Help parsing file

[Sean OB_1]

I have a file with info like this in it:

Interesting ports on mke1qdhe06.corp.fortishealth.com (165.245.247.239)
(The 1650 ports scanned but not shown below are in state: closed)
PORT STATE SERVICE
135/tcp open msrpc
139/tcp open netbios-ssn
445/tcp open microsoft-ds
1027/tcp open IIS
1494/tcp open citrix-ica
3372/tcp open msdtc
3389/tcp open ms-term-serv
8080/tcp open http-proxy
8081/tcp open blackice-icecap
Device type: general purpose
Running: Microsoft Windows 95/98/ME|NT/2K/XP OS
details: Microsoft Windows Millennium Edition (Me), Windows 2000 Pro


Each machine has a block like this. I need to parse out the IP address of the server, but only if it is a Windows server.

Any ideas?
TIA and points for all responses.

Sean

[Pete Randall]

Sean,

Here's an idea from "Handy One-Liners for Sed" (attached).

# print 1 line of context before and after regexp, with line number
# indicating where the regexp occurred (similar to "grep -A1 -B1")
sed -n -e '/regexp/{=;x;1!p;g;$!N;p;D;}' -e h

I believe you could alter that to print the IP address line.


Pete

[RAC_1]

cat file | grep "Interesting ports on" | awk -F " " '{print $NF, " "}' >> /tmp/host.txt
cat file|grep "Running" |awk -F ":" '{print $2}' >> /tmp/os.txt

paste /tmp/os.txt /tmp/host.txt > /tmp/final.txt
awk -F " " '{if ($1==Microsoft) print}' /tmp/final.txt

Anil

[Sean OB_1]

Pete,

How would that work since the IP line could vary in the number of lines away from the server line?

[Pete Randall]

Sean,

Sorry, I assumed that it would be consistent - if it's not, that idea won't work.


Pete

[Rodney Hills]

How about with perl-

perl -n -e '/^Interesting ports on (\S+)\s+(\d+\.\d+\.\d+)/ && do { $mach=$1; $ip=$2; }; /^Running.*Windows/i && do { print "$ip $mach\n";' yourinputfile.txt

HTH

-- Rod Hills

[curt larson_1]

cat yourfile |
awk '
/^Interesting/ {mach=$4;ip=$5;next;}
/^Running/ { if ( $0 ~ "[W,w]indows" )
print $4 " " $5;}'

[curt larson_1]

oops

i hope you caught that
/^Running/ { if ( $0 ~ "[W,w]indows" )
print $4 " " $5;}'

should have been
/^Running/ { if ( $0 ~ "[W,w]indows" )
print mach " " ip;}'

[D Block 2]

Sean,

is there anyway you can create the output file different format without the Block of fields ? How about merging into a long record with a field separator ?

how about columns separated with | instead of '\n'. I'm thinking a simple:

IFS=|
egrep -i 'running:Micro' FILE-NAME | cut -f1

record sample follows:
mke1qdhe06.corp.fortishealth.com (165.245.247.239)|(The 1650 ports scanned but not shown below are in state: closed)|PORT STATE SERVICE|135/tcp open msrpc|139/tcp open netbios-ssn|445/tcp open microsoft-ds|1027/tcp open IIS|1494/tcp open citrix-ica|3372/tcp open msdtc

[Muthukumar_5]

We can do it with awk program as,

Get the IP-Address first and check weather Running: Microsoft keyword is there or not. IF so print ip ( wiht () ) else none


awk '{ if ( $1 == "Interesting" && $2 == "ports" ) ip=$5
if ( $1 == "Running:" && $2 == "Microsoft" ) test=1 }
END { if ( test == 1) print ip }' tst.log | tr -d '()'

Your output will be ..,
165.245.247.239

Regards
Muthu