Anyway, the way to set up a regex to capture the pieces you want involves ignoring or escaping the regex-special characters (the parens in this case) -- something like this would do:

$_ = "tethereal (proto 6 or 17) and src host suntest1 and dst host sun
+test2 -w /tmp/dumpfile";

( /\(proto ([^)]+)\) and src host (\S+) and dst host (\S+) -w (\S+)/ )
    and ( $protocol, $srchost, $dsthost, $dir ) = ($1,$2,$3,$4);

$protocol =~ s/ or /,/g;
[download]

Note the backslashes in front of the open and close parens that are intended to match actual parens in the string.

Hi graff,

Thanks for the reply. But sometimes the filters does't exists. I mean we may run with out specifying the proto / srchost / dsthost /dir.

So, we need some generic solution to extract this command.

Thanks again.
- Swaroop

In that case you can split up the regex into multiple regex's and see if each one matches...

my $s = "tethereal (proto 6 or 17) and src host suntest1 and dst host 
+suntest2 -w /tmp/dumpfile";
my %info;
$info{srchost} = $1 if $s =~ /\bsrc host (\S+)/;
$info{dsthost} = $1 if $s =~ /\bdst host (\S+)/;
$info{dir} = $1 if $s =~ /\b-w (\S+)/;
if( $s =~ /\(proto (.*?)\)/ ){   # this one needs extra processing
  my $prot = $1;                          # start with the proto strin
+g: "6 or 17"
  my @prot = $prot =~ /(\d+)/g;           # pull out the integers:    
+   (6, 17)
  $info{protocol = join ',', @prot;       # create the desired string:
+   '6,17'
}
# if necessary, validate %info here to make sure you can continue...
[download]

Show us the code that you have tried so far. Which parts of the line can change and which parts stay the same?

You could consider using a regex (see perlretut) along these lines:

which would match "some text (6's and 7's) more text fred and dst text joe -flag /tmp/filename" and would set the variables as:

$part1 = 6's and 7's
$part2 = fred 
$part3 = joe 
$part4 = /tmp/filename
[download]

You will need to adjust the example for your particular problem, but the essence is there.

an updated regex example with an optional parameter field

use warnings;
use strict;

while (<DATA>)
  {
  my ($part1, $part2, $part3, $part4) = $_ =~
    /"some text (?:\((.*?)\) )?more text (.*?) and dst text (.*?) -fla
+g (.*?)"/;

  $part1 ||= '';
  print "1: $part1\n2: $part2\n3: $part3\n4: $part4\n";
  }
  
__DATA__
"some text (6\'s and 7\'s) more text fred and dst text joe -flag /tmp/
+filename"
"some text more text fred and dst text joe -flag /tmp/filename"
[download]