Skip site navigation (1)Skip section navigation (2)
Date:      Thu, 23 Jan 2014 09:43:59 -0600
From:      Paul Schmehl <>
To:        Freebsd Questions <>
Subject:   awk programming question
Message-ID:  <F01EB9CE742DEB17DB6B51C7@localhost>

Next in thread | Raw E-Mail | Index | Archive | Help
I'm kind of stubborn.  There's lots of different ways to skin a cat, but I 
like to force myself to use the built-in utilities to do things so I can 
learn more about them and better understand how they work.

So, I'm trying to parse a file of snort rules, extract two string values 
and insert a double pipe between them to create a file

Here's a typical rule:

alert udp $HOME_NET any -> $EXTERNAL_NET 69 (msg:"E3[rb] ET POLICY Outbound 
TFTP Read Request"; content:"|00 01|"; depth:2; classtype:bad-unknown; 
sid:2008120; rev:1;)

Here's a typical file entry:

9624 || RPC UNIX authentication machinename string overflow attempt UDP

So, from the above rule I would want to create a single line like this:

2008120 || E3[rb] ET POLICY Outbound TFTP Read Request

There are several ways I can extract one or the other value, and I've 
figured out how to extract the sid and add the double pipe, but for the 
life of me I can't figure out how to extract and print out sid || msg.

This prints out the sid and the double pipe:

echo `awk 'match($0,/sid:[0-9]*;/) {print substr($0,RSTART,RLENGTH)" || "}' 
/tmp/mtc.rules | tr -d ";sid"

It seems I could put the results into a variable rather than printing them 
out, and then print var1 || var2, but my google foo hasn't found a useful 

Surely there's a way to do this using awk?  I can use tr for cleanup.  I 
just need to get close to the right result.

How about it awk experts?  What's the cleanest way to get this done?

Paul Schmehl, Senior Infosec Analyst
As if it wasn't already obvious, my opinions
are my own and not those of my employer.
"It is as useless to argue with those who have
renounced the use of reason as to administer
medication to the dead." Thomas Jefferson
"There are some ideas so wrong that only a very
intelligent person could believe in them." George Orwell

Want to link to this message? Use this URL: <>