[nycbug-talk] Regular expressions

[jonathan at kc8onw.net]

Hello all,

I see to remember there being a way to specify that part of the condition
you used to create the match is not returned when the regex returns.  I'm
trying to return just the number from the "length: 40" portion of this
line.

"IP (tos 0x0, ttl  47, id 52246, offset 0, flags [none], proto: TCP (6),
length: 40)"

I'm currently using  grep -Eo "length: ([[:digit:]]{2,4})" but that
includes "length: " in the output.

If someone can give me the right term or concept to search for I'll do the
legwork I'm just out of ideas on what to search for and didn't see
anything relevant in the man pages.

Thanks,
Jonathan Stewart

P.S. There is probably a better way but the main goal of this is to
monitor bandwidth usage by IP on a pflog device.  I'll probably do most of
the work in Python I'm just prototyping in the shell right now.