topic Thanks. So does the in Network Security

Cisco ASA Multiple Show Command Filters

Mike Keenan — Tue, 12 Mar 2019 06:14:40 GMT

Is there a way to perform multiple filters to a show command in the Cisco ASA IOS (8.4 and above)? Please give an example if there is. I tried:

show access-list | include 10.15.221.22 | exclude 1270

but that does not work.

Hi,No , this will not work on

Vibhor Amrodia — Thu, 09 Jul 2015 13:53:34 GMT

Hi,

No , this will not work on the ASA device.

Thanks and Regards,

Vibhor Amrodia

Thanks. So does the

Mike Keenan — Thu, 09 Jul 2015 14:38:13 GMT

Thanks. So does the explanation of, "This will not work on the ASA device" refer to my example or does it refer to any kind of multiple filter syntax? In other words do ASA devices not support muliple show command filter syntax?

As far as we know, ASA

James Leinweber — Thu, 09 Jul 2015 19:19:22 GMT

As far as we know, ASA devices do not support multiple filters, period. In particular, the first "|" means filter, and any subsequent ones mean regular expression alternation. I usually cut & paste show output from a terminal window into a text editor on a real OS, and then beat up on it with actual string processing tools.

-- Jim Leinweber, WI State Lab of Hygiene

I found out from

Mike Keenan — Wed, 12 Aug 2015 13:43:47 GMT

I found out from TrevorTraining.com that you can do multiple | i statements. Example:

show run | i p n|3.3.3.3

This will include BOTH strings "p n" (object-group network) AND any string that contains "3.3.3.3". This will indicate the object-group that contains 3.3.3.3 without having to do a "show run object-group" and manually filtering through the output.

Re: I found out from

netadmin@oyo — Fri, 21 Dec 2018 19:18:57 GMT

This extra vertical bar to add more search parameters works for me 😃

with some caveats of space delimiters that I have yet to see documented, but have not researched much.

The active parsing process definitely processes the first vertical bar differently than subsequent vertical bars.

The first vertical bar needs a space delimiter before and after :

ASA-5515X# sho traff| in rec
^
ERROR: % Invalid input detected at '^' marker.

ASA-5515X# sho traff |in ?
ERROR: % Unrecognized command

ASA-5515X# sho traff | in LAN
LAN:

Subsequent vertical bars...

Space after second vertical bar does not work:
ASA-5515X# sho traff | in WAN| LAN
WAN:

Space before and after second vertical bar does not work:

ASA-5515X# sho traff | in LAN | WAN

No space before and after second vertical bar works:

ASA-5515X# sho traff | in LAN|WAN
WAN:
LAN:

Space before third vertical bar causes second search parameter to be dropped:

ASA-5515X# sho traff | in WAN|LAN |2 pkts

WAN:
5 minute input rate 2 pkts/sec, 139 bytes/sec
5 minute input rate 2 pkts/sec, 187 bytes/sec
5 minute output rate 2 pkts/sec, 177 bytes/sec
5 minute input rate 2 pkts/sec, 177 bytes/sec

No space before third vertical bar includes second search parameter in the search:

ASA-5515X# sho traff | in WAN|LAN|2 pkts
WAN:
LAN:
5 minute input rate 2 pkts/sec, 139 bytes/sec
5 minute input rate 2 pkts/sec, 187 bytes/sec
5 minute output rate 2 pkts/sec, 177 bytes/sec
5 minute input rate 2 pkts/sec, 177 bytes/sec

Sample output without a filter:

ASA-5515X# sho traf
WAN:
received (in 883729.480 secs):
554326570 packets 687492900119 bytes
0 pkts/sec 777002 bytes/sec
transmitted (in 883729.480 secs):
81159319 packets 38001404317 bytes
4 pkts/sec 43001 bytes/sec
1 minute input rate 515 pkts/sec, 481704 bytes/sec
1 minute output rate 255 pkts/sec, 292291 bytes/sec
1 minute drop rate, 0 pkts/sec
5 minute input rate 438 pkts/sec, 478150 bytes/sec
5 minute output rate 69 pkts/sec, 16105 bytes/sec
5 minute drop rate, 0 pkts/sec
LAN:
received (in 883729.480 secs):
81157929 packets 33663306289 bytes
4 pkts/sec 38004 bytes/sec
transmitted (in 883729.480 secs):
551441501 packets 658413447560 bytes
1 pkts/sec 745000 bytes/sec
1 minute input rate 255 pkts/sec, 278934 bytes/sec
1 minute output rate 512 pkts/sec, 454322 bytes/sec
1 minute drop rate, 0 pkts/sec
5 minute input rate 69 pkts/sec, 12420 bytes/sec
5 minute output rate 434 pkts/sec, 455113 bytes/sec
5 minute drop rate, 0 pkts/sec
management:
received (in 883734.520 secs):
31148850 packets 1261698039 bytes
1 pkts/sec 1000 bytes/sec
transmitted (in 883734.520 secs):
55648308 packets 13494870042 bytes
4 pkts/sec 15002 bytes/sec

...

There are more permutations of this, but very cool that this works at least a little to save some time processing in one-shot rather than multiple processing steps. 😃

Thanks for the idea otherwise I may have given up. 😉

-Mike