Print out only last 4 digits of mac addresses from 2nd column using awk in linux

Question

I have made a shell script for getting the list of mac address using awk and arp-scan command. I want to strip the mac address to only last 4 digits i.e (i want to print only the letters yy)

ac:1e:04:0e:yy:yy   
ax:8d:5c:27:yy:yy   
ax:ee:fb:55:yy:yy   
dx:37:42:c9:yy:yy   
cx:bf:9c:a4:yy:yy

I have tried many things. removed all the unnecessary lines and rows. but I am unable to shorten the mac address. I have it stored in $2 — Yash Bhagwatkar, Nov 09 '17 at 08:28
Try this method also `awk -F":" '{print $NF":"$(NF-1)}' fileName` — Kalanidhi, Nov 09 '17 at 08:30
Please update your question with what you have tried so far. — sat, Nov 09 '17 at 08:30
@YashBhagwatkar, show us your expected output in code tags so that we could try to help you(though I provided solution but since expected output is not given so that is based on some assumptions only). — RavinderSingh13, Nov 09 '17 at 08:31
@PS.that only yields `yy`. This is how I'd use `grep`: `grep -oP '[^:]*:[^:]*$'`. — simlev, Nov 09 '17 at 10:17

score 2 · Answer 1 · answered Nov 09 '17 at 08:26

2

Try cut -d: -f5-

(Options meaning: delimiter : and fields 5 and up.)

EDIT: Or in awk, as you requested: awk -F: '{ print $5 ":" $6 }'

answered Nov 09 '17 at 08:26

marcolz

2,880
2
23
28

score 0 · Answer 2 · answered Nov 09 '17 at 09:31

0

here are a few

line=cx:bf:9c:a4:yy:yy
echo ${line:(-5)}

line=cx:bf:9c:a4:yy:yy
echo $line | cut -d":" -f5-

answered Nov 09 '17 at 09:31

asio_guy

3,667
2
19
35

simlev · Answer 3 · 2017-11-09T10:47:32.333

I imagine you want to strip the trailing spaces, but it isn't clear whether you want yy:yy or yyyy.

Anyhow, there are multiple ways to it but you already are running AWK and have the MAC in $2.

In the first case it would be:

awk '{match($2,/([^:]{2}:[^:]{2}) *$/,m); print m[0]}'
yy:yy

In the second (no colon :):

awk 'match($2,/([^:]{2}):([^:]{2}) *$/,m); print m[1]m[2]}'
yyyy

In case you don't have match available in your AWK, you'd need to resort to gensub.

awk '{print gensub(/.*([^:]{2}:[^:]{2}) *$/,"\\1","g",$2)}'
yy:yy

or:

awk '{print gensub(/.*([^:]{2}):([^:]{2}) *$/,"\\1\\2","g",$0)}'
yyyy

Edit:

I now realized the trailing spaces were added by anubhava in his edit; they were not present in the original question! You can then simply keep the last n characters:

awk '{print substr($2,13,5)}'
yy:yy

or:

awk '{print substr($2,13,2)substr($2,16,2)}'
yyyy

nbari · Answer 4 · 2017-11-09T15:08:38.793

Taking into account that the mac address always is 6 octets, you probably could just do something like this to get the last 2 octets:

awk '{print substr($0,13)}' input.txt

While testing on the fly by using arp -an I notice that the output was not always printing the mac addresses in some cases it was returning something like:

(169.254.113.54) at (incomplete) on en4 [ethernet]

Therefore probably is better to filter the input to guarantee a mac address, this can be done by applying this regex:

^([0-9A-Fa-f]{2}[:-]){5}([0-9A-Fa-f]{2})$

Applying the regex in awk and only printing the 2 last octecs:

arp -an | awk '{if ($4 ~ /^([0-9A-Fa-f]{2}[:-]){5}([0-9A-Fa-f]{2})$/) print substr($4,13)}'

This will filter the column $4 and verify that is a valid MAC address, then it uses substr to just return the last "letters"

You could also split by : and print the output in multiple ways, for example:

awk '{if ($4 ~ /^([0-9A-Fa-f]{2}[:-]){5}([0-9A-Fa-f]{2})$/) split($4,a,":");  print a[5] ":" a[6]}

Notice the exp ~ /regexp/

This is true if the expression exp (taken as a string) is matched by regexp. 
The following example matches, or selects, all input records with the upper-case letter `J' somewhere in the first field:
$ awk '$1 ~ /J/' inventory-shipped
-| Jan  13  25  15 115
-| Jun  31  42  75 492
-| Jul  24  34  67 436
-| Jan  21  36  64 620
So does this:
awk '{ if ($1 ~ /J/) print }' inventory-shipped

Print out only last 4 digits of mac addresses from 2nd column using awk in linux

4 Answers4