Using the Pipe in IOS

A lot of IOS commands give you a lot of information. Most of the time, though, it’s way too much information, and it sure would be nice to do some grep-like stuff on the output, right? Well, just like on Linux, you can use the pipe (|) to do such. That’s not a butt cheek, by the way.

The most useful function is the include directive. This is the equivalent of just plain grep on Linux, and will show you only lines that match a string that you give it. Say that you want to find what ports on your switch are down, but don’t want to grind through all the lines of a show ip interface brief. If you just pipe it to the include command followed by the word “down”, you’ll see something like this.

Switch#show ip interface brief | include down
GigabitEthernet0/4 unassigned YES unset down down
GigabitEthernet0/7 unassigned YES unset down down
GigabitEthernet0/17 unassigned YES unset down down
GigabitEthernet0/18 unassigned YES unset down down
GigabitEthernet0/19 unassigned YES unset down down
GigabitEthernet0/20 unassigned YES unset down down

You can also use the exclude directive, which is the same as a grep -v on Linux. I hope you figured out that this gives you all lines that don’t match the word, so, let’s use the exclude directive to found out what ports are down. How about we just ignore the lines that are up.

Switch#show ip interface brief | exclude up
Interface IP-Address OK? Method Status Protocol
GigabitEthernet0/4 unassigned YES unset down down
GigabitEthernet0/7 unassigned YES unset down down
GigabitEthernet0/17 unassigned YES unset down down
GigabitEthernet0/18 unassigned YES unset down down
GigabitEthernet0/19 unassigned YES unset down down
GigabitEthernet0/20 unassigned YES unset down down

Well, this won’t exactly give you all the ports that are down. What if the port is up/down?

What else can you use with the pipe? What if you want to look at the configurations of all the ports or interfaces on a box but don’t want to go through the config hitting the spacebar over and over. If you use the begin command, you’ll see the output beginning from the first match, so, using the string interface will show you the config starting at the first interface.

Switch#show running-config | begin interface
interface GigabitEthernet0/1
description Server
switchport access vlan 4
switchport mode access
spanning-tree portfast

Another good one is the section command. It’s usually used on the output of show running-config and shows you sections of the config that match your string. Huh? If you want to see the BGP section of the configuration, you can do something like thing just to see that part of the configuration.

Router#show running-config | section bgp
router bgp 1
neighbor 1.1.1.1 remote-as 65000
neighbor 1.1.1.1 version 4

There are a few other commands for use with the pipe, so explore on your own. You might also want to check out regular expressions on the Cisco IOS if you want to match more than just simple text.

Aaron Conaway

I like to lean my head to the left, hit it with the palm of my right hand, and document what knowledge falls out.

More Posts - Website

13 comments for “Using the Pipe in IOS

  1. April 14, 2008 at 09:03

    Great article! Keep it up!

    You can just add this tidbit to your article and not post the comment, but I just found that you can use an OR statement the other day. Just enclose the search items in parenthesis and separate them with pipes.

    bunker-3825-r1#show interface | i (line protocol|error|rate)
    GigabitEthernet0/0 is up, line protocol is up
    Queueing strategy: fifo
    5 minute input rate 4882000 bits/sec, 1425 packets/sec
    5 minute output rate 909000 bits/sec, 1188 packets/sec
    2 input errors, 0 CRC, 0 frame, 2 overrun, 0 ignored
    0 output errors, 0 collisions, 0 interface resets

  2. April 14, 2008 at 09:18

    Absolutely right, Josh. That’s part of the regular expression syntax for IOS. You can do all sorts of stuff, too. You can match only interfaces F0/1, F0/2, F0/7 with this.

    …. | include 0/[127]

    Or to find all the IP addresses in the config, do this.

    sh run | incl address [0-9]+\.[0-9]+\.[0-9]+\.[0-9]+

    I’ve gone back and set a link to Cisco page on regular expressions, so check it out.

  3. April 14, 2008 at 23:11

    Thanks for adding the link.

  4. Clint Young
    April 15, 2008 at 23:20

    Dang, while I have always used the include and begin, etc. I wasn’t aware I could use it to this extent. Time to start customizing some Cisco scripts on my Unix box now to pull more specific info! Great article!!

  5. April 16, 2008 at 13:00

    Thanks, Clint. Regular expressions are crazy and can do amazing things. They’re used elsewhere in IOS (like BGP AS path stuff), so it’s worth checking out.

  6. LBSources
    April 21, 2008 at 06:03

    I don’t know what I’d do without “include” or “begin” .. Now I’ve just added “section” :-) Thanks!

  7. James Smith
    July 9, 2009 at 17:14

    Is there a symbol for AND statement? I would like to search output that has two different strings on the same line and only pull those lines (not everything else). Example if wanted sh log and only show lines with date Jul 8 and Serial0/0

  8. July 10, 2009 at 09:12

    Thanks for reading, James.

    There’s not a symbol for AND per se, but you can do it with the wildcards. Give this a shot.

    show log | incl Jul 8.*Serial0/0

    That should match any string of characters that has “Jul 8″ followed by some number of characters followed by “Serial0/0″.

  9. James Smith
    July 10, 2009 at 20:54

    That works! Thank you so much!

  10. Jay Dixon
    August 6, 2009 at 19:40

    in addition to the usual pipe includes, you can include more than 1 thing in your search for certain things too by using multiple pipes, i’ve found it extremely handy in certain cases… eg:

    SWITCH1#sh run | inc interface | speed | switchport access vlan
    interface Port-channel1
    interface Port-channel2
    interface GigabitEthernet1/0/1
    switchport access vlan 1306
    speed auto 10 100
    interface GigabitEthernet1/0/2
    switchport access vlan 1306
    speed auto 10 100
    interface GigabitEthernet1/0/3
    switchport access vlan 1306
    speed auto 10 100

    …. and so on

    i have noticed that sometimes it appears to be case/whole word sensitive, so you *may* need to type a whole word rather than just part of it on some occasions… not sure why this is but if i figure it out i’ll let you know :)

  11. Daran
    December 5, 2012 at 10:33

    Thanks for the info Aaron. I am still struggling after reading the above info and the Cisco CLI guide how I can get a ‘show mac-address table’ output to exclude the macs listed against 2 uplink interfaces. If I do exc (Fa0/1|Fa0/2) for example it takes out Fa0/10 etc.

    Any ideas?

  12. Viet
    February 3, 2013 at 18:00

    Thanks Aaron! For so long I’ve been trying to find how to find multiple strings in one line (JUNOS so simple). The wildcard did the trick (i dont mind if it has to match the order). Thanks heapppppssss!

  13. jon
    May 27, 2013 at 00:25

    “If I do exc (Fa0/1|Fa0/2) for example it takes out Fa0/10 etc.”

    It’s because “Fa0/1″ matches on the line that contains “Fa0/10″ — they both start with the same string. It would also remove Fa0/11, Fa0/12, etc.

    Try matching a space after the 1, eg:
    sw1#sh ip int b | exc (0/1( )|0/2( ))

Leave a Reply

Your email address will not be published. Required fields are marked *