使用AWK打印來自兩個不同字段分隔符的值？

Question

我有以下的（有些微調）從nmap的日誌文件：

Host: 111.111.111.5() Ports: 139/open/tcp//netbios-ssn///, 445/open/tcp//microsoft-ds//Windows XP microsoft-ds/ 
Host: 111.111.111.10() Ports: 139/open/tcp//netbios-ssn///, 445/open/tcp//microsoft-ds//Windows Server 2003 3790 Service Pack 2 microsoft-ds/ 
Host: 111.111.111.31() Ports: 139/open/tcp//netbios-ssn///, 445/open/tcp//microsoft-ds//Windows Server 2003 3790 Service Pack 1 microsoft-ds/ 
Host: 111.111.111.73() Ports: 139/open/tcp//netbios-ssn///, 445/open/tcp//microsoft-ds//Windows 7 Professional 7601 Service Pack 1 microsoft-ds/ 
Host: 111.111.111.128() Ports: 139/open/tcp//netbios-ssn///, 445/open/tcp//microsoft-ds//Windows 2000 microsoft-ds/ 
Host: 111.111.111.145() Ports: 139/open/tcp//netbios-ssn///, 445/open/tcp//microsoft-ds//Windows Server (R) 2008 Standard 6001 Service Pack 1 microsoft-ds/ 
Host: 111.111.111.202() Ports: 139/open/tcp//netbios-ssn///, 445/open/tcp//microsoft-ds//Windows 2000 microsoft-ds/ 
Host: 111.111.111.218() Ports: 139/open/tcp//netbios-ssn///, 445/open/tcp//microsoft-ds//Windows 7 Professional 7601 Service Pack 1 microsoft-ds/ 
Host: 111.111.111.220() Ports: 139/open/tcp//netbios-ssn///, 445/open/tcp//microsoft-ds//Windows Server 2008 R2 Standard 7601 Service Pack 1 microsoft-ds/ 
Host: 111.111.111.221() Ports: 139/open/tcp//netbios-ssn///, 445/open/tcp//microsoft-ds//Windows Server (R) 2008 Standard 6001 Service Pack 1 microsoft-ds/ 
Host: 111.111.111.223() Ports: 139/open/tcp//netbios-ssn///, 445/open/tcp//microsoft-ds//Windows Server (R) 2008 Standard 6001 Service Pack 1 microsoft-ds/ 
Host: 111.111.111.227() Ports: 139/open/tcp//netbios-ssn///, 445/open/tcp//microsoft-ds//Windows 2000 microsoft-ds/ 
Host: 111.111.111.229() Ports: 139/open/tcp//netbios-ssn//Windows Server 2003 3790 Service Pack 1 netbios-ssn/, 445/filtered/tcp//microsoft-ds/// 
Host: 111.111.111.230() Ports: 139/open/tcp//netbios-ssn///, 445/open/tcp//microsoft-ds//Windows 7 Ultimate N 7600 microsoft-ds/ 

我試圖用awk打印出來的IP，然後機器類型。一個例子輸出將如下所示：

111.111.111.5的Windows XP

使用AWK我已經提取的IP地址和一些信息：

cat smb-sweep-oG.txt | awk '/Windows/ {print $2 " " $6}' 

不過我需要使用不同的字段分隔符來提取我相信的操作系統信息？有沒有辦法解決這個問題，而不創建專用於該任務的Python腳本？

Answer 1

像這樣：

awk -F\/ '{sub(/^[^ ]+ /,"",$1); sub(/ .*/,"", $1); sub(/ [^ ]*$/,"",$(NF-1)); print $1, $(NF-1)}' File 

111.111.111.5 Windows XP 
111.111.111.10 Windows Server 2003 3790 Service Pack 2 
111.111.111.31 Windows Server 2003 3790 Service Pack 1 
111.111.111.73 Windows 7 Professional 7601 Service Pack 1 
111.111.111.128 Windows 2000 
111.111.111.145 Windows Server (R) 2008 Standard 6001 Service Pack 1 
111.111.111.202 Windows 2000 
111.111.111.218 Windows 7 Professional 7601 Service Pack 1 
111.111.111.220 Windows Server 2008 R2 Standard 7601 Service Pack 1 
111.111.111.221 Windows Server (R) 2008 Standard 6001 Service Pack 1 
111.111.111.223 Windows Server (R) 2008 Standard 6001 Service Pack 1 
111.111.111.227 Windows 2000 
111.111.111.229 
111.111.111.230 Windows 7 Ultimate N 7600 

在第二最後一行..服務器名稱出現在不同的位置，因此在輸出不打印。因此，在情況下，服務器名稱可能出現在任何兩個位置，那麼你可以去：

awk -F\/ '{sub(/^[^ ]+ /,"",$1); sub(/ .*/,"",$1); sub(/ [^ ]*$/,"",$(NF-1)); sub(/ [^ ]*$/,"",$7); print $1, $(NF-1), $7}' File 

111.111.111.5 Windows XP 
111.111.111.10 Windows Server 2003 3790 Service Pack 2 
111.111.111.31 Windows Server 2003 3790 Service Pack 1 
111.111.111.73 Windows 7 Professional 7601 Service Pack 1 
111.111.111.128 Windows 2000 
111.111.111.145 Windows Server (R) 2008 Standard 6001 Service Pack 1 
111.111.111.202 Windows 2000 
111.111.111.218 Windows 7 Professional 7601 Service Pack 1 
111.111.111.220 Windows Server 2008 R2 Standard 7601 Service Pack 1 
111.111.111.221 Windows Server (R) 2008 Standard 6001 Service Pack 1 
111.111.111.223 Windows Server (R) 2008 Standard 6001 Service Pack 1 
111.111.111.227 Windows 2000 
111.111.111.229 Windows Server 2003 3790 Service Pack 1 
111.111.111.230 Windows 7 Ultimate N 7600 

如果你想過濾出Windows部分：

awk -F\/ '/Windows/ {sub(/^[^ ]+ /,"",$1); sub(/ .*/,"",$1); sub(/ [^ ]*$/,"",$(NF-1)); sub(/ [^ ]*$/,"",$7); print $1, $(NF-1), $7}' File 

Answer 2

作爲一種替代方案，將與所有線路的工作，因爲你要打印的系統信息始終是最後一個字段（$ NF）：

$ a="Host: 111.111.111.230() Ports: 139/open/tcp//netbios-ssn///, 445/open/tcp//microsoft-ds//Windows 7 Ultimate N 7600 microsoft-ds/" 
$ awk -F'/' '{split($1,f," ");print f[2],$(NF-1)}' <<<"$a" 
#output 
111.111.111.230 Windows 7 Ultimate N 7600 microsoft-ds 

順便說一句，你可以在GNU AWK裏使用多個分隔符關鍵字：

$ a="Host: 111.111.111.5() Ports: 139/open/tcp//netbios-ssn///, 445/open/tcp//microsoft-ds//Windows XP microsoft-ds/" 
$ awk -F"[ //]" '{print $2,$20,$21,$22}' <<<"$a" #delimiter is space and // 
#output: 
111.111.111.5 Windows XP microsoft-ds 

但是在文件中，第二種方法將無法正常工作，因爲文檔結構在所有行中都不相同。

Answer 3

awk中的替代方法。刪除最後一個字段（$NF），printf$6（= Windows）的最後部分以及之後的所有內容。沒有必要撥弄FS：

$ awk ' 
{ 
    NF--; $0=$0       # remove last field 
    n=split($6,a,"/")      # split $6 by /s 
    printf "%s %s ", $2,a[n]    # output last a[] 
    for(i=7; i<=NF; i++)     # iterate the rest of fields 
     printf "%s%s", $i, (i<NF?OFS:ORS) # output 
}' foo 
111.111.111.5 Windows XP 
111.111.111.10 Windows Server 2003 3790 Service Pack 2 
111.111.111.31 Windows Server 2003 3790 Service Pack 1