从dhcpd.lease中提取MAC和IP地址-阿里云开发者社区

从dhcpd.lease中提取MAC和IP地址

2017-11-09 1116

版权

本文内容由阿里云实名注册用户自发贡献，版权归原作者所有，阿里云开发者社区不拥有其著作权，亦不承担相应法律责任。具体规则请查看《阿里云开发者社区用户服务协议》和《阿里云开发者社区知识产权保护指引》。如果您发现本社区中有涉嫌抄袭的内容，填写侵权投诉表单进行举报，一经查实，本社区将立刻删除涉嫌侵权内容。

简介：

从DHCP的log中提取MAC和IP地址./var/lib/dhcpd/dhcp.lease中的一段记录如下:

lease 192.168.1.238 {
starts 0 2007/11/25 11:57:41;
ends 0 2007/11/25 17:57:41;
tstp 0 2007/11/25 17:57:41;
binding state free;
hardware ethernet 00:0c:29:ac:4e:01;
uid "\377eth0\000\001\000\001\016\354\015J\000\014)\254N\001";
}

# cat dhcpd.leases | egrep 'lease|hardware' | sed 's/lease//g' | sed 's/{//g' | sed 's/hardware ethernet//g

网友给的办法.测试了一下.重复的较多.主要是出现了.同一个MAC多次获取不同的IP地址的情况
在CU上找到更好的命令[url]http://bbs.chinaunix.net/thread-980700-1-1.html[/url]
cat dhcpd.leases|awk 'BEGIN{RS=ORS="}"}{print $2,$21,"\n"}'

或者
awk 'BEGIN{RS=ORS="}"}{print $2,$21,"\n"}' dhcpd.leases
解释:
RS 输入的记录他隔符新行
ORS 输出的记录分隔符新行
从头查找,遇到}结束,显示第2和第21个字段.ip在第2个字段.mac在第21个字段.
这样出来的结果基本符合我们的要求.
All so
}192.168.1.250 00:0c:29:ac:4e:01;
}192.168.1.238 00:0c:29:ac:4e:01;
}192.168.1.241 00:0c:29:ac:4e:01;
}192.168.1.246 00:0c:29:ac:4e:01;
}192.168.1.248 00:0c:29:ac:4e:01;
}192.168.1.251 00:0c:29:05:ac:8a;
}192.168.1.253 00:0c:29:c2:b3:44;
}192.168.1.247 00:0a:eb:f3:39:dd;
}192.168.1.254 00:0c:29:c2:b3:44;
}192.168.1.249 00:0c:29:a8:c7:0a;
}192.168.1.245 00:0c:29:79:e2:aa;
}192.168.1.244 00:0c:29:79:e2:aa;
}192.168.1.243 00:0c:29:9d:e8:d8;
}192.168.1.240 00:0c:29:a8:59:21;
}192.168.1.242 00:0c:29:9d:e8:d8;
}192.168.1.239 00:16:d3:b6:1b:d2;
}
缺点就是第一行多了All so 每一行多了},也就是说我们要把这个结果再处理一下.
去掉第一行和最后一行,并把它排序.
改进一下命令,由于dhcpd.lease前面7行都是注释的内容,我们跳过这些行
tail -n +8 dhcpd.lease

从第8行开始显示dhcpd.lease文件

#tail -n +8 dhcpd.leases|less|awk 'BEGIN{RS=ORS="}"}{print $2,$21,"\n"}'
192.168.1.252 00:0c:29:ac:4e:01;
}192.168.1.250 00:0c:29:ac:4e:01;
}192.168.1.238 00:0c:29:ac:4e:01;
}192.168.1.241 00:0c:29:ac:4e:01;
}192.168.1.246 00:0c:29:ac:4e:01;
}192.168.1.248 00:0c:29:ac:4e:01;
}192.168.1.251 00:0c:29:05:ac:8a;
}192.168.1.253 00:0c:29:c2:b3:44;
}192.168.1.247 00:0a:eb:f3:39:dd;
}192.168.1.254 00:0c:29:c2:b3:44;
}192.168.1.249 00:0c:29:a8:c7:0a;
}192.168.1.245 00:0c:29:79:e2:aa;
}192.168.1.244 00:0c:29:79:e2:aa;
}192.168.1.243 00:0c:29:9d:e8:d8;
}192.168.1.240 00:0c:29:a8:59:21;
}192.168.1.242 00:0c:29:9d:e8:d8;
}192.168.1.239 00:16:d3:b6:1b:d2;
}
现在还有该死的},我们用sed命令把它替换掉.
sed 's/}//g'

替换所有的}为空
#tail -n +8 dhcpd.leases|less|awk 'BEGIN{RS=ORS="}"}{print $2,$21,"\n"}'|sed 's/}//g'

192.168.1.252 00:0c:29:ac:4e:01;
192.168.1.250 00:0c:29:ac:4e:01;
192.168.1.238 00:0c:29:ac:4e:01;
192.168.1.241 00:0c:29:ac:4e:01;
192.168.1.246 00:0c:29:ac:4e:01;
192.168.1.248 00:0c:29:ac:4e:01;
192.168.1.251 00:0c:29:05:ac:8a;
192.168.1.253 00:0c:29:c2:b3:44;
192.168.1.247 00:0a:eb:f3:39:dd;
192.168.1.254 00:0c:29:c2:b3:44;
192.168.1.249 00:0c:29:a8:c7:0a;
192.168.1.245 00:0c:29:79:e2:aa;
192.168.1.244 00:0c:29:79:e2:aa;
192.168.1.243 00:0c:29:9d:e8:d8;
192.168.1.240 00:0c:29:a8:59:21;
192.168.1.242 00:0c:29:9d:e8:d8;
192.168.1.239 00:16:d3:b6:1b:d2;

我们再把结果排序一下,让它看上去舒服一些.
#tail -n +8 dhcpd.leases|less|awk 'BEGIN{RS=ORS="}"}{print $2,$21,"\n"}'|sed 's/}//g'|sort -n

192.168.1.238 00:0c:29:ac:4e:01;
192.168.1.239 00:16:d3:b6:1b:d2;
192.168.1.240 00:0c:29:a8:59:21;
192.168.1.241 00:0c:29:ac:4e:01;
192.168.1.242 00:0c:29:9d:e8:d8;
192.168.1.243 00:0c:29:9d:e8:d8;
192.168.1.244 00:0c:29:79:e2:aa;
192.168.1.245 00:0c:29:79:e2:aa;
192.168.1.246 00:0c:29:ac:4e:01;
192.168.1.247 00:0a:eb:f3:39:dd;
192.168.1.248 00:0c:29:ac:4e:01;
192.168.1.249 00:0c:29:a8:c7:0a;
192.168.1.250 00:0c:29:ac:4e:01;
192.168.1.251 00:0c:29:05:ac:8a;
192.168.1.252 00:0c:29:ac:4e:01;
192.168.1.253 00:0c:29:c2:b3:44;
192.168.1.254 00:0c:29:c2:b3:44;
如果只是单纯要IP或者MAC
列出IP
cat dhcpd.leases|grep -o '\<[0-9]\{1,3\}\.[0-9]\{1,3\}\.[0-9]\{1,3\}\.[0-9]\{1,3\}\>'

列出MAC

cat dhcpd.lease|grep -o '\<[0-9a-f]\{2\}:[0-9a-f]\{2\}:[0-9a-f]\{2\}:[0-9a-f]\{2\}:[0-9a-f]\{2\}:[0-9a-f]\{2\}\>'

本文转自 mcshell 51CTO博客，原文链接：http://blog.51cto.com/mcshell/166705，如需转载请自行联系原作者

从dhcpd.lease中提取MAC和IP地址

热门文章

最新文章

相关电子书