Match this name and mac address if it is not associated with this ip using regex-CodePudding

I am trying to match the name and mac address that is NOT associated with the ip 172.16.1.102 using regex in the test string example below.

In this case the output I would like is (eth1, 00:e0:4c:68:ce:52). As 'inet 172.16.1.102' is associated with eth0 and the address d8:bb:c1:57:42:82.

The name will be standard ubuntu ethernet adapters, so not necessarily eth1 as in this case.

eth0: flags=4163<UP,BROADCAST,RUNNING,MULTICAST> mtu 1500
inet 172.16.1.102 netmask 255.255.255.0 broadcast 172.16.1.255
inet6 fe80::dabb:c1ff:fe57:4282 prefixlen 64 scopeid 0x20<link>
ether d8:bb:c1:57:42:82 txqueuelen 1000 (Ethernet)
RX packets 1103615 bytes 1565295587 (1.5 GB)
RX errors 0 dropped 0 overruns 0 frame 0
TX packets 1030880 bytes 799141588 (799.1 MB)
TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0


eth1: flags=4099<UP,BROADCAST,MULTICAST> mtu 1500
ether 00:e0:4c:68:ce:52 txqueuelen 1000 (Ethernet)
RX packets 0 bytes 0 (0.0 B)
RX errors 0 dropped 0 overruns 0 frame 0
TX packets 0 bytes 0 (0.0 B)
TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0


lo: flags=73<UP,LOOPBACK,RUNNING> mtu 65536
inet 127.0.0.1 netmask 255.0.0.0
inet6 ::1 prefixlen 128 scopeid 0x10<host>
loop txqueuelen 1000 (Local Loopback)
RX packets 1777991522 bytes 108254434164 (108.2 GB)
RX errors 0 dropped 0 overruns 0 frame 0
TX packets 1777991522 bytes 108254434164 (108.2 GB)
TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0


wlan0: flags=4098<BROADCAST,MULTICAST> mtu 1500
ether b8:08:cf:a0:7c:2e txqueuelen 1000 (Ethernet)
RX packets 0 bytes 0 (0.0 B)
RX errors 0 dropped 0 overruns 0 frame 0
TX packets 0 bytes 0 (0.0 B)
TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0

As an example: The python regex I have previously used to match the name and mac address that IS associated with the ip 172.16.1.102:

.*((?<!\w)e\w ): flags.*(inet 172.16.1.102).*?(\w{2}[:]\w{2}[:]\w{2}[:]\w{2}[:]\w{2}[:]\w{2})

So perhaps if there is a way to say not 'inet 172.16.1.102' in the above expression?

Example 2: This regex should also work in this case:

eth0: flags=4163<UP,BROADCAST,RUNNING,MULTICAST> mtu 1500
ether d8:bb:c1:57:42:82 txqueuelen 1000 (Ethernet)
RX packets 1103615 bytes 1565295587 (1.5 GB)
RX errors 0 dropped 0 overruns 0 frame 0
TX packets 1030880 bytes 799141588 (799.1 MB)
TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0


eth1: flags=4099<UP,BROADCAST,MULTICAST> mtu 1500
inet 172.16.1.102 netmask 255.255.255.0 broadcast 172.16.1.255
inet6 fe80::dabb:c1ff:fe57:4282 prefixlen 64 scopeid 0x20<link>
ether 00:e0:4c:68:ce:52 txqueuelen 1000 (Ethernet)
RX packets 0 bytes 0 (0.0 B)
RX errors 0 dropped 0 overruns 0 frame 0
TX packets 0 bytes 0 (0.0 B)
TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0


lo: flags=73<UP,LOOPBACK,RUNNING> mtu 65536
inet 127.0.0.1 netmask 255.0.0.0
inet6 ::1 prefixlen 128 scopeid 0x10<host>
loop txqueuelen 1000 (Local Loopback)
RX packets 1777991522 bytes 108254434164 (108.2 GB)
RX errors 0 dropped 0 overruns 0 frame 0
TX packets 1777991522 bytes 108254434164 (108.2 GB)
TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0


wlan0: flags=4098<BROADCAST,MULTICAST> mtu 1500
ether b8:08:cf:a0:7c:2e txqueuelen 1000 (Ethernet)
RX packets 0 bytes 0 (0.0 B)
RX errors 0 dropped 0 overruns 0 frame 0
TX packets 0 bytes 0 (0.0 B)
TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0

And the output for this should be (eth0, d8:bb:c1:57:42:82)

CodePudding user response：

One way of doing it with regex is by checking that your ip is not found between the name and the address:

^(eth\d )((?!.*172.16.1.102)[^\n] \n)*ether ([\w:] )((?!.*172.16.1.102)[^\n] \n)*$

Explanation:

(eth\d ): eth word with more than one digit
((?!.*172.16.1.102)[^\n] \n)*: anything between the name and the address
- (?!.*172.16.1.102): negative lookahead that won't match if finds the hot ip
- [^\n] : anything different than new line
- \n: new line
ether : ether followed by space
([\w:] ): the address as combination of alphanumeric characters and colons
((?!.*172.16.1.102)[^\n] \n)*: anything after the address
$: end of string

Your infos will be in:

Group 1 >> name
Group 3 >> address

Try it here.