Reputation: 13
Example Inputs
1 0.000000 10.19.20.105 -> 74.125.236.200 ICMP 74 Echo (ping) request id=0x000a, seq=51187/62407, ttl=128
6 0.097977 74.125.236.194 -> 10.19.20.105 ICMP 74 Echo (ping) reply id=0x000b, seq=62844/31989, ttl=57 (request in 2)
7 0.131456 74.125.236.198 -> 10.19.20.105 ICMP 74 Echo (ping) reply id=0x000b, seq=62845/32245, ttl=57 (request in 3)
8 0.143539 74.125.236.196 -> 10.19.20.105 ICMP 74 Echo (ping) reply id=0x000b, seq=62847/32757, ttl=57 (request in 5)
9 0.160567 74.125.236.192 -> 10.19.20.105 ICMP 74 Echo (ping) reply id=0x000b, seq=62846/32501, ttl=57 (request in 4)
10 0.177972 10.19.20.172 -> 10.19.20.255 NBNS 92 Name query NB INDERPAL-PC<1c>
11 0.270418 10.19.20.105 -> 74.125.236.194 ICMP 74 Echo (ping) request id=0x000b, seq=62848/33013, ttl=128
12 0.318404 10.19.20.105 -> 74.125.236.194 ICMP 74 Echo (ping) request id=0x000b, seq=62849/33269, ttl=128
13 0.330236 74.125.236.194 -> 10.19.20.105 ICMP 74 Echo (ping) reply id=0x000b, seq=62848/33013, ttl=57 (request in 11)
14 0.376039 74.125.236.194 -> 10.19.20.105 ICMP 74 Echo (ping) reply id=0x000b, seq=62849/33269, ttl=57 (request in 12)
17 0.397384 10.19.20.105 -> 74.125.236.195 ICMP 74 Echo (ping) request id=0x000b, seq=62852/34037, ttl=128
18 0.438108 74.125.236.200 -> 10.19.20.105 ICMP 74 Echo (ping) reply id=0x000b, seq=62850/33525, ttl=57 (request in 15)
19 0.444489 10.19.20.105 -> 74.125.236.196 ICMP 74 Echo (ping) request id=0x000b, seq=62853/34293, ttl=128
21 0.463515 74.125.236.195 -> 10.19.20.105 ICMP 74 Echo (ping) reply id=0x000b, seq=62852/34037, ttl=57 (request in 17)
22 0.475425 10.19.20.105 -> 74.125.236.197 ICMP 74 Echo (ping) request id=0x000b, seq=62854/34549, ttl=128
25 0.522472 74.125.236.197 -> 10.19.20.105 ICMP 74 Echo (ping) reply id=0x000b, seq=62854/34549, ttl=57 (request in 22)
26 0.535794 Giga-Byt_5d:06:ac -> Broadcast ARP 60 Who has 10.19.20.74? Tell 10.19.20.94
27 0.537735 Giga-Byt_a0:ad:23 -> Broadcast ARP 60 Who has 10.19.20.94? Tell 10.19.20.74
28 0.550321 10.19.20.105 -> 74.125.200.95 TCP 55 58240→80 [ACK] Seq=1 Ack=1 Win=16402 Len=1
29 0.574957 JetwayIn_a0:b1:a2 -> Broadcast ARP 60 Who has 10.19.20.180? Tell 10.19.20.172
30 0.584448 74.125.236.195 -> 10.19.20.105 ICMP 74 Echo (ping) reply id=0x000b, seq=62855/34805, ttl=57 (request in 24)
public class DataGridClass
{
public int SerialNumber { get; set; }
public string Time { get; set; }
public string DestinationIP { get; set; }
public string SourceIP { get; set; }
public string Protocol { get; set; }
public int Length { get; set; }
public string Info { get; set; }
}
Desired Output
SerialNumber = 1
Time = "0.000000"
DestinationIP = "10.19.20.105"
SourceIP = "74.125.236.200"
Protocol = "ICMP"
Length = 74
Info = "Echo (ping) request id=0x000a, seq=51187/62407, ttl=128"
I'm unable to split with white space as the string is inconsistent and secondly number of white space may increase or decrease
Thanks in advance
Update:
26, 27 are different from other's
Upvotes: 1
Views: 314
Reputation: 154
I would use regex as well
^(\d+)\s+(\S+)\s+(\S+)\s*->\s*(\S+)\s+(\S+)\s+(\d+)(.*)$
start (serial number) one or more white space (time) one or more white space (destination IP) zero or more white space -> zero or more white space (source IP) one or more white space (protocol) one or more white space (length) one or more white space (info) end
class Program
{
static void Main(string[] args)
{
string []inputs = {@"1 0.000000 10.19.20.105 -> 74.125.236.200 ICMP 74 Echo (ping) request id=0x000a, seq=51187/62407, ttl=128",
@"6 0.097977 74.125.236.194 -> 10.19.20.105 ICMP 74 Echo (ping) reply id=0x000b, seq=62844/31989, ttl=57 (request in 2)",
@"7 0.131456 74.125.236.198 -> 10.19.20.105 ICMP 74 Echo (ping) reply id=0x000b, seq=62845/32245, ttl=57 (request in 3)",
@"8 0.143539 74.125.236.196 -> 10.19.20.105 ICMP 74 Echo (ping) reply id=0x000b, seq=62847/32757, ttl=57 (request in 5)",
@"9 0.160567 74.125.236.192 -> 10.19.20.105 ICMP 74 Echo (ping) reply id=0x000b, seq=62846/32501, ttl=57 (request in 4)",
@"10 0.177972 10.19.20.172 -> 10.19.20.255 NBNS 92 Name query NB INDERPAL-PC<1c>",
@"11 0.270418 10.19.20.105 -> 74.125.236.194 ICMP 74 Echo (ping) request id=0x000b, seq=62848/33013, ttl=128",
@"12 0.318404 10.19.20.105 -> 74.125.236.194 ICMP 74 Echo (ping) request id=0x000b, seq=62849/33269, ttl=128",
@"13 0.330236 74.125.236.194 -> 10.19.20.105 ICMP 74 Echo (ping) reply id=0x000b, seq=62848/33013, ttl=57 (request in 11)",
@"14 0.376039 74.125.236.194 -> 10.19.20.105 ICMP 74 Echo (ping) reply id=0x000b, seq=62849/33269, ttl=57 (request in 12)",
@"17 0.397384 10.19.20.105 -> 74.125.236.195 ICMP 74 Echo (ping) request id=0x000b, seq=62852/34037, ttl=128",
@"18 0.438108 74.125.236.200 -> 10.19.20.105 ICMP 74 Echo (ping) reply id=0x000b, seq=62850/33525, ttl=57 (request in 15)",
@"19 0.444489 10.19.20.105 -> 74.125.236.196 ICMP 74 Echo (ping) request id=0x000b, seq=62853/34293, ttl=128",
@"21 0.463515 74.125.236.195 -> 10.19.20.105 ICMP 74 Echo (ping) reply id=0x000b, seq=62852/34037, ttl=57 (request in 17)",
@"22 0.475425 10.19.20.105 -> 74.125.236.197 ICMP 74 Echo (ping) request id=0x000b, seq=62854/34549, ttl=128",
@"25 0.522472 74.125.236.197 -> 10.19.20.105 ICMP 74 Echo (ping) reply id=0x000b, seq=62854/34549, ttl=57 (request in 22)",
@"26 0.535794 Giga-Byt_5d:06:ac -> Broadcast ARP 60 Who has 10.19.20.74? Tell 10.19.20.94",
@"27 0.537735 Giga-Byt_a0:ad:23 -> Broadcast ARP 60 Who has 10.19.20.94? Tell 10.19.20.74",
@"28 0.550321 10.19.20.105 -> 74.125.200.95 TCP 55 58240→80 [ACK] Seq=1 Ack=1 Win=16402 Len=1",
@"29 0.574957 JetwayIn_a0:b1:a2 -> Broadcast ARP 60 Who has 10.19.20.180? Tell 10.19.20.172",
@"30 0.584448 74.125.236.195 -> 10.19.20.105 ICMP 74 Echo (ping) reply id=0x000b, seq=62855/34805, ttl=57 (request in 24)",
};
List<DataGridClass> data = new List<DataGridClass>();
Match match;
foreach (var item in inputs)
{
match = Regex.Match(item, @"^(\d+)\s+(\S+)\s+(\S+)\s*->\s*(\S+)\s+(\S+)\s+(\d+)(.*)$");
if (match.Success )
{
data.Add(new DataGridClass {
SerialNumber = Convert.ToInt32(match.Groups[1].Value),
Time = match.Groups[2].Value,
DestinationIP = match.Groups[3].Value,
SourceIP = match.Groups[4].Value,
Protocol = match.Groups[5].Value,
Length = Convert.ToInt32(match.Groups[6].Value),
Info = match.Groups[7].Value,
});
}
}
if (data.Count > 0)
{
foreach (var item in data)
{
Console.WriteLine(String.Format("SN: {0}, T: {1}, DIP: {2}, SIP: {3}, P: {4}, L: {5}, I: {6}",
item.SerialNumber, item.Time, item.DestinationIP, item.SourceIP, item.Protocol, item.Length, item.Info));
}
}
Console.ReadLine();
}
}
public class DataGridClass
{
public int SerialNumber { get; set; }
public string Time { get; set; }
public string DestinationIP { get; set; }
public string SourceIP { get; set; }
public string Protocol { get; set; }
public int Length { get; set; }
public string Info { get; set; }
}
Upvotes: 0
Reputation: 3256
To solve the problem if inconsistent white space, use:
var items = test.Split(new char[] {' '}, StringSplitOptions.RemoveEmptyEntries);
Luckily, all of your data is in a consistent order and doesn't contain random spaces within the data. So, given the items taken per the split above, you should find that the below always assigns correctly:
var dataGrid = new DataGridClass();
dataGrid.SerialNumber = int.Parse(items[0]);
dataGrid.Time = items[1];
dataGrid.SourceIP = items[2];
dataGrid.DestinationIP = items[4]; // Not a typo, we have to skip the ->
dataGrid.Protocol = items[5];
dataGrid.Length = int.Parse(items[6]);
datagrid.Info = string.Join(" ", items.Skip(7));
I tried to be clever with Info, but if it doesn't work like I think it would, feel free to simply say:
for (int i = 7; i < items.Length; ++i)
{
dataGrid.Info += items[i] + " ";
}
Upvotes: 0
Reputation: 1497
Try this:
(^\d*) SerialNumber = 1
(\s\d*[.]\d*\s) Time = "0.000000"
\b\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\b - [0] - first IP, [1] - second IP
DestinationIP = "10.19.20.105"
SourceIP = "74.125.236.200"
([A-Z]{2,}) Protocol = "ICMP"
(\s\d{1,}\s) Length = 74
((Echo).*) Info = "Echo (ping) request id=0x000a, seq=51187/62407, ttl=128"
Upvotes: 1
Reputation:
You could just use a regex. This seems to work for your data.
Note - if Dot-net supports it, use horizontal tab \h+
in place of all the \s+
below.
# @"(?m)^(\S+)\s+(\S+)\s+(\S+)\s+(\S+)\s+(\S+)\s+(\S+)\s+(\S+)\s+(.*)"
(?m)
^
( \S+ ) # (1), Serial Number
\s+
( \S+ ) # (2), Time
\s+
( \S+ ) # (3), Destination IP
\s+
( \S+ ) # (4), ->
\s+
( \S+ ) # (5), Source IP
\s+
( \S+ ) # (6), Protocol
\s+
( \S+ ) # (7), Length
\s+
( .* ) # (8), Info
Output Sample for lines 1, 26, 27
** Grp 0 - ( pos 0 , len 108 )
1 0.000000 10.19.20.105 -> 74.125.236.200 ICMP 74 Echo (ping) request id=0x000a, seq=51187/62407, ttl=128
** Grp 1 - ( pos 0 , len 1 )
1
** Grp 2 - ( pos 4 , len 8 )
0.000000
** Grp 3 - ( pos 13 , len 12 )
10.19.20.105
** Grp 4 - ( pos 26 , len 2 )
->
** Grp 5 - ( pos 29 , len 14 )
74.125.236.200
** Grp 6 - ( pos 44 , len 4 )
ICMP
** Grp 7 - ( pos 49 , len 2 )
74
** Grp 8 - ( pos 52 , len 56 )
Echo (ping) request id=0x000a, seq=51187/62407, ttl=128
--------------------------------
** Grp 0 - ( pos 1873 , len 93 )
26 0.535794 Giga-Byt_5d:06:ac -> Broadcast ARP 60 Who has 10.19.20.74? Tell 10.19.20.94
** Grp 1 - ( pos 1873 , len 2 )
26
** Grp 2 - ( pos 1878 , len 8 )
0.535794
** Grp 3 - ( pos 1887 , len 17 )
Giga-Byt_5d:06:ac
** Grp 4 - ( pos 1905 , len 2 )
->
** Grp 5 - ( pos 1908 , len 9 )
Broadcast
** Grp 6 - ( pos 1921 , len 3 )
ARP
** Grp 7 - ( pos 1925 , len 2 )
60
** Grp 8 - ( pos 1928 , len 38 )
Who has 10.19.20.74? Tell 10.19.20.94
----------------------------
** Grp 0 - ( pos 1968 , len 93 )
27 0.537735 Giga-Byt_a0:ad:23 -> Broadcast ARP 60 Who has 10.19.20.94? Tell 10.19.20.74
** Grp 1 - ( pos 1968 , len 2 )
27
** Grp 2 - ( pos 1973 , len 8 )
0.537735
** Grp 3 - ( pos 1982 , len 17 )
Giga-Byt_a0:ad:23
** Grp 4 - ( pos 2000 , len 2 )
->
** Grp 5 - ( pos 2003 , len 9 )
Broadcast
** Grp 6 - ( pos 2016 , len 3 )
ARP
** Grp 7 - ( pos 2020 , len 2 )
60
** Grp 8 - ( pos 2023 , len 38 )
Who has 10.19.20.94? Tell 10.19.20.74
Upvotes: 1