Find Unused Ports - Script
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
02-14-2018 05:14 AM - edited 03-08-2019 01:50 PM
I came across this script to find ports that have not been used for 6 weeks or more. I can get it to work for anything up to 9 weeks or more. However I'm struggling to figure out how to modify this script to show double digit weeks or more.
For example, I want to show unused ports for 16 weeks or more, but I'm not sure what to change/add.
Shows only admin down or unconnected ports that have no input/input for +6 weeks
show int | i proto.*notconnect|proto.*administratively down|Last in.* [6-9]w|Last in.*[0-9][0-9]w|[0-9]y|disabled|Last input never, output never, output hang never
Script Source:
- Labels:
-
Other Switching
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
02-14-2018 05:42 AM - edited 02-14-2018 05:47 AM
ah some nice regex.
You will want to adjust the first character range expression: [6-9] which will only show you output for weeks 6 to 9.
You could change this to:
([1-9][6])
...which would match weeks 16,26,36, etc ...so not much good. You could tweak it a little:
([1-9][0-9])
...which would give you weeks 10-99
But I guess this is probably the best I can come up with:
(16|17|18|19)
...just keep adding to the OR statement.
So you will have:
show int | i proto.*notconnect|proto.*administratively down|Last in.* (16|17|18)w|[0-9]y|disabled|Last input never, output never, output hang never
cheers,
Seb.
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
02-14-2018 08:18 AM
Thanks @Seb Rupik. Your suggestions gave me a few things to try. I added another OR statement. I found out that the first bracket matches the first digit and the second bracket matches the second digit. For it to be true, both digits have to be found in their respective positions.
Thus if 16 weeks or more is needed, I did this:
Last in.* [1][6-9]w
...First digit can only be a 1 and the second digit can be a 6,7,8,9 resulting in 16,17,18,19
In order to continue with 20 and after, another OR statement was needed.
Last in.*[2-9][0-9]w
...Now first digit can be 2-9 and the second digit can be 0-9 resulting in 20-99
This statement now give me unused ports 16 weeks or greater.
show int | i proto.*notconnect|proto.*administratively down|Last in.* [1][6-9]w|Last in.*[2-9][0-9]w|[0-9]y|disabled|Last input never, output never, output hang never
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
02-15-2018 12:10 AM
I like it, good regex-fu!

- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
01-03-2020 06:21 AM
Unfortunately this command does not work 100% properly. It showed me a port which is only unused since 2 weeks.
GigabitEthernet1/0/25 is down, line protocol is down (notconnect) Hardware is Gigabit Ethernet, address is 580a.20dd.8c99 (bia 580a.20dd.8c99) MTU 1500 bytes, BW 10000 Kbit/sec, DLY 1000 usec, reliability 255/255, txload 1/255, rxload 1/255 Encapsulation ARPA, loopback not set Keepalive set (10 sec) Auto-duplex, Auto-speed, media type is 10/100/1000BaseTX input flow-control is off, output flow-control is unsupported ARP type: ARPA, ARP Timeout 04:00:00 Last input 2w0d, output 2w0d, output hang never Last clearing of “show interface” counters never Input queue: 0/75/0/0 (size/max/drops/flushes); Total output drops: 0 Queueing strategy: fifo Output queue: 0/40 (size/max) 5 minute input rate 0 bits/sec, 0 packets/sec 5 minute output rate 0 bits/sec, 0 packets/sec 31066381 packets input, 8796519066 bytes, 0 no buffer Received 620213 broadcasts (348900 multicasts) 0 runts, 0 giants, 0 throttles 0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored 0 watchdog, 348900 multicast, 0 pause input 0 input packets with dribble condition detected 63243708 packets output, 43477234713 bytes, 0 underruns 0 output errors, 0 collisions, 1 interface resets 1663 unknown protocol drops 0 babbles, 0 late collision, 0 deferred 0 lost carrier, 0 no carrier, 0 pause output 0 output buffer failures, 0 output buffers swapped out
Do you know why this happens and can this be fixed?
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
01-03-2020 07:33 AM
Can you share the exact show command that you are using?
cheers,
Seb.

- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
01-03-2020 10:08 AM
I tried the command from the first post.
show int | i proto.*notconnect|proto.*administratively down|Last in.* [6-9]w|Last in.*[0-9][0-9]w|[0-9]y|disabled|Last input never, output never, output hang never
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
01-04-2020 03:12 PM
It is matching 'protocol is down (notconnect' with the regex:
proto.*notconnect
Perhaps you want to strip the regex down to search just on the Last input value:
show int | i Last in.* [6-9]w|Last in.*[0-9][0-9]w|[0-9]y|Last input never, output never, output hang never
cheers,
Seb.

- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
01-07-2020 12:55 AM
Thanks for your answer. Your suggestions works better but unfortunately now the interfaces are not shown anymore.
However I tried only proto.*down and this worked in my first approaches.
show int | i proto.*down|Last in.* [0-9]w|Last in.*[0-9][0-9]w|[0-9]y|disabled|Last input never, output never, output hang never
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
01-14-2020 07:14 AM
Seb,
I am running the command:
show int | i proto.*down|Last in.* [0-9]w|Last in.*[0-9][0-9]w|[0-9]y|disabled|Last input never, output never
However, it is showing me every port that is down (even if it has only been down for a few days). Is there any way to make it not show me ports that are down unless it has been down for 2 weeks? Or is there a document that dives further into what the values inside of the brackets mean?
Here is what it looks like when I run the code:
XXXXXXXXXX#$n.* [0-9]w|Last in.*[0-9][0-9]w|[0-9]y|disabled|Last input never, output never
Vlan1 is administratively down, line protocol is down
GigabitEthernet0/1 is down, line protocol is down (notconnect)
GigabitEthernet0/2 is down, line protocol is down (notconnect)
GigabitEthernet0/3 is down, line protocol is down (notconnect)
Last input never, output never, output hang never
GigabitEthernet0/4 is down, line protocol is down (notconnect)
GigabitEthernet0/5 is down, line protocol is down (notconnect)
Last input never, output 1w4d, output hang never
GigabitEthernet0/6 is down, line protocol is down (notconnect)
Last input never, output never, output hang never
GigabitEthernet0/7 is down, line protocol is down (notconnect)
Last input never, output never, output hang never
GigabitEthernet0/9 is down, line protocol is down (notconnect)
Last input never, output never, output hang never
GigabitEthernet0/11 is down, line protocol is down (notconnect)
Last input never, output never, output hang never
GigabitEthernet0/12 is down, line protocol is down (notconnect)
Last input never, output never, output hang never
Here is port 1:
XXXXXXX#sh int gi0/1
GigabitEthernet0/1 is down, line protocol is down (notconnect)
Last input 5d01h, output 5d01h, output hang never
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
01-16-2020 02:47 PM
Hi there,
The reason Gi0/1 is showing is that the show int output is matching on:
GigabitEthernet0/1 is down, line protocol is down (notconnect)
...using this element of the regex statement:
show int | i proto.*down
As for the numbers in the square brackets, that represents a numeric range for a single digit. ie [0-9] will match one of 0,1,2,3,4,5,6,7,8,9
[4-7] will match one of 4,5,6,7 .
Now if you want to find the switchports which have been 'down' for 2 weeks, all we have to go on is the last input/output values. So the following regex would work:
show int | i Last in.*[2-9]w|Last in.*[1-9][0-9]w|Last in.*[1-9]y|Last input never, output never
This will look for the digit preceeding the week value. Notice we have a regex OR operator, so we are first looking for a value 2 to 9, OR 10-99 OR 1-9 years.
cheers,
Seb.
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
02-22-2022 02:26 PM
this only returns the status Seb. how would you determine which interface actually matches the last input value given
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
02-23-2022 06:56 AM
Hi there,
I don't have a way to test this currently but it looks like we have forgotten to match on the first line of sh int output which would give us the interface ID:
show int | i proto.*down
...once we have that we can start adding the remaining conditional statements:
show int | i proto.*down|Last in.*[2-9]w|Last in.*[1-9][0-9]w|Last in.*[1-9]y|Last input never, output never
Does it work?
cheers,
Seb.
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
02-23-2022 07:01 AM - edited 02-23-2022 07:03 AM
Good morning Seb,
so i was working in Python the entire time vs. just the CLI of a given Cisco device.
i used netmiko and TEXTFSM templates to pull the interface data.
then i did some regex within python to determine the interfaces that i wanted to see which had not been active in two weeks. here is a test i was doing which i think integrated into my python script.
your post here made it easier for me to create my regex pattern along with a regex generator.
Thanks again.
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
03-01-2022 08:39 AM
Any mention of years and you can assume it is longer than 2 weeks. You also seem to have repeated '[1-9][0-9]w'. The two digit week number can be solved using the ? operator.
I think you could condense your regex down to just:
[0-9]{1,2}+y|[1-9][0-9]?w
...and pass the same number of test cases.
cheers,
Seb.
