Home
Routing & Switching
Cisco CLI PIPE and Regular Expressions (RegEx)

Cisco CLI PIPE and Regular Expressions (RegEx)

Kerry Cordero
Routing & Switching
8 min read

Some common ones I use:

Find all GigabitEthernet ports that are up/up:

TPA-SWA#sh ip int br | in ^Giga.*up.*up
GigabitEthernet1/0/14  unassigned      YES unset  up                    up     
GigabitEthernet1/0/23  unassigned      YES unset  up                    up     
GigabitEthernet1/0/24  unassigned      YES unset  up                    up     
GigabitEthernet1/0/26  unassigned      YES unset  up                    up     
GigabitEthernet1/0/37  unassigned      YES unset  up                    up     
GigabitEthernet1/0/47  unassigned      YES unset  up                    up     
GigabitEthernet1/0/48  unassigned      YES unset  up                    up     
GigabitEthernet1/1/1   unassigned      YES unset  up                    up     
GigabitEthernet2/0/2   unassigned      YES unset  up                    up     
GigabitEthernet2/0/15  unassigned      YES unset  up                    up     
GigabitEthernet2/0/21  unassigned      YES unset  up                    up     
GigabitEthernet2/0/23  unassigned      YES unset  up                    up     
GigabitEthernet2/0/47  unassigned      YES unset  up                    up     
GigabitEthernet3/0/22  unassigned      YES unset  up                    up

You can also do something like this:

sh int status | inc ^Te.*connected

Look to see if VLANs 11, 12, 13, 14 are in the VLAN database:

TPA-SWA#sh vlan | inc VLAN001[01234]
10   VLAN0010                         active
11   VLAN0011                         active
12   VLAN0012                         active
13   VLAN0013                         active
14   VLAN0014                         active

Find configured static routes for 10.48.x.x, 10.102.x.x, 172.18.x.x, and 172.19.x.x:

TPA-SWA#sh run | in ^ip.route.10.(48|102)|^ip.route.172.(18|19)
ip route 10.48.230.0 255.255.255.0 172.22.200.1
ip route 10.102.150.28 255.255.255.255 172.22.200.13
ip route 10.102.160.11 255.255.255.255 172.22.200.1
ip route 10.102.160.12 255.255.255.255 172.22.200.1
ip route 172.18.200.0 255.255.255.0 172.18.200.1
ip route 172.19.200.0 255.255.255.0 172.18.200.1

Find out where something is patched in or uplinked using their description:

TPA-SWA#sh interfaces description | inc Nexus
Te1/1/1                        up             up       Nexus 5548 Core Uplink to SW A Te1/0/1
Te2/1/1                        up             up       Nexus 5548 Core Uplink to SW A Te1/0/2
Po1                            up             up       Nexus 5548 Core Uplink

Find all IP Enable interfaces:

TPA-SWA#show ip interf brief | e unassigned
Interface              IP-Address      OK? Method Status                Protocol
Vlan2                  10.65.2.1       YES manual up                    up
Vlan3                  10.65.3.1       YES manual up                    up
Vlan240                172.24.0.1      YES manual up                    up
Vlan241                172.24.1.1      YES manual up                    up
Vlan242                172.24.2.1      YES manual up                    up
Vlan243                172.24.3.1      YES manual up                    up

Find interfaces that have errors:

TPA-SWA#sh int | inc (Ethernet)|(error)|(packet)
GigabitEthernet1/0/1 is up, line protocol is up (connected)
Hardware is Gigabit Ethernet, address is 1c6a.7ad3.2181 (bia 1c6a.7ad3.2181)
5 minute input rate 0 bits/sec, 0 packets/sec
5 minute output rate 21000 bits/sec, 34 packets/sec
0 packets input, 0 bytes, 0 no buffer
0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored
0 input packets with dribble condition detected
28125542 packets output, 2600335977 bytes, 0 underruns
0 output errors, 0 collisions, 1 interface resets

Search for either 3750 OR Version per line. So the line could have either 3750 OR Version.

TPA-SWA#show version | include 3750|Version
Cisco IOS Software, C3750E Software (C3750E-UNIVERSALK9-M), Version 12.2(55)SE5, RELEASE SOFTWARE (fc1)
ROM: Bootstrap program is C3750E boot loader
BOOTLDR: C3750E Boot Loader (C3750X-HBOOT-M) Version 12.2(58r)SE1, RELEASE SOFTWARE (fc1)
BOS-C3750-SERVER-B uptime is 1 week, 4 days, 19 hours, 58 minutes
System image file is "flash:/c3750e-universalk9-mz.122-55.SE5/c3750e-universalk9-mz.122-55.SE5.bin"
cisco WS-C3750X-48 (PowerPC405) processor (revision A0) with 262144K bytes of memory.
Model number                    : WS-C3750X-48T-S
Version ID                      : V06
Switch Ports Model              SW Version            SW Image
     1 54    WS-C3750X-48       12.2(55)SE5           C3750E-UNIVERSALK9-M
*    2 54    WS-C3750X-48       12.2(55)SE5           C3750E-UNIVERSALK9-M
Model number                    : WS-C3750X-48T-S
Version ID                      : V06

Search for 3750 AND Version per line. So the line must have both 3750 AND Version.

TPA-SWA#show version | include 3750.*Version
Cisco IOS Software, C3750E Software (C3750E-UNIVERSALK9-M), Version 12.2(55)SE5, RELEASE SOFTWARE (fc1)
BOOTLDR: C3750E Boot Loader (C3750X-HBOOT-M) Version 12.2(58r)SE1, RELEASE SOFTWARE (fc1)

As you can see Regular Expressions are powerful and you can do so many things with them.

25 Single Pipe Examples:

1. `show interfaces | include up`
2. `show ip interface brief | exclude unassigned`
3. `show ip route | include ^O`
4. `show processes cpu | exclude idle`
5. `show running-config | begin router bgp`
6. `show ip ospf database | include 10.1.1.1`
7. `show log | include error`
8. `show cdp neighbors | include Device ID`
9. `show spanning-tree | exclude down`
10. `show interface status | include connected`
11. `show run | section router ospf`
12. `show version | include IOS`
13. `show memory | include Processor`
14. `show ip bgp | include ^*`
15. `show flash: | include .bin`
16. `show vtp status | include Domain Name`
17. `show access-lists | include permit`
18. `show vlan | exclude active`
19. `show clock | include *`
20. `show crypto isakmp sa | include mm_no_state`
21. `show running-config | include ntp`
22. `show etherchannel summary | include SU`
23. `show ip eigrp neighbors | include up`
24. `show controllers serial 0/0/0 | include clock`
25. `show running-config | include username`

25 Multiple Pipes Examples:

1. `show ip interface brief | exclude unassigned | include up`
2. `show interfaces | include GigabitEthernet|packets input`
3. `show run | begin router bgp | exclude network`
4. `show ip route | include ^O.*via | exclude 10.0.0.0`
5. `show cdp neighbors | include Device ID|Interface`
6. `show interfaces | include line protocol | exclude down`
7. `show running-config | include interface | exclude shutdown`
8. `show processes cpu | exclude 0.00%__0.00%__0.00% | include IOSd`
9. `show log | include error|warning`
10. `show spanning-tree vlan 10 | include blocking|forwarding`
11. `show ip bgp | include ^* | exclude ^*>`
12. `show running-config | include ntp | exclude peer`
13. `show flash: | include .bin | exclude crashinfo`
14. `show controllers | include up | exclude administratively down`
15. `show ip eigrp neighbors | include 10.0.0.1|Serial0/0`
16. `show run | begin router ospf | include network|area`
17. `show vtp status | include Domain Name|VTP Operating Mode`
18. `show interfaces | include Ethernet|CRC`
19. `show ip ospf | include Area BACKBONE|SPF algorithm executed`
20. `show ip arp | include 10.1.1.1|Incomplete`
21. `show version | include IOS|uptime`
22. `show cdp neighbors detail | include Device ID|IP address`
23. `show interfaces status | include connected|disabled`
24. `show vlan brief | include active|suspended`
25. `show access-lists | include permit|deny`

Please note that the output of these commands can vary depending on the specific configuration and state of your device. Also, be sure to understand the command before running it on a production device.

See the table below from Cisco’s website:

Regular Expression Character

Function

Examples

.

Matches any single character.

0.0 matches 0x0 and 020

t..t matches strings such as test, text, and tart

\

Matches the character following the backslash. Also matches (escapes) special characters.

172\.1\.. matches 172.1.10.10 but not 172.12.0.0

\. allows a period to be matched as a period

[ ]

Matches the characters or a range of characters separated by a hyphen, within left and right square brackets.

[02468a-z] matches 0, 4, and w, but not 1, 9, or K

^

Matches the character or null string at the beginning of an input string.

^123 matches 1234, but not 01234

?

Matches zero or one occurrence of the pattern. (Precede the question mark with Ctrl-V sequence to prevent it from being interpreted as a help command.)

ba?b matches bb and bab

$

Matches the character or null string at the end of an input string.

123$ matches 0123, but not 1234

*

Matches zero or more sequences of the character preceding the asterisk. Also acts as a wildcard for matching any number of characters.

5* matches any occurrence of the number 5 including none

18\..* matches the characters 18. and any characters that follow 18.

+

Matches one or more sequences of the character preceding the plus sign.

8+ requires there to be at least one number 8 in the string to be matched

() []

Nest characters for matching. Separate endpoints of a range with a dash (-).

(17)* matches any number of the two-character string 17

([A-Za-z][0-9])+ matches one or more instances of letter-digit pairs: b8 and W4, as examples

|

Concatenates constructs. Matches one of the characters or character patterns on either side of the vertical bar.

A(B|C)D matches ABD and ACD, but not AD, ABCD, ABBD, or ACCD

_

Replaces a long regular expression list by matching a comma (,), left brace ({), right brace (}), the beginning of the input string, the end of the input string, or a space.

The characters _1300_ can match any of the following strings:

^1300$

^1300space

space1300

{1300,

,1300,

{1300}

,1300,
© 2025 cordero.me • All Rights Reserved