Categories

Category cover

Automation
155 posts

Category cover

Learning paths
119 posts

Category cover

CISO
22 posts

Category cover

Security
20 posts

Category cover

Notes
19 posts

Category cover

Personal Security
18 posts

Category cover

Infrastructure
12 posts

Category cover

OT/ICS
5 posts

Category cover

Books
3 posts

Category cover

UNetLab
3 posts

Category cover

Write-up
3 posts

Category cover

OSInt
2 posts

Category cover

My life
1 posts

TextFSM: parsing non-tabular text

Andrea Dainese
May 31, 2025
Post cover

Many network devices provide two commands to retrieve specific information: the first command returns a summarized output in tabular format,

Many network devices provide two commands to retrieve specific information: the first command returns a summarized output in tabular format, while the second command provides a more detailed view, typically in a non-tabular format where each entry is separated into a specific section.

Although the tabular format is more human-readable, non-tabular text is significantly easier for a machine to interpret.

Let’s look at an example: the show interfaces command displays detailed information about the interfaces configured on a switch.

The first step is to identify the pieces of information we’re interested in, each of which must be associated with a RegEx. Here are a few examples:

  • Interface, which is mandatory and serves as the key: \w+/\d+/\d+
  • Bandwidth, which is a string delimited by a comma: [^,]+
  • Description, which is a generic string ending at the end of the line: .+
  • Line status, which is one of several possible strings: up|down|administratively down
  • MAC address, which consists of three hexadecimal sequences separated by dots: ([0-9a-f.]{4}.){2}[0-9a-f]{4}
  • MTU, which is a number: \d+
  • Protocol status, which is one of several possible strings: up|down
  • Interface type, which is a string delimited by a comma: [^,]+

Continue reading the post on Patreon .