticate
+ Before Ass
ociating"
Mar 14 14:58:14 10.70.204.11 Draper-1-01-office-01 (Info): Station [re
+snet204-034.wireless]00022d250968 Authenticated
Mar 14 14:58:14 10.70.204.11 Draper-1-01-office-01 (Info): Station [re
+snet204-034.wireless]00022d250968 Reassociated
Mar 14 14:59:47 10.70.204.11 Draper-1-01-office-01 (Info): Started dri
+ver for port "awc0"
Mar 14 14:59:47 10.70.204.11 Draper-1-01-office-01 (Info): Started dri
+ver for port "fec0"
Mar 14 15:00:04 10.70.204.11 Draper-1-01-office-01 (Info): Bound "AWC 
+Packet Router" protocol to device "rptr2"
Mar 14 15:00:04 10.70.204.11 Draper-1-01-office-01 (Info): Bound "AWC 
+DDP Protocol" protocol to device "rptr2"
[download]

As you see the MAC address are not in':' or "-" seperated.

In the above case how do I find the MAC address

Comment on Regular Expression for MAC Address Download Code

Replies are listed 'Best First'.
Re: Regular Expression for MAC Address by BrowserUk (Patriarch) on Feb 28, 2003 at 01:55 UTC
I think this found all the MAC's in your post but it's a little difficult to tell. You might like to read Site How to - post code C:\test>perl -nle" print $1 while m[([0-9a-f]{12})]ig" - Hi I have log files that look like this Mar 14 14:54:13 10.70.204.11 D +raper-1-01-office-01 (Info): Station resnet204- 011.wireless00 022d33a500 Authenticated Mar 14 14:54:13 10.70.204.11 Draper-1-01-offi +ce-01 (Info): Station resnet204- 011.wireless00022d33a500 Reas sociated Mar 14 14:58:14 10.70.204.11 Draper-1-01-office-01 (Info): De +authenticating resnet204-034.wireless00022d250968, reason "Mus t Authenticate Before Ass ociating" Mar 14 14:58:14 10.70.204.11 Drape +r- 1-01-office-01 (Info): Station resnet204-034.wireless00022d 250968 Authenticated Mar 14 14:58:14 10.70.204.11 Draper-1- 01-office- +01 (Info): Station resnet204-034.wireless00022d250968 Reassoci ated Mar 14 14:59:47 10.70.204.11 Draper-1-01- office-01 (Info): Start +ed driver for port "awc0" Mar 14 14:59:47 10.70.204.11 Draper- 1-01-office-01 (Info): Started driver for port "fec0" Mar 14 15:00:04 +10.70.204.11 Draper-1-01-office-01 (Info): Bound "AWC Packet R outer" protocol to device "rptr2" Mar 14 15:00:04 10.70.204.11 Draper- +1-01-office-01 (Info): Bound "AWC DDP Protocol" protocol to de vice "rptr2" As you see the MAC address are not in':' or "-" seperated +. In the above case how do I find the MAC address 00022d33a500 00022d33a500 00022d250968 00022d250968 00022d250968 ^Z [download] Examine what is said, not who speaks. 1) When a distinguished but elderly scientist states that something is possible, he is almost certainly right. When he states that something is impossible, he is very probably wrong. 2) The only way of discovering the limits of the possible is to venture a little way past them into the impossible 3) Any sufficiently advanced technology is indistinguishable from magic. Arthur C. Clarke.	[reply] [d/l]

Replies are listed 'Best First'.

Re: Regular Expression for MAC Address
by BrowserUk (Patriarch) on Feb 28, 2003 at 01:55 UTC

I think this found all the MAC's in your post but it's a little difficult to tell.

You might like to read Site How to - post code

C:\test>perl -nle" print $1 while m[([0-9a-f]{12})]ig" -

Hi I have log files that look like this Mar 14 14:54:13 10.70.204.11 D
+raper-1-01-office-01 (Info): Station resnet204- 011.wireless00
022d33a500 Authenticated Mar 14 14:54:13 10.70.204.11 Draper-1-01-offi
+ce-01 (Info): Station resnet204- 011.wireless00022d33a500 Reas
sociated Mar 14 14:58:14 10.70.204.11 Draper-1-01-office-01 (Info): De
+authenticating resnet204-034.wireless00022d250968, reason "Mus
t Authenticate Before Ass ociating" Mar 14 14:58:14 10.70.204.11 Drape
+r- 1-01-office-01 (Info): Station resnet204-034.wireless00022d
250968 Authenticated Mar 14 14:58:14 10.70.204.11 Draper-1- 01-office-
+01 (Info): Station resnet204-034.wireless00022d250968 Reassoci
ated Mar 14 14:59:47 10.70.204.11 Draper-1-01- office-01 (Info): Start
+ed driver for port "awc0" Mar 14 14:59:47 10.70.204.11 Draper-
1-01-office-01 (Info): Started driver for port "fec0" Mar 14 15:00:04 
+10.70.204.11 Draper-1-01-office-01 (Info): Bound "AWC Packet R
outer" protocol to device "rptr2" Mar 14 15:00:04 10.70.204.11 Draper-
+1-01-office-01 (Info): Bound "AWC DDP Protocol" protocol to de
vice "rptr2" As you see the MAC address are not in':' or "-" seperated
+. In the above case how do I find the MAC address
00022d33a500
00022d33a500
00022d250968
00022d250968
00022d250968
^Z
[download]

Examine what is said, not who speaks.

1) When a distinguished but elderly scientist states that something is possible, he is almost certainly right. When he states that something is impossible, he is very probably wrong.
2) The only way of discovering the limits of the possible is to venture a little way past them into the impossible
3) Any sufficiently advanced technology is indistinguishable from magic.
Arthur C. Clarke.

[reply]
[d/l]