Using the Pipe in IOS
A lot of IOS commands give you a lot of information. Most of the time, though, it’s way too much information, and it sure would be nice to do some grep-like stuff on the output, right? Well, just like on Linux, you can use the pipe (|) to do such. That’s not a butt cheek, by the way.
The most useful function is the include directive. This is the equivalent of just plain grep on Linux, and will show you only lines that match a string that you give it. Say that you want to find what ports on your switch are down, but don’t want to grind through all the lines of a show ip interface brief. If you just pipe it to the include command followed by the word “down”, you’ll see something like this.
Switch#show ip interface brief | include down
GigabitEthernet0/4 unassigned YES unset down down
GigabitEthernet0/7 unassigned YES unset down down
GigabitEthernet0/17 unassigned YES unset down down
GigabitEthernet0/18 unassigned YES unset down down
GigabitEthernet0/19 unassigned YES unset down down
GigabitEthernet0/20 unassigned YES unset down down
You can also use the exclude directive, which is the same as a grep -v on Linux. I hope you figured out that this gives you all lines that don’t match the word, so, let’s use the exclude directive to found out what ports are down. How about we just ignore the lines that are up.
Switch#show ip interface brief | exclude up
Interface IP-Address OK? Method Status Protocol
GigabitEthernet0/4 unassigned YES unset down down
GigabitEthernet0/7 unassigned YES unset down down
GigabitEthernet0/17 unassigned YES unset down down
GigabitEthernet0/18 unassigned YES unset down down
GigabitEthernet0/19 unassigned YES unset down down
GigabitEthernet0/20 unassigned YES unset down down
Well, this won’t exactly give you all the ports that are down. What if the port is up/down?
What else can you use with the pipe? What if you want to look at the configurations of all the ports or interfaces on a box but don’t want to go through the config hitting the spacebar over and over. If you use the begin command, you’ll see the output beginning from the first match, so, using the string interface will show you the config starting at the first interface.
Switch#show running-config | begin interface
interface GigabitEthernet0/1
description Server
switchport access vlan 4
switchport mode access
spanning-tree portfast…
Another good one is the section command. It’s usually used on the output of show running-config and shows you sections of the config that match your string. Huh? If you want to see the BGP section of the configuration, you can do something like thing just to see that part of the configuration.
Router#show running-config | section bgp
router bgp 1
neighbor 1.1.1.1 remote-as 65000
neighbor 1.1.1.1 version 4
There are a few other commands for use with the pipe, so explore on your own. You might also want to check out regular expressions on the Cisco IOS if you want to match more than just simple text.
https://masto.ai/@aconaway
- Generating Network Diagrams from Netbox with Pynetbox - August 23, 2023
- Out-of-band Management – Useful Beyond Catastrophe - July 13, 2023
- Overlay Management - July 12, 2023
Great article! Keep it up!
You can just add this tidbit to your article and not post the comment, but I just found that you can use an OR statement the other day. Just enclose the search items in parenthesis and separate them with pipes.
bunker-3825-r1#show interface | i (line protocol|error|rate)
GigabitEthernet0/0 is up, line protocol is up
Queueing strategy: fifo
5 minute input rate 4882000 bits/sec, 1425 packets/sec
5 minute output rate 909000 bits/sec, 1188 packets/sec
2 input errors, 0 CRC, 0 frame, 2 overrun, 0 ignored
0 output errors, 0 collisions, 0 interface resets
Absolutely right, Josh. That’s part of the regular expression syntax for IOS. You can do all sorts of stuff, too. You can match only interfaces F0/1, F0/2, F0/7 with this.
…. | include 0/[127]
Or to find all the IP addresses in the config, do this.
sh run | incl address [0-9]+.[0-9]+.[0-9]+.[0-9]+
I’ve gone back and set a link to Cisco page on regular expressions, so check it out.
Thanks for adding the link.
Dang, while I have always used the include and begin, etc. I wasn’t aware I could use it to this extent. Time to start customizing some Cisco scripts on my Unix box now to pull more specific info! Great article!!
Thanks, Clint. Regular expressions are crazy and can do amazing things. They’re used elsewhere in IOS (like BGP AS path stuff), so it’s worth checking out.
I don’t know what I’d do without “include” or “begin” .. Now I’ve just added “section” 🙂 Thanks!
Is there a symbol for AND statement? I would like to search output that has two different strings on the same line and only pull those lines (not everything else). Example if wanted sh log and only show lines with date Jul 8 and Serial0/0
Thanks for reading, James.
There’s not a symbol for AND per se, but you can do it with the wildcards. Give this a shot.
show log | incl Jul 8.*Serial0/0
That should match any string of characters that has “Jul 8” followed by some number of characters followed by “Serial0/0”.
That works! Thank you so much!
in addition to the usual pipe includes, you can include more than 1 thing in your search for certain things too by using multiple pipes, i’ve found it extremely handy in certain cases… eg:
SWITCH1#sh run | inc interface | speed | switchport access vlan
interface Port-channel1
interface Port-channel2
interface GigabitEthernet1/0/1
switchport access vlan 1306
speed auto 10 100
interface GigabitEthernet1/0/2
switchport access vlan 1306
speed auto 10 100
interface GigabitEthernet1/0/3
switchport access vlan 1306
speed auto 10 100
…. and so on
i have noticed that sometimes it appears to be case/whole word sensitive, so you *may* need to type a whole word rather than just part of it on some occasions… not sure why this is but if i figure it out i’ll let you know 🙂
Thanks for the info Aaron. I am still struggling after reading the above info and the Cisco CLI guide how I can get a ‘show mac-address table’ output to exclude the macs listed against 2 uplink interfaces. If I do exc (Fa0/1|Fa0/2) for example it takes out Fa0/10 etc.
Any ideas?
Thanks Aaron! For so long I’ve been trying to find how to find multiple strings in one line (JUNOS so simple). The wildcard did the trick (i dont mind if it has to match the order). Thanks heapppppssss!
“If I do exc (Fa0/1|Fa0/2) for example it takes out Fa0/10 etc.”
It’s because “Fa0/1” matches on the line that contains “Fa0/10” — they both start with the same string. It would also remove Fa0/11, Fa0/12, etc.
Try matching a space after the 1, eg:
sw1#sh ip int b | exc (0/1( )|0/2( ))