Question

我的文件包含扫描结果。每个结果可以有4-20行

我想仅过滤成功（通过扫描）的MAC地址

我的档案：

FAIL user1 OS-Anti-Virus-Check     Mac OS X 10.10.5

        PASSED Operating-System :: OS X 10.10 Yosemite
        PASSED Operating-System :: OS X 10.10 Yosemite Update
        FAILED Anti-Virus :: Sophos
        E0:AC:CB:82:C3:F2 - en0
FAIL user2 OS-Anti-Virus-Check     Windows Vista (TM) Home Premium 6.0 Service Pack 2

        PASSED Operating-System :: Windows Vista
        PASSED Operating-System :: Vista Service Pack
        PASSED Operating-System :: Windows Vista Edition
        PASSED Operating-System :: Vista Critical and Security Updates
        PASSED Operating-System :: Windows Vista AutoUpdates Label
        FAILED Anti-Spyware :: Microsoft Windows Defender
        FAILED Anti-Virus :: Microsoft Windows Defender
        00:23:4D:E2:8E:03 - Atheros AR928x Wireless Network Adapter
        00:1D:BA:AF:D4:35 - Marvell Yukon 88E8055 PCI-E Gigabit Ethernet Controller
PASS user3 OS-Anti-Virus-Check     Windows 8 China 6.2

        PASSED Anti-Spyware :: Avast! Premier
        PASSED Anti-Virus :: Avast! Premier
        PASSED Anti-Virus :: Avast! Premier Definitions
        PASSED Operating-System :: Windows 8 x64
        PASSED Operating-System :: Windows 8 x64 Service Pack
        PASSED Operating-System :: Windows 8 x64 Edition
        PASSED Operating-System :: Windows 8 x64 Critical and Security Updates
        PASSED Operating-System :: Windows 8 x64 AutoUpdates Label
        28:D2:44:D2:7A:2E - Intel(R) Ethernet Connection I218-V
        7C:7A:91:73:88:09 - Intel(R) Wireless-N 7260
        7C:7A:91:73:88:0A - Microsoft Wi-Fi Direct ï¿½ï¿½ï¿½ï¿½ï¿½ï¿½ï¿½ï¿½ï¿½ï¿½
        7C:7A:91:73:88:0D - Bluetooth ï¿½?(ï¿½ï¿½ï¿½ï¿½ï¿½ï¿½ï¿½ï¿½ï¿½ï¿½
PASS user4 OS-Anti-Virus-Check     Mac OS X 10.10.5

        PASSED Anti-Virus :: Sophos
        PASSED Anti-Virus :: Sophos Definitions
        PASSED Operating-System :: OS X 10.10 Yosemite
        PASSED Operating-System :: OS X 10.10 Yosemite Update
        E0:AC:CB:82:C3:F2 - en0

我想提取通过扫描的mac收件人列表。

所以在示例中

如果行包含＆＃34; PASSED＆＃34;下一行或2行包含mac地址...打印mac地址。

如果有人能指出我正确的方向，我将不胜感激......

Answer 1

你可以使用grep两次：

第一次识别“PASSED”行，然后是MAC地址
第二次从结果中提取MAC地址

例：

grep -Pzo 'PASSED.*?\s+([0-9A-F]{2}(\:[0-9A-F]{2}){5})' d.txt | grep -Po '[0-9A-F]{2}(\:[0-9A-F]{2}){5}'

您可以使用以下命令检查下两行（我仍然无法找到使其适用于这两种情况的方法）：

grep -Pzo 'PASSED.*?(\s+([0-9A-F]{2}(\:[0-9A-F]{2}){5}).*?){2}' 3.txt | grep -Po '[0-9A-F]{2}(\:[0-9A-F]{2}){5}'

Answer 2

这对Awk来说是微不足道的。

awk '$1 ~ /^[0-9a-f][0-9a-f]:/ && p { print; next; }
    /PASSED/ { p=1; next }
    { p=0 }'

如果第一个字段看起来像MAC地址并且p非零（表示我们在前一行看到PASSED），则会打印第一行。接下来的两行检查PASSED的输入;当它被看到时，我们将p设置为1，否则设置为零。然后脚本从顶部继续下一个输入行。

grep mac address - 连续2行

2 个答案: