Often in our daily work we encounter the need to run stuff in CLI - and too often this proves to be trickier than one would expect. In the spirit of saving time for others, we've decided to compile a list of the ones we've found to be useful and not-so-obvious.
grep -o '".*"' | tr -d '"'
grep -oP "(?<=').*?(?=')"
grep -oP '(?<=\()[^\)]+'
grep -oP '\(\K[^\)]+'
grep -o "<MATCH>.*"
grep -E -o "([0-9]{1,3}[\.]){3}[0-9]{1,3}"
grep -oh "\w*<MATCH>\w*"
grep --only-matching '[[:digit:]]\+'
grep -e '^[^/]*/[^/]*$'
grep -E -o '<MATCH>\w+'
grep -E "MATCH" | cut -d "," -f2 | awk '{print $1}'
grep -oh "\w*<STRING>\w*"
grep -o -P '(?<=PATTERN1).*(?=PATTERN2)'
awk 'NR>1{print $1}' RS=[ FS=]
awk -F'[()]' '{print $2}'
awk '{gsub("[^[:digit:]]+"," ")}1'
Print the line immediately before a line that matches "/regex/" (but not the line that matches itself):
awk '/regex/ { print x }; { x=$0 }'
Print the line immediately after a line that matches "/regex/" (but not the line that matches itself):
awk '/regex/ { print (x=="" ? "match on line 1" : x) }; { x=$0 }'
awk -v srch="<PATTERN>" 'BEGIN{l=length(srch)}{t=match($0,srch);if(!t){next}$0=substr($0,t+l);print srch" "$2}' <filename> | awk '{print $1}'
awk '{ print substr($0, index($0,$3)) }'
awk '/AAA|BBB|CCC/'
awk '{$<COL_NUMBER> = "<VALUE>"; print}'
cat FILENAME.txt | awk 'BEGIN { print "<table>" }
{ print "<tr><td>" $1 "</td><td>" $2 "</td><tr>" }
END { print "</table>" }'
cat toTable | awk 'BEGIN { print "<tbody>" }
{ print "<tr><td><strong>" $1 "</strong></td>" }
{ print "<td>" $2 "</td></tr>" }
END { print "</tbody>" }'
awk -v FS="(PATTERN1|PATTERN2)" '{print $2}'
s/ <-- this means it should perform a substitution
.* <-- this means match zero or more characters
\[ <-- this means match a literal [ character
\( <-- this starts saving the pattern for later use
[^]]* <-- this means match any character that is not a [ character
the outer [ and ] signify that this is a character class
having the ^ character as the first character in the class means "not"
\) <-- this closes the saving of the pattern match for later use
\] <-- this means match a literal ] character
/\1 <-- this means replace everything matched with the first saved pattern
(the match between "\(" and "\)" )
/g <-- this means the substitution is global (all occurrences on the line)
\< EXACT MATCH \>
sed '/regex/{x;p;x;}'
sed '/regex/G'
sed '/regex/{x;p;x;G;}'
sed '/./=' filename | sed '/./N; s/\n/ /'
sed '/baz/s/foo/bar/g'
sed '/baz/!s/foo/bar/g'
sed '1!G;h;$!d'
sed -n '1!G;h;$p'
sed -e :a -e '/\\$/N; s/\\\n//; ta'
sed -e :a -e '$!N;s/\nMATCH/ /;ta' -e 'P;D'
sed '/\n/!G;s/\(.\)\(.*\n\)/&\2\1/;//D;s/.//'
sed 's/witch/red/g;s/gem/red/g;s/puss/red/g' # most seds
gsed 's/witch\|gem\|puss/red/g' # GNU sed only
sed 's/foo/bar/' # replaces only 1st instance in a line
sed 's/foo/bar/4' # replaces only 4th instance in a line
sed 's/foo/bar/g' # replaces ALL instances in a line
sed 's/\(.*\)foo\(.*foo\)/\1bar\2/' # replace the next-to-last case
sed 's/\(.*\)foo/\1bar/' # replace only the last case
sed 's/^[ \t]*//' # see note on '\t' at end of file
sed 's/[ \t]*$//' # see note on '\t' at end of file
sed -n '/regexp/p' # method 1
sed '/regexp/!d' # method 2
sed -n '/regexp/{g;1!p;};h'
sed -n '/regexp/{n;p;}'
sed '/^\s*$/d' file
sed '/MATCH/a\ADD_THIS' file
sed '/MATCH/i\<INSERT>' file
sed 's/^/<STRING>/'
sed '/AAA/!d; /BBB/!d; /CCC/!d'
sed '/<MATCH>/s/^/<STRING>/'
sed -e '/./{H;$!d;}' -e 'x;/MATCH/!d;'
sed -e '/./{H;$!d;}' -e 'x;/AAA/!d;/BBB/!d;/CCC/!d'
sed -e '/./{H;$!d;}' -e 'x;/AAA/b' -e '/BBB/b' -e '/CCC/b' -e d
sed -n '/regexp/,$p'
sed '/s/$/<string>/'
sed '/<MATCH>/s/$/ myalias/'
sed '/match/ s/$/ anotherthing/' file
sed -e :a -e '/\\$/N; s/\\\n//; ta'
sed 's/^[ \t]*//;s/[ \t]*$//'
sed 's/[ \t]*$//'
sed '/X/{$!N;/\n.*Y/!P;D}'
sed 's/<MATCH>/,/<MATCH>//g'
sed '/<MATCH>/,/<MATCH>/!d;/;/p'
sed G
Double-space a file which already has blank lines in it - do it so that the output contains no more than one blank line between two lines of text
sed '/^$/d;G'
sed '/<MATCH>/s/<STR>/<REPLACE>/g'
echo '345,0m0.047s' | sed -n -r 's/^(.*),.*[^0-9]([0-9]*)\.(.*)s$/\1,\2\3/p'
345,0047
sed 's/[0-9][0-9];[0-9][0-9]H//g' | egrep -o '[^][]+'
sed '/regex/{x;p;x;G;}'
sed '/regex/{x;p;x;}'
sed '/regex/G'
sed -n '/ABC/,+1p' infile
sed 's/<STRING1>.*<STRING2>//'
sed -e 's|[<THIS>\<THIS>]||g'
sed 's|/|:|g'
sed 's/[!@#\$%^&*<>"()]//g'
sed -i "/aaa=/c\aaa=xxx" your_file_here
sed 'G;G'
sed 'n;d'
:%s/unix/Linux/gi
:%s/UNIX/bar/gI
:%s/\<UNIX\>/Linux/gc
:%s/UNIX/Linux/gc
alias ..='cd ..'
alias c='clear'
alias cls='clear;ls'
# Grabs the disk usage in the current directory
alias usage='du -ch | grep total'
alias ksh='du -ksh *'
# Gives you what is using the most space. Both directories and files. Varies on
# current directory
alias most='du -hsx * | sort -rh | head -10'
# ls aliases
alias lf='ls -alF --color=auto'
alias la='ls -al --color=auto'
alias ll='ls -l --color=auto'
alias l='ls -l --color=auto'
alias lh='ls -lh --color=auto'
# create directory
alias md='mkdir -p'
alias t='tail -f '
alias network='service network restart'
alias f='find / -name'
alias fhere='find . -name'
alias iptables='service iptables restart'
lsof | grep "(deleted)$" | sed -re 's/^\S+\s+(\S+)\s+\S+\s+([0-9]+).*/\1\/fd\/\2/' | while read file; do bash -c ": > /proc/$file"; done
echo "<XML>" or cat file | xml_pp
cut -d "<MATCH>" -f1
perl -MURI::Escape -lne 'print uri_escape($_)'
alias hashpass='echo $PASS | awk -F : '"'"'{for (i=1;i<=NF;i++) {print $i}}'"'"
perl -lne '/\(\K[^\)]+/ and print $&'
comm -13 <(sort file1) <(sort file2)
perl -pe 's/(?<!^)(?=<STRING>)/\n/g' <filename>
diff -a --suppress-common-lines -y File1 File2
rpm -qa --qf "%{NAME}\n"
^\w{0,10}$ # allows words of up to 10 characters.
^\w{5,}$ # allows words of more than 4 characters.
^\w{5,10}$ # allows words of between 5 and 10 characters.
tcpdump -D
tcpdump -i eth0
Listen on any available interface (cannot be done in promiscuous mode. Requires Linux kernel 2.2 or greater):
tcpdump -i any
tcpdump -v
tcpdump -vv
tcpdump -vvv
Be verbose and print the data of each packet in both hex and ASCII, excluding the link level header:
tcpdump -v -X
Be verbose and print the data of each packet in both hex and ASCII, also including the link level header:
tcpdump -v -XX
tcpdump -q
tcpdump -c 100
tcpdump -w capture.cap
Record the packet capture to a file called capture.cap but display on-screen how many packets have been captured in real-time:
tcpdump -v -w capture.cap
tcpdump -r capture.cap
tcpdump -vvv -r capture.cap
Display IP addresses and port numbers instead of domain and service names when capturing packets (note: on some systems you need to specify -nn to display port numbers):
tcpdump -n
Capture any packets where the destination host is 192.168.1.1. Display IP addresses and port numbers:
tcpdump -n dst host 192.168.1.1
tcpdump -n src host 192.168.1.1
Capture any packets where the source or destination host is 192.168.1.1. Display IP addresses and port numbers:
tcpdump -n host 192.168.1.1
Capture any packets where the destination network is 192.168.1.0/24. Display IP addresses and port numbers:
tcpdump -n dst net 192.168.1.0/24
Capture any packets where the source network is 192.168.1.0/24. Display IP addresses and port numbers:
tcpdump -n src net 192.168.1.0/24
Capture any packets where the source or destination network is 192.168.1.0/24. Display IP addresses and port numbers:
tcpdump -n net 192.168.1.0/24
tcpdump -n dst port 23
Capture any packets where the destination port is is between 1 and 1023 inclusive. Display IP addresses and port numbers:
tcpdump -n dst portrange 1-1023
Capture only TCP packets where the destination port is is between 1 and 1023 inclusive. Display IP addresses and port numbers:
tcpdump -n tcp dst portrange 1-1023
Capture only UDP packets where the destination port is is between 1 and 1023 inclusive. Display IP addresses and port numbers:
tcpdump -n udp dst portrange 1-1023
Capture any packets with destination IP 192.168.1.1 and destination port 23. Display IP addresses and port numbers:
tcpdump -n "dst host 192.168.1.1 and dst port 23"
Capture any packets with destination IP 192.168.1.1 and destination port 80 or 443. Display IP addresses and port numbers:
tcpdump -n "dst host 192.168.1.1 and (dst port 80 or dst port 443)"
tcpdump -v icmp
tcpdump -v arp
tcpdump -v "icmp or arp"
tcpdump -n "broadcast or multicast"
tcpdump -s 500
tcpdump -s 0
/backbox/backbox-3.0/bin/sendEmail -f [email protected] -t [email protected] -s SMTP_ADDRESS -u MailTest -o message-file=
[Expert@Checkpoint]# cplic print > cplic.txt
[Expert@Checkpoint]# cat cplic | grep -o -P '..?Jan.*?....|..?Feb.*?....|..?Mar.*?....|..?Apr.*?....|..?May.*?....|..?Jun.*?....|..?Jul.*?....|..?Aug.*?....|..?Sep.*?....|..?Oct.*?....|..?Nov.*?....|..?Dec.*?....'
echo -e "print <table_name> <object_name>\n-q\n" | dbedit -local
echo -e "printxml <table_name> <object_name>\n-q\n" | dbedit -local
fw="xxx"; cpmiquerybin object "" network_objects "name='$fw'" |grep anti_spoof
cpmiquerybin attr "" network_objects "type='gateway_cluster'" -a __name__,ipaddr
cpmiquerybin attr "" network_objects "type='cluster_member'" -a __name__
cpmiquerybin object "" network_objects "" |grep -A 12 cluster_members |grep Name | awk -F "(" '{printf $2}' | sed -e 's/)/|/g'
cpmiquerybin attr "" network_objects "name='cluster_name'" -a cluster_members
cpmiquerybin object "" network_objects "name='group_name_goes_here'" | grep ":Name"
cpmiquerybin attr "" policies_collections "" -a __name__
cpmiquerybin attr "" fw_policies "" -a __name__
cpmiquerybin attr "" policies_collections "name='Standar'" -a __name__,installable_targets
cpmiquerybin attr "mdsdb" network_objects "name='Cluster1'" -a __name__,ipaddr
cpmiquerybin attr "" network_objects "(primary_management='false') & (management='true')" -a __name__
cpmiquerybin attr "mdsdb" mdss "" -a __name__
cpmiquerybin attr "mdsdb" network_objects "management='true'" -a __name__,ipaddr
cpmiquerybin attr "" network_objects "management='true'" -a __name__,ipaddr
cpmiquerybin attr "mdsdb" mdss "primary='true'" -a __name__
cpmiquerybin attr "" services "include_in_any='true'" -a __name__
cpmiquerybin attr "" network_objects "ipaddr='<IP>'" -a __name__,ipaddr
GATEWAYS=( `cpmiquerybin attr "" network_objects "(type='gateway') & (location='internal')" -a __name__ | tr '\n' ' '` )
CLUSTERS=( `cpmiquerybin attr "" network_objects "(type='gateway_cluster') & (location='internal')" -a __name__ | tr '\n' ' '` )
CLUSTER MEMBERS=( `cpmiquerybin attr "" network_objects "(type='cluster_member') | (type='gateway') & (location='internal')" -a __name__ | tr '\n'
cpmiquerybin attr "" network_objects "type='gateway'|type='cluster_member'|type='gateway_cluster'" -a __name__,ipaddr,svn_version_name,appliance_type
NAME="Variable"
echo $NAME
echo "$NAME"
echo "${NAME}!"
$# Number of arguments
$* All arguments
$@ All arguments, starting from first
$1 First argument
[[ -z STRING ]] Empty string
[[ -n STRING ]] Not empty string
[[ STRING == STRING ]] Equal
[[ STRING != STRING ]] Not Equal
[[ NUM -eq NUM ]] Equal
[[ NUM -ne NUM ]] Not equal
[[ NUM -lt NUM ]] Less than
[[ NUM -le NUM ]] Less than or equal
[[ NUM -gt NUM ]] Greater than
[[ NUM -ge NUM ]] Greater than or equal
[[ STRING =~ STRING ]] Regexp
(( NUM < NUM )) Numeric conditions
[[ -o noclobber ]] If OPTIONNAME is enabled
[[ ! EXPR ]] Not
[[ X ]] && [[ Y ]] And
[[ X ]] || [[ Y ]] Or
[[ -e FILE ]] Exists
[[ -r FILE ]] Readable
[[ -h FILE ]] Symlink
[[ -d FILE ]] Directory
[[ -w FILE ]] Writable
[[ -s FILE ]] Size is > 0 bytes
[[ -f FILE ]] File
[[ -x FILE ]] Executable
[[ FILE1 -nt FILE2 ]] 1 is more recent than 2
[[ FILE1 -ot FILE2 ]] 2 is more recent than 1
[[ FILE1 -ef FILE2 ]] Same files
!$ Expand last parameter of most recent command
!* Expand all parameters of most recent command
!-n Expand nth most recent command
!n Expand nth command in history
!<command> Expand most recent invocation of command <command>
date -d@$(echo $(($(date +"%s")-86400))) +"%Y-%m-%d"
echo -n "STRING" | perl -MURI::Escape -wlne 'print uri_escape $_'
¯\_(ツ)_/¯