BGP Regular Expressions Cheat Sheet
Regular expressions are strings of special characters that can be used to search and find character patterns. Within the scope of BGP in Cisco IOS regular expressions can be used in show commands and AS-Path access-lists to match BGP prefixes based on the information contained in their AS-Path. [boxads]
In order to understand how to build regular expressions we first need to know what the character definitions are for the regex function of IOS. The below table illustrates the regex characters and their usage. This information is contained in the Cisco IOS documentation under the Appendix of Cisco IOS Terminal Services Configuration Guide, Release 12.2.
BGP Regular Expressions Cheat Sheet:
To find all subnets originating from AS 100 (AS path ends with 100):
Router# show ip bgp regexp _100$
…
Network            Next Hop           Metric LocPrf Weight Path
*Â 10.1.0.0/30Â Â Â Â Â 172.16.0.6Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â 0 300 100 ?
*>Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â 172.16.0.1Â Â Â Â Â Â Â Â Â Â Â Â Â Â 0Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â 0 100 ?
*Â 172.16.0.0/30Â Â 172.16.0.6Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â 0 300 100 ?
*Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â 172.16.0.1Â Â Â Â Â Â Â Â Â Â Â Â Â Â 0Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â 0 100 ?
…
To find all subnets reachable via AS 100 (AS path begins with 100):
Router# show ip bgp regexp ^100_ ... Network Next Hop Metric LocPrf Weight Path *> 10.1.0.0/30 172.16.0.1 0 0 100 ? * 10.3.0.0/30 172.16.0.1 0 100 300 ? * 172.16.0.0/30 172.16.0.1 0 0 100 ? *> 172.16.0.8/30 172.16.0.1 0 0 100 ? ...
To find all routes traversing AS 100:
Router# show ip bgp regexp _100_ ... Network Next Hop Metric LocPrf Weight Path * 10.1.0.0/30 172.16.0.6 0 300 100 ? *> 172.16.0.1 0 0 100 ? * 10.3.0.0/30 172.16.0.1 0 100 300 ? * 172.16.0.0/30 172.16.0.6 0 300 100 ? ...
If you need to further filter the output, use quote-regexp
instead. For example, to find all 172.x.x.x routes originating from AS 100:
Router# show ip bgp quote-regexp "_100$" | include ^. 172\. * 172.16.0.0/30 172.16.0.6 0 300 100 ? * 172.31.0.1/32 172.16.0.6 0 300 100 ?
Or, to find all subnets currently being reached via AS 100:
Router# show ip bgp quote-regexp "^100_" | i ^.> *> 10.1.0.0/30 172.16.0.1 0 0 100 ? *> 172.16.0.8/30 172.16.0.1 0 0 100 ? *> 172.31.0.1/32 172.16.0.1 0 0 100 ? [bodyads]
BGP Regular Expressions Cheat Sheet Examples:
3-1-1, Filtering bgp output with route only origin from AS7018
Cisco Router#sh ip bgp regexp ^7018$
BGP table version is 199154652, local router ID is x.x.x.x
Status codes: s suppressed, d damped, h history, * valid, > best, i – internal,
r RIB-failure, S Stale
Origin codes: i – IGP, e – EGP, ? – incomplete
Network                Next Hop           Metric LocPrf Weight Path
*>i3.51.92.0/23Â Â Â Â 12.122.126.39Â Â Â Â Â Â Â Â Â Â 10Â Â Â 100Â Â Â Â Â Â Â Â Â Â Â Â 0 7018 ?
* i                           12.122.126.39          10   100             0 7018 ?
*>i12.0.0.0/9Â Â Â Â Â Â Â 12.122.126.39Â Â Â Â Â Â Â Â Â Â 10Â Â Â 100Â Â Â Â Â Â Â Â Â Â Â Â 0 7018 i
* i                      12.122.126.39          10   100            0 7018 i
*>i12.0.0.0Â Â Â Â Â Â Â Â Â 12.122.126.39Â Â Â Â Â Â Â Â Â Â 10Â Â Â 100Â Â Â Â Â Â Â Â Â Â Â Â 0 7018 i
:
3-1-2, Filtering bgp output with route origin from AS46164
Cisco Router#sh ip bgp regexp _46164$
BGP table version is 199155849, local router ID is x.x.x.x
Status codes: s suppressed, d damped, h history, * valid, > best, i – internal,
r RIB-failure, S Stale
Origin codes: i – IGP, e – EGP, ? – incomplete
Network         Next Hop           Metric LocPrf Weight Path
* i4.23.88.0/24Â 12.122.126.39Â Â Â Â Â Â Â Â Â Â 10Â Â Â 100Â Â Â Â Â Â Â 0Â Â Â Â 7018 46164 i
*>i                   12.122.126.39          10   100       0   7018 46164 i
*>i4.23.88.0/23 12.122.126.39Â Â Â Â Â Â Â Â Â Â 10Â Â Â 100Â Â Â Â Â Â 0 Â Â 7018 46164 i
:
3-2, Filtering bgp output with route pass thru AS46164
Cisco Router#sh ip bgp regexp _6762_
BGP table version is 199165809, local router ID is x.x.x.x
Status codes: s suppressed, d damped, h history, * valid, > best, i – internal,
r RIB-failure, S Stale
Origin codes: i – IGP, e – EGP, ? – incomplete
Network              Next Hop           Metric LocPrf Weight Path
*>i2.0.0.0/16Â Â 144.228.243.250Â Â Â Â Â Â Â Â 10Â Â Â 100Â Â Â Â Â Â Â Â 0 1239 6762 12654 i
* i                       144.228.243.250        10   100       0 1239 6762 12654 i
*>i2.1.0.0/21Â Â 144.228.243.250Â Â Â Â Â Â Â Â 10Â Â Â 100Â Â Â Â Â Â Â Â Â Â Â Â 0 1239 6762 12654 i
* i                   144.228.243.250        10   100            0 1239 6762 12654 i
3-4, Filtering bgp output with route only origin from AS1239 and directly attached with AS1239
Cisco Router#sh ip bgp regexp ^1239_[0-9]*$
BGP table version is 199175215, local router ID is x.x.x.x
Status codes: s suppressed, d damped, h history, * valid, > best, i – internal,
r RIB-failure, S Stale
Origin codes: i – IGP, e – EGP, ? – incomplete
Network                Next Hop          Metric LocPrf Weight Path
*>i8.3.213.0/24Â Â Â Â 144.228.243.250Â Â Â 10Â Â Â Â Â Â 100Â Â Â Â Â Â 0 1239 4739 i
* i                      144.228.243.250   10    100      0 1239 4739 i
*>i8.10.245.0/24Â 144.228.243.250Â Â Â 10Â Â Â Â Â Â 100Â Â Â Â Â Â 0 1239 17151 i
* i                      144.228.243.250   10      100      0 1239 17151 i
 3-5, Filtering bgp output with route origin from AS46164
Cisco Router#sh ip bgp regexp ^1239$
BGP table version is 199175920, local router ID is x.x.x.x
Status codes: s suppressed, d damped, h history, * valid, > best, i – internal,
r RIB-failure, S Stale
Origin codes: i – IGP, e – EGP, ? – incomplete
Network                    Next Hop             Metric LocPrf Weight Path
*>i12.70.138.0/24Â Â 144.228.243.250Â Â Â Â Â Â Â Â 10Â Â Â Â Â Â 100Â Â Â Â Â Â Â 0 1239 i
* i                       144.228.243.250        10      100         0 1239 i
*>i12.195.4.0/24Â Â Â 144.228.243.250Â Â Â Â Â Â Â Â 10Â Â Â Â Â Â Â 100Â Â Â Â Â Â 0 1239 i
 3-6, Filtering bgp output with route learning from AS1239
Cisco Router#sh ip bgp regexp ^1239_
BGP table version is 199177194, local router ID is x.x.x.x
Status codes: s suppressed, d damped, h history, * valid, > best, i – internal,
r RIB-failure, S Stale
Origin codes: i – IGP, e – EGP, ? – incomplete
Network                Next Hop           Metric LocPrf Weight Path
*>i2.0.0.0/16Â Â Â Â Â Â 144.228.243.250Â Â Â Â Â Â 10Â Â Â Â Â 100Â Â Â Â Â Â Â Â Â Â 0 1239 6762 12654 i
* i                         144.228.243.250      10     100       0 1239 6762 12654 i
*>i2.1.0.0/21Â Â Â Â Â Â 144.228.243.250Â Â Â Â Â Â 10Â Â Â Â Â 100Â Â Â Â Â Â Â 0 1239 6762 12654 i
 3-7, Filtering bgp output with route only direct connected ASs
Cisco Router#sh ip bgp regexp ^[0-9]+$
BGP table version is 199177786, local router ID is x.x.x.x
Status codes: s suppressed, d damped, h history, * valid, > best, i – internal,
r RIB-failure, S Stale
Origin codes: i – IGP, e – EGP, ? – incomplete
Network                Next Hop          Metric LocPrf Weight Path
*>i3.51.92.0/23Â Â Â Â 12.122.126.39Â Â Â Â Â Â Â Â Â Â 10Â Â Â 100Â Â Â Â Â Â Â Â 0Â 7018 ?
* i                      12.122.126.39          10   100             0 7018 ?
*>i4.0.0.0/9Â Â Â Â Â Â Â Â Â Â Â Â 4.68.185.60Â Â Â Â Â Â Â Â Â Â Â Â 10Â Â Â 100Â Â Â Â Â Â Â Â Â Â Â Â Â 0Â 3356 i
3-8, Filtering bgp output with route only direct connected ASN with letter 1, 7 and 4
Cisco Router#sh ip bgp regexp ^[174]+$
BGP table version is 199179097, local router ID is x.x.x.x
Status codes: s suppressed, d damped, h history, * valid, > best, i – internal,
r RIB-failure, S Stale
Origin codes: i – IGP, e – EGP, ? – incomplete
Network         Next Hop             Metric LocPrf Weight Path
*>i24.238.0.0/24Â Â Â 154.54.13.137Â Â Â Â Â 10Â Â Â Â Â Â 100Â Â Â Â Â Â Â Â Â 0 174 i
* i                      154.54.13.137      10     100       0 174 i
*>i24.238.2.0/24Â Â Â 154.54.13.137Â Â Â Â Â Â 10Â Â Â Â Â 100Â Â Â Â Â Â Â Â Â 0 714 i
* i                      154.54.13.137      10     100     0 714 i
[bodylink]
3-9, Filtering bgp output with route origin from AS46164 and thru AS7018
Cisco Router#sh ip bgp reg ^7018_46164$
BGP table version is 199190289, local router ID is x.x.x.x
Status codes: s suppressed, d damped, h history, * valid, > best, i – internal,
r RIB-failure, S Stale
Origin codes: i – IGP, e – EGP, ? – incomplete
Network               Next Hop        Metric LocPrf Weight Path
* i4.23.88.0/24Â Â Â Â 12.122.126.39Â Â Â Â Â Â 10Â Â Â 100Â Â Â Â Â Â Â 0Â Â 7018 46164 i
*>i                          12.122.126.39      10   100         0  7018 46164 i
*>i4.23.88.0/23Â Â 12.122.126.39Â Â Â Â Â Â Â 10Â Â Â 100Â Â Â Â Â Â Â Â Â 0Â Â 7018 46164 i
* i                           12.122.126.39      10   100         0  7018 46164 i
 3-10, Filtering bgp output with route locally origin
Cisco Router#sh ip bgp reg ^$
BGP table version is 199192287, local router ID is x.x.x.x
Status codes: s suppressed, d damped, h history, * valid, > best, i – internal,
r RIB-failure, S Stale
Origin codes: i – IGP, e – EGP, ? – incomplete
Network                Next Hop              Metric LocPrf Weight Path
*>i4.68.62.96/30Â Â Â 140.222.130.48Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â 100Â Â Â Â Â Â 0 i
* i                              140.222.130.48                  100       0 i
*>i4.68.63.140/30Â 140.222.130.48Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â 100Â Â Â Â Â Â Â Â Â Â 0 i
* i                              140.222.130.48                     100       0 i