{"id":817,"date":"2019-07-24T13:01:48","date_gmt":"2019-07-24T13:01:48","guid":{"rendered":"http:\/\/feralpacket.org\/?p=817"},"modified":"2019-07-25T18:49:58","modified_gmt":"2019-07-25T18:49:58","slug":"regular-expressions-for-securecrt-keyword-highlighting-update","status":"publish","type":"post","link":"https:\/\/feralpacket.org\/?p=817","title":{"rendered":"Regular Expressions For SecureCRT Keyword Highlighting &#8211; Update"},"content":{"rendered":"<p>This is an update to my previous post on syntax highlighting in SecureCRT. &nbsp;I\u2019ve focused on highlighting the output of show commands, but not &#8220;show run&#8221;. &nbsp;I don&#8217;t specifically try to match the configuration. &nbsp;I find that doing so causes the output of&nbsp;\u201cshow logging\u201d to be over highlighted with different colors making it hard to read.&nbsp; It&#8217;s easy to over highlight and ruin the entire point of it.&nbsp; I have temporarily added entries to look for configuration problems in the past, such as allowing telnet, using password 7 hashes, or SNMPv1 read\/write strings. &nbsp;But I\u2019ve found it\u2019s easier and quicker to search through the backed up device configurations and address the issue all at once.<br \/>\n&nbsp;<br \/>\nI\u2019ve updated the regular expressions to include:<br \/>\n&#8211; Works with with IOS, IOS-XE, and NXOS.<br \/>\n&#8211; Works fairly well with XR.&nbsp; Matching the output of &#8220;show logging&#8221; needs more work.<br \/>\n&#8211; Works fairly well with ASAs.&nbsp; The ASAs use a time format of 0:00:00.&nbsp; They end up partially matching the RT \/ RD regular expression.&nbsp; If you are not working with L3VPNs, you can delete that regular expression and modify the Time regular expression to match the ASA&#8217;s format.&nbsp; Otherwise, the fix would be to use a separate .ini file with the ASAs.<br \/>\n&#8211; Match Hundred, Forty, TwentyFive, and Ten GigabitEthernet interfaces.<br \/>\n&#8211; Match switch stack switch\/slot\/port interfaces, router slot\/subslot\/port interfaces, FEX chassis_id\/slot\/port interfaces, breakout cable chassis_id\/slot\/port\/breakout_port interfaces, and XR rack\/slot\/module\/port interfaces.<br \/>\n&#8211; Reduced the interface regular expressions to two lines (my personal list had grown to 14 lines).<br \/>\n&#8211; Changed the Privileged EXEC&nbsp;prompt regular expression to match anything with A-Z, a-z, 0-9,a dash, underscore, forward slash, or colon. &nbsp;If you use other characters in your hostname, you\u2019ll have to make the appropriate changes. &nbsp;The User EXEC prompt is not matched.<br \/>\n&#8211; Added MAC addresses to the Time regular expression line. &nbsp;If I didn\u2019t, one of the Time regular expressions would match part of the MAC address turning that part grey and one of the RT\/RD regular expressions would match another part of the same MAC address turning that part blue.&nbsp; While I was at it, I added VOIP phone and access point device IDs that are displayed in the output of &#8220;show cdp neighbors&#8221;.<br \/>\n&#8211; Changed the order of the lines. &nbsp;This is to allow the global configuration prompt to display&nbsp;\u201cconfig\u201d in yellow. &nbsp;It also allows me to override the greedy &#8220;(not(.*)?\u201d regular expression. &nbsp;I was tired of seeing&nbsp;\u201cnotconnect\u201d and &#8220;notifications&#8221; in red.<br \/>\n&#8211; Added regular expressions to match unwanted, partial matches. &nbsp;I thing turn these white or the default text color.<br \/>\n&nbsp;<br \/>\nThe regular expressions are based on syntax used with Python. <a href=\"https:\/\/docs.python.org\/3\/library\/re.html\">https:\/\/docs.python.org\/3\/library\/re.html<\/a><br \/>\n&nbsp;<br \/>\nSecureCRT does not support using spaces in regular expressions. &nbsp;Which sucks.&nbsp; Matching spaces would be handy for matching within the OSPF database, EIGRP topology, or the BGP neighbor information.&nbsp; I&#8217;ve found example configurations that try to use the hexcodes for a space, such as \\x20. &nbsp;That doesn\u2019t work for me. &nbsp;Using the hexcode for a dash works, \\x2d. &nbsp;*shrug*&nbsp;&nbsp;There are many references in the VanDyke forums that the performance hit was too large.<br \/>\n&nbsp;<br \/>\nAs much as I complain about not being able to match across spaces and, I\u2019ve tried to get my list of regular expressions to work with a SSH\/terminal program that does allow syntax highlighting matches with spaces. &nbsp;Wow. &nbsp;Talk about greedy matches. &nbsp;\u201cWhy is my entire screen blue?!?!\u201d &nbsp;It\u2019d take some time to completely rethink, rewrite, and test what I\u2019m matching.<br \/>\n&nbsp;<br \/>\nWith SecureCRT, the following are considered word delimiters:<\/p>\n<p>`~!#$%^&amp;*()+=:;&lt;&gt;,.?\/\\[]{}|&#8217;<br \/>\n&nbsp;<br \/>\nOrder matters. &nbsp;Generally, match the more specific (longer) before the less specific (shorter). &nbsp;Otherwise, you&#8217;ll get partial matches. &nbsp;For example, match &#8220;errors&#8221; before &#8220;error&#8221; before &#8220;err\u201d. &nbsp;Unless, of course, you want to override more specific matches. &nbsp;For example, match emergencies, alerts, and critical log messages with&nbsp;%\\w*\\-[012]\\-\\w*.<br \/>\n&nbsp;<br \/>\nPython regular expressions are greedy. &nbsp;This means that it will try to match as much as possible. &nbsp;This allows &#8220;(errors|error|err)&#8221; to be shortened to &#8220;(err(ors|or)?\u201d or \u201c(err(or(s)?)?\u201d or &#8220;(err(.*)?)\u201d.<br \/>\n&nbsp;<br \/>\nI\u2019m still using the one line regular expressions for IPv6 and IPv4 addresses from the book&nbsp;Regular Expressions Cookbook, 2nd Edition&nbsp;by&nbsp;Steven Levithan,&nbsp;Jan Goyvaerts.<br \/>\n&nbsp;<br \/>\nThere are some false matches. &nbsp;I use the &#8220;Case match&#8221; option to reduce them as much as possible. &nbsp;Still, things such as &#8220;B&#8221;, &#8220;R&#8221;, and &#8220;DR&#8221; still show up in some odd places. &nbsp;Meh. &nbsp;NXOS gets a few weird matches as well.&nbsp; With EIGRP on NXOS, &#8220;internal&#8221; and &#8220;external&#8221; are lowercase in the output of &#8220;show ip route&#8221;.&nbsp; Matching them causes those words to appear green in some weird places.&nbsp;&nbsp;The ASAs use a time format that doesn&#8217;t follow any of the other Cisco device families.<br \/>\n&nbsp;<br \/>\nThe colors I use are meant for a dark (black) background with white text.&nbsp;&nbsp;Because of this, dark colors are avoided. &nbsp;I&#8217;ve tried to group the output of some protocols together: &nbsp;BGP &#8211; blue,&nbsp;RIP &#8211; red,&nbsp;OSPF &#8211; orange,&nbsp;EIGRP &#8211; evergreen (but evergreen is too dark, so a lighter shade of green).<br \/>\n&nbsp;<br \/>\nNot listed below are some personal regular expressions.&nbsp; It&#8217;s common for route-map names, named ACLs, and other user defined names to be partially matched.&nbsp; I create regular expressions to match those and then color them depending on their purpose.<br \/>\n&nbsp;<br \/>\nIf you don&#8217;t want to configured the highlight keywords in SecureCRT, you can use this .ini file. &nbsp;For OS X, copy the .ini file into the following directory:<\/p>\n<p>\/Users\/username\/Library\/Application\/Support\/VanDyke\/SecureCRT\/Config\/Keywords\/.<br \/>\n&nbsp;<br \/>\nFor Windows, the directory is located in %APPDATA%, which should be:<\/p>\n<p>C:\\Users\\username\\AppData\\Roaming\\VanDyke\\Config|Keywords&gt;.<br \/>\n&nbsp;<br \/>\nIn Linux, copy the .ini file into:<\/p>\n<p>\/home\/username\/.vandyke\/SecureCRT\/Config\/Keywords\/.<br \/>\n&nbsp;<br \/>\n<a href=\"http:\/\/download.feralpacket.org\/feralpacket.ini\">http:\/\/download.feralpacket.org\/feralpacket.ini<\/a><br \/>\n&nbsp;<br \/>\nNOTE &#8211; &nbsp;Information that will not age well:<br \/>\n&#8211; Linux syntax highlighting support is in pre-release for version 8.6. &nbsp;If your license for SecureCRT is current, you can request access to a pre-release. &nbsp;Information can be found in the VanDyke forums. &nbsp;Or you can wait for 8.6 to be released.<br \/>\n&#8211; The regular expressions I\u2019m using to get rid of unwanted, partial matches doesn\u2019t work with the latest version of SecureCRT for OS X. &nbsp;It works in the latest Windows and Linux versions. &nbsp;From the SecureCRT_History.txt of the 8.6 pre-release, &#8220;Change the keyword highlighting regular expression algorithm to honor the order of the configured keywords.\u201d &nbsp;Hopefully, that fixes the issue.<\/p>\n<p><code><br \/>\n<strong>SecureCRT Settings:<\/strong><br \/>\n- Session Options -&gt; Terminal -&gt; Appearance<br \/>\n-&gt; Current color scheme<br \/>\n-&gt; White \/ Black<br \/>\n-&gt; Highlight keywords<br \/>\n-&gt; Name:  feralpacket<br \/>\n-&gt; Style:  Color is checked<br \/>\n- Keyword List Properties<br \/>\n-&gt; Match case is checked<br \/>\n- To set for the default session:<br \/>\n-&gt; Global Options -&gt; General -&gt; Default Session<br \/>\n-&gt; Edit Default Settings...<br \/>\n<\/code><br \/>\n&nbsp;<br \/>\n<strong>Screenshots:<\/strong><\/p>\n<p><a href=\"https:\/\/feralpacket.org\/wp-content\/uploads\/2019\/07\/config_prompt.png\"><img decoding=\"async\" width=\"300\" class=\"alignnone size-medium wp-image-311\" alt=\"Prompt\" src=\"https:\/\/feralpacket.org\/wp-content\/uploads\/2019\/07\/config_prompt.png\"><\/a><\/p>\n<p><a href=\"https:\/\/feralpacket.org\/wp-content\/uploads\/2019\/07\/ipv6_test.png\"><img decoding=\"async\" width=\"300\" class=\"alignnone size-medium wp-image-311\" alt=\"Prompt\" src=\"https:\/\/feralpacket.org\/wp-content\/uploads\/2019\/07\/ipv6_test.png\"><\/a><\/p>\n<p><a href=\"https:\/\/feralpacket.org\/wp-content\/uploads\/2016\/08\/Logs.png\"><img loading=\"lazy\" decoding=\"async\" width=\"300\" height=\"75\" class=\"alignnone size-medium wp-image-311\" alt=\"Logs\" src=\"https:\/\/feralpacket.org\/wp-content\/uploads\/2016\/08\/Logs-300x75.png\" srcset=\"https:\/\/feralpacket.org\/wp-content\/uploads\/2016\/08\/Logs-300x75.png 300w, https:\/\/feralpacket.org\/wp-content\/uploads\/2016\/08\/Logs-768x193.png 768w, https:\/\/feralpacket.org\/wp-content\/uploads\/2016\/08\/Logs-1024x257.png 1024w, https:\/\/feralpacket.org\/wp-content\/uploads\/2016\/08\/Logs.png 1808w\" sizes=\"auto, (max-width: 300px) 100vw, 300px\" \/><\/a><\/p>\n<p><a href=\"https:\/\/feralpacket.org\/wp-content\/uploads\/2016\/08\/OSPF.png\"><img loading=\"lazy\" decoding=\"async\" width=\"300\" height=\"143\" class=\"alignnone size-medium wp-image-310\" alt=\"OSPF\" src=\"https:\/\/feralpacket.org\/wp-content\/uploads\/2016\/08\/OSPF-300x143.png\" srcset=\"https:\/\/feralpacket.org\/wp-content\/uploads\/2016\/08\/OSPF-300x143.png 300w, https:\/\/feralpacket.org\/wp-content\/uploads\/2016\/08\/OSPF-768x366.png 768w, https:\/\/feralpacket.org\/wp-content\/uploads\/2016\/08\/OSPF-1024x488.png 1024w, https:\/\/feralpacket.org\/wp-content\/uploads\/2016\/08\/OSPF.png 1086w\" sizes=\"auto, (max-width: 300px) 100vw, 300px\" \/><\/a><\/p>\n<p><a href=\"https:\/\/feralpacket.org\/wp-content\/uploads\/2016\/08\/RIB.png\"><img loading=\"lazy\" decoding=\"async\" width=\"300\" height=\"234\" class=\"alignnone size-medium wp-image-309\" alt=\"RIB\" src=\"https:\/\/feralpacket.org\/wp-content\/uploads\/2016\/08\/RIB-300x234.png\" srcset=\"https:\/\/feralpacket.org\/wp-content\/uploads\/2016\/08\/RIB-300x234.png 300w, https:\/\/feralpacket.org\/wp-content\/uploads\/2016\/08\/RIB-768x600.png 768w, https:\/\/feralpacket.org\/wp-content\/uploads\/2016\/08\/RIB-1024x800.png 1024w, https:\/\/feralpacket.org\/wp-content\/uploads\/2016\/08\/RIB.png 1088w\" sizes=\"auto, (max-width: 300px) 100vw, 300px\" \/><\/a><\/p>\n<p><a href=\"https:\/\/feralpacket.org\/wp-content\/uploads\/2016\/08\/MPLS.png\"><img loading=\"lazy\" decoding=\"async\" width=\"300\" height=\"228\" class=\"alignnone size-medium wp-image-308\" alt=\"MPLS\" src=\"https:\/\/feralpacket.org\/wp-content\/uploads\/2016\/08\/MPLS-300x228.png\" srcset=\"https:\/\/feralpacket.org\/wp-content\/uploads\/2016\/08\/MPLS-300x228.png 300w, https:\/\/feralpacket.org\/wp-content\/uploads\/2016\/08\/MPLS-768x583.png 768w, https:\/\/feralpacket.org\/wp-content\/uploads\/2016\/08\/MPLS-1024x777.png 1024w, https:\/\/feralpacket.org\/wp-content\/uploads\/2016\/08\/MPLS.png 1118w\" sizes=\"auto, (max-width: 300px) 100vw, 300px\" \/><\/a><\/p>\n<p><a href=\"https:\/\/feralpacket.org\/wp-content\/uploads\/2016\/08\/EIGRP.png\"><img loading=\"lazy\" decoding=\"async\" width=\"300\" height=\"231\" class=\"alignnone size-medium wp-image-307\" alt=\"EIGRP\" src=\"https:\/\/feralpacket.org\/wp-content\/uploads\/2016\/08\/EIGRP-300x231.png\" srcset=\"https:\/\/feralpacket.org\/wp-content\/uploads\/2016\/08\/EIGRP-300x231.png 300w, https:\/\/feralpacket.org\/wp-content\/uploads\/2016\/08\/EIGRP-768x592.png 768w, https:\/\/feralpacket.org\/wp-content\/uploads\/2016\/08\/EIGRP-1024x789.png 1024w, https:\/\/feralpacket.org\/wp-content\/uploads\/2016\/08\/EIGRP.png 1100w\" sizes=\"auto, (max-width: 300px) 100vw, 300px\" \/><\/a><\/p>\n<p><a href=\"https:\/\/feralpacket.org\/wp-content\/uploads\/2016\/08\/v6RIB.png\"><img loading=\"lazy\" decoding=\"async\" width=\"300\" height=\"168\" class=\"alignnone size-medium wp-image-306\" alt=\"v6RIB\" src=\"https:\/\/feralpacket.org\/wp-content\/uploads\/2016\/08\/v6RIB-300x168.png\" srcset=\"https:\/\/feralpacket.org\/wp-content\/uploads\/2016\/08\/v6RIB-300x168.png 300w, https:\/\/feralpacket.org\/wp-content\/uploads\/2016\/08\/v6RIB-768x431.png 768w, https:\/\/feralpacket.org\/wp-content\/uploads\/2016\/08\/v6RIB-1024x574.png 1024w, https:\/\/feralpacket.org\/wp-content\/uploads\/2016\/08\/v6RIB.png 1034w\" sizes=\"auto, (max-width: 300px) 100vw, 300px\" \/><\/a><br \/>\n&nbsp;<br \/>\n<code><br \/>\n<strong>The Regular Expressions: <\/strong><\/code><\/p>\n<p><code><strong>! Get rid of unwanted, partial matches. Turn them white.<\/strong><br \/>\n(Stub\\-Routing|Process\\-tag|Dual\\-active|\\(R\\)|inactive\\-\\if\\-config|snmp\\-ipv6\\-dhcp\\-relay|dot1q\\-tunnel|route-tag|fddi\\-default|H\/W|hsrp\\-Vl\\d{1,4}\\-\\d{1,4}|B,T|B,R|notify|A\\.B\\.C\\.D|forwarding\\-table|repair\\-paths|forwarding\\-adjacency)<br \/>\n(passive\\-interface)<\/code><\/p>\n<p><code><strong>! IPv4-mapped IPv6 Addresses and SAF Identifier Numbers<\/strong><br \/>\n((\\d{1,5}:){2}[0-9A-F]{1,8}(\\.[0-9A-F]{1,8}){3}|(::FFFF)?::?(?:(?:25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9]?[0-9])\\.){3}(?:25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9]?[0-9]))<\/code><\/p>\n<p><code><strong>! VPNv6 Addresses<\/strong><br \/>\n\\[\\d{1,10}:\\d{1,10}\\](?:(?:[0-9A-Fa-f]{1,4}:){7}[0-9A-Fa-f]{1,4}|(?=(?:[0-9A-Fa-f]{0,4}:){0,7}[0-9A-Fa-f]{0,4}(?![:.\\w]))(([0-9A-Fa-f]{1,4}:){1,7}|:)((:[0-9A-Fa-f]{1,4}){1,7}|:)|(?:[0-9A-Fa-f]{1,4}:){7}:|:(:[0-9A-Fa-f]{1,4}){7})(?![:.\\w])<br \/>\n\\[\\d{1,3}(\\.\\d{1,3}){3}:\\d{1,10}\\](?:(?:[0-9A-Fa-f]{1,4}:){7}[0-9A-Fa-f]{1,4}|(?=(?:[0-9A-Fa-f]{0,4}:){0,7}[0-9A-Fa-f]{0,4}(?![:.\\w]))(([0-9A-Fa-f]{1,4}:){1,7}|:)((:[0-9A-Fa-f]{1,4}){1,7}|:)|(?:[0-9A-Fa-f]{1,4}:){7}:|:(:[0-9A-Fa-f]{1,4}){7})(?![:.\\w])<\/code><\/p>\n<p><code><strong>! VPNv4 Addresses<\/strong><br \/>\n(\\d{1,10}:){2}(?:(?:25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9]?[0-9])\\.){3}(?:25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9]?[0-9])<br \/>\n(?:(?:25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9]?[0-9])\\.){3}(?:25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9]?[0-9]):\\d{1,10}:(?:(?:25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9]?[0-9])\\.){3}(?:25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9]?[0-9])<\/code><\/p>\n<p><code><strong>! IPv6 Addresses<\/strong><br \/>\n(?:(?:[0-9A-Fa-f]{1,4}:){7}[0-9A-Fa-f]{1,4}|(?=(?:[0-9A-Fa-f]{0,4}:){0,7}[0-9A-Fa-f]{0,4}(?![:.\\w]))(([0-9A-Fa-f]{1,4}:){1,7}|:)((:[0-9A-Fa-f]{1,4}){1,7}|:)|(?:[0-9A-Fa-f]{1,4}:){7}:|:(:[0-9A-Fa-f]{1,4}){7})(?![:.\\w])<\/code><\/p>\n<p><code><strong>! MAC Addresses and Time<\/strong><br \/>\n((\\w{2}:){5}\\w{2}|(\\w{4}\\.){2}\\w{4}|SEP\\w{12}|AP(\\w{4}\\.){2}\\w{4}|(2[0-3]|[01][0-9])(:([0-5]?[0-9])){2,3}\\.\\d{3}|(2[0-3]|[01][0-9])(:([0-5]?[0-9])){1,2}|\\dy\\d{1,2}w|\\d{1,3}w\\dd|\\d{1,4}d\\d{2}h|year(s)?|week(s)?|day(s)?|hour(s)?|minutes)<\/code><\/p>\n<p><code><strong>! ASN:nn RD or RT<\/strong><br \/>\n((RT:)?\\d{1,10}:\\d{2,10}|(RT:)?\\d{1,10}:[1-9])<\/code><\/p>\n<p><code><strong>! IP-address:nn RD or RT<\/strong><br \/>\n(RT:)?(?:(?:25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9]?[0-9])\\.){3}(?:25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9]?[0-9]):\\d{2,5}|(RT:)?(?:(?:25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9]?[0-9])\\.){3}(?:25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9]?[0-9]):[1-9])<\/code><\/p>\n<p><code><strong>! IPv4 Addresses<\/strong><br \/>\n(?:(?:25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9]?[0-9])\\.){3}(?:25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9]?[0-9])<\/code><\/p>\n<p><code><strong>! Interfaces<\/strong><br \/>\n((Hundred|TwentyFive)GigE\\d{1,3}(\/\\d{1,3})*(\\.\\d{1,10})*|((Forty|Ten)*Gigabit|Fast)*Ethernet\\d{1,3}(\/\\d{1,3})*(\\.\\d{1,10})*|(Internal\\-(Control|Data)|Management|Serial|Twe|Eth|Hu|Tw|Fo|Te|Gi|Fa|Et|Se)\\d{1,3}(\/\\d{1,3})*(\\.\\d{1,10})*)<br \/>\n((Virtual\\-(Template|Access)|(P|p)ort-channel|Multilink|Loopback|Tunnel|Dialer|Vlan|mgmt|Null|NVI|BVI|Po|Mu|Lo|Tu|Di|Vl)\\d{1,4})<\/code><\/p>\n<p><code><strong>! Possible warning and other things that deserve attention<\/strong><br \/>\n(?:((E|e)rr(ors|or)?)|reset|act\/unsup|dhcp|DHCP|mismatch|drop(s|ped|ping)?|runts|CRC|collision(s)?|LRN|learning|listening|LIS|unsynchronized|(R|r)eason|SYN(SENT|RCVD))<br \/>\n(?:Peer\\(STP\\)|Shr|pvst|ieee|mstp|Bound\\(PVST\\)|INIT|TFTP|Mbgp|LAPB|l2ckt\\(\\d{1,10}\\)|DCE|DTE|passive|\\[ANY\\]|RIB\\-failure|discriminator|Standby|disable(d)?|unnumbered)<br \/>\n(?:aggregate(d|\\\/\\w*)|atomic\\-aggregate|\\[V\\]|ATTEMPT|INIT|2WAY|EXCHANGE|LOADING|\\(global\\)|(T|t)ag|key-chain|backup\\\/repair|repair|v2\\\/D|v2\\\/SD|(W|w)arning)<br \/>\n(?:Condition\\-map|Advertise\\-map|no\\-advertise|no\\-export|local\\-AS|internet|reached\\(\\d*\\)|n-802.1q|monitoring|inactive|config(.*)?\\)|notconnec(t)?|notifications)<\/code><\/p>\n<p><code><strong>! Bad responses<\/strong><br \/>\n(?:(D|d)own|DOWN|(F|f)ail(ed|ure)?|not(.*)?|bad|never|BLK|fddi|n\\-isl|isl|blocking|\\(tdp\\)|tdp|TDP|(I|i)nvalid|err\\-disable(d)?|unusable|a\\-half|half|a\\-10|\\(SD\\)|\\(D\\))<br \/>\n(?:denied|DENIED|deny|infinity|inaccessible|\\*ROOT_Inc|BKN\\*|\\*LOOP_Inc|wrong|<br \/>\nK[2456]=1|cannot|MM_NO_STATE|MM_KEY_EXCH|UP\\-NO\\-IKE|Idle|ERROR:)<\/code><\/p>\n<p><code><strong>! Good responses<\/strong><br \/>\n(?:rstp|best|CIST|QM_IDLE|(IP|L|CDP)CP\\+|CHAP\\+|PAP\\+|(IP|L|CDP)CP\\[Open\\]|our_master|UP\\-ACTIVE|permit|(G|g)ood|(O|o)k|uptime|0x2102|0x102|0xF|Established|ESTAB|enable(d)?|READY|AUTHORIZED|SUCCESS(FUL)?|CONNECT(ION|ED)?)<br \/>\n(?:\\*\\&gt;|FWD|(R|r)oot|802\\.1q|dot1q|connected|LocalT|yes|\\(SU\\)|\\(RU\\)|\\(bndl\\)|\\(P\\)|forwarding|synchronized|(A|a)ctive|ACTIVE|rapid\\-pvst|(U|u)p|UP|FULL|.*\\.(?:bin|img|pkg|packages\\.conf|vm)|.*\\-mz\\..*)<\/code><\/p>\n<p><code><strong>! Bad - emergancies, alerts, and critical log messages<\/strong><br \/>\n%\\w*\\-[012]\\-\\w*<\/code><\/p>\n<p><code><strong>! BGP<\/strong><br \/>\n(Cost:pre\\-bestpath|0x880\\d):\\d{1,10}:\\d{1,10}<br \/>\n(bgp|BGP|B|IGP|incomplete|\\d{2,7}\\\/nolabel\\(\\w*\\)|RR\\-client|Originato|cluster\\-id|Cluster\\-id|Cluster|Route\\-Reflector)<br \/>\n(%BGP\\-\\d\\-\\w*|%BGP_SESSION\\-\\d\\-\\w*|%ROUTING\\-\\BGP\\-\\d\\-\\w*|%ROUTING\\-\\BGP_VRF\\-\\d\\-\\w*)<\/code><\/p>\n<p><code><strong>! OSPFv2 and OSPFv3<\/strong><br \/>\n(OSPF_VL\\d{1,2}|OSPF_SL\\d{1,2}|VL\\d{1,2}|SL\\d{1,2}|Type\\-\\d|ospf|OSPF|O|IA|E[12]|N[12]|P2P|P2MP|BDR|DR|ABR|ASBR|LOOP)<br \/>\n(DROTHER|POINT_TO_POINT|POINT_TO_MULTIPOINT|BROADCAST|NON_BROADCAST|LOOPBACK|<br \/>\nSHAM_LINK|3101|1587|transit|Transit|nssa|NSSA|stub|Stub|Superbackbone)<br \/>\n(OSPFv3_VL\\d{1,2}|OSPFv3\\-\\d{1,5}\\-IPv6|ospfv3|OSPFv3|OI|OE[12]|ON[12]|V6\\-Bit|E\\-Bit|R\\-bit|DC\\-Bit|opaque|DROTH)<br \/>\n(%OSPF\\-\\d\\-\\w*|%OSPFV3\\-\\d\\-\\w*|%ROUTING\\-OSPF\\-\\d\\-\\w*|%ROUTING\\-OSPFv3_RIB\\-\\d\\-\\w*)<\/p>\n<p><strong>! NHRP and DMVPN<\/strong><br \/>\n(DT[12]|T2|NHRP|H|p|EXp|IX|D\/ur|(multi\\-)?GRE\/IP(v6)?|%DOMAIN\\-\\d\\-\\w*)<\/p>\n<p><strong>! EIGRP<\/strong><br \/>\n(EIGRP\\-(IPv|SFv)(4|6)|eigrp\\-\\w*|eigrp|((IP|IPv6)\\-)?EIGRP|EX|D|K[13]=1|K[2456]=0|(I|i)nternal|(E|e)xternal|VR\\(\\w*\\)|VR\\(#AUTOCFG#\\)|AS\\(\\d{1,5}\\)|Passive)<br \/>\n(%DUAL\\-\\d\\-\\w*|%ROUTING\\-\\EIGRP\\-\\d\\-\\w*)<\/p>\n<p><strong>! RIP<\/strong><br \/>\n(rip|RIP|R)<br \/>\n(%ROUTING-\\-RIP\\-\\d\\-\\w*)<\/p>\n<p><strong>! PIM, MSDP, and IGMP<\/strong><br \/>\n(PIM\\\/IPv4|RP\\:|v2\\\/S|BSR)<br \/>\n(%PIM\\-\\d\\-\\w*|%MSDP\\-\\d\\-\\w*|%IGMP\\-\\d\\-\\w*|%ROUTING\\-IPV4_IGMP\\-\\d\\-\\w*|%ROUTING\\-\\MSDP\\-\\d\\-\\w*)<\/p>\n<p><strong>! Hostnames and prompt<\/strong><br \/>\n(^[A-Za-z0-9\\-\\(\\)_\/:]+\\(|^[A-Za-z0-9\\-\\(\\)_\/:]+#)<\/p>\n<p><strong>! Routing table metrics<\/strong><br \/>\n\\[\\d{1,3}\/\\d{1,12}\\]<\/p>\n<p><strong>! EIGRP topology table metrics and ping responses<\/strong><br \/>\n\\(\\d{1,12}\/\\d{1,12}\\)<\/p>\n<p><strong>! LDP<\/strong><br \/>\n(\\(ldp\\)|ldp|imp\\-null|Pop|Label|Stack)<br \/>\n(%LDP\\-\\d\\-\\w*|%LSD\\-\\d\\-\\w*|%LDP\\-\\d\\-\\w*|%LSD\\-\\d\\-\\w*|%ROUTING\\-LDP\\-\\d\\-\\w*|%ROUTING\\-\\MPLS_TE\\-\\d\\-\\w*)<\/p>\n<p><strong>! IPv6 Neighbor Discovery<\/strong><br \/>\n%IPV6_ND\\-\\d\\-\\w*<\/p>\n<p><strong>! Various log messages I turn green<\/strong><br \/>\n(%AUTHMGR\\-\\d\\-SUCCESS|%DOT1X\\-\\d\\-SUCCESS|%MAB\\-\\d\\-SUCCESS)<\/p>\n<p><strong>! Various log messages I turn red<\/strong><br \/>\n(%AUTHMGR\\-\\d\\-SECURITY_VIOLATION|%AUTHMGR\\-\\d\\-FAIL|%DOT1X\\-\\d\\-FAIL|%MAB\\-\\d\\-FAIL|%CRYPTO\\-\\d\\-RECVD_PKT_NOT_IPSEC)<\/p>\n<p><strong>! Various log messages I turn yellow<\/strong><br \/>\n(%CDP\\-\\d\\-\\w*|%DHCP\\-\\d\\-\\w*|%SPANTREE\\-\\d\\-\\w*|%TDP\\-\\d\\-\\w*|%SW_DAI\\-\\d\\-\\w*|%SW_VLAN\\-\\d\\-\\w*|%SSH\\-\\d\\-\\w*)<br \/>\n(%PM\\-d\\-\\w*|%STORM_CONTROL\\-\\d-\\w*|%PV\\-\\d\\-\\w*|%SPANTREE_FAST\\-\\d\\-\\w*|%TRACK\\-\\d\\-\\w*|%REDUNDANCY\\-\\d\\-\\w*)<br \/>\n(%TRACKING\\-\\d\\-\\w*|%FR_EEK\\-\\d\\-\\w*|%HSRP\\-\\d\\-\\w*|%SNAT\\-\\d\\-\\w*|%SEC\\-\\d\\-\\w*|%IPRT\\-\\d\\-\\w*|%HA_CONFIG_SYNC\\-\\d\\-\\w*)<br \/>\n(%SYS\\-\\d\\-\\w*|%PARSER\\-\\d\\-cfglog\\w*|%ENVMON\\-\\d\\-\\w*|%EC\\-\\d\\-\\w*|%GLDP\\-\\d\\-\\w*|%PLATFORM_PM\\-\\d\\-\\w*)<br \/>\n(%CRYPTO\\-\\d\\-\\w*|%NHRP\\-\\d\\-\\w*|%SNMP\\-\\d\\-\\w*|%CP\\-\\d\\-\\w*|%HA_EM\\-\\d\\-\\w*|%TCP\\-\\d\\-\\w*|%STACKMGR\\-\\d\\-\\w*)<br \/>\n(%IP\\-\\d\\-\\w*|%ADJ\\-\\d\\-\\w*|%IKEV2\\-\\d\\-\\w*|%DHCP_SNOOPING\\-\\d\\-\\w*|%SEC_LOGIN\\-\\d\\-\\w*|%ILPOWER\\-\\d\\-\\w*)<\/p>\n<p><strong><\/strong><strong><strong>! Catch-all for all other log messages<\/strong><br \/>\n%\\w*\\-\\d\\-\\w*<br \/>\n<\/strong><\/p>\n<p><\/code><code><\/code><code><\/code><code><\/code><code><\/code><code><\/code><code><\/code><code><\/code><code><\/code><code><\/code><code><\/code><code><\/code><code><\/code><code><\/code><code><\/code><code><\/code><\/p>\n","protected":false},"excerpt":{"rendered":"<p>Regular Expressions &#8211; For SecureCRT Text Highlighting\u00a0<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[6],"tags":[31,58,59],"class_list":["post-817","post","type-post","status-publish","format-standard","hentry","category-ccie","tag-published","tag-regular-expressions","tag-securecrt"],"_links":{"self":[{"href":"https:\/\/feralpacket.org\/index.php?rest_route=\/wp\/v2\/posts\/817","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/feralpacket.org\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/feralpacket.org\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/feralpacket.org\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/feralpacket.org\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=817"}],"version-history":[{"count":31,"href":"https:\/\/feralpacket.org\/index.php?rest_route=\/wp\/v2\/posts\/817\/revisions"}],"predecessor-version":[{"id":899,"href":"https:\/\/feralpacket.org\/index.php?rest_route=\/wp\/v2\/posts\/817\/revisions\/899"}],"wp:attachment":[{"href":"https:\/\/feralpacket.org\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=817"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/feralpacket.org\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=817"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/feralpacket.org\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=817"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}