BGP Regular Expressions

Unanswered Question
Jan 2nd, 2009
User Badges:

Hellow all of you in the network world i am preparing for ccie R&S and in BGP i am finding understanding regular expressions kind of tricky or u can say i am not able to unerstand it.

Can anyone help me out to get these concept clear.



  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 5 (1 ratings)
scottmac Fri, 01/02/2009 - 11:24
User Badges:
  • Green, 3000 points or more

Regular Expressions are a sort of wildcard that permits you to accept exactly one or more characters in one or several positions in the message.

So you can specify a specific AS or group of AS from the routing string.

Things like a period "." say "accept anything", then there are quantifiers ("how many") like the "+" (zero or more) or the "*" (one or more).

Then there are position markers, usually the "^" (beginning of the line) or the "$" (end of the line)that specifically place the pattern that you want to match i teh line that you are matching against.

You are permitted to specify groups and ranges by putting them in brackets "[xxx]," for example [3-7] specifies any digit in that position that match 3, 4, 5, 6, 7.

REGEX can get complex, the best book I've seen is "Mastering Regular Expressions" by O'Reilly.

Cisco also has some good documentation, search the main site for "regular expression" for specific application in teh Cisco world.

Almost any Perl or other programming site will also have explanations on REGEX.

Was there a specific point of confusion that we can focus on? What concepts are confusing you?

Let us know ...


steve_steele Fri, 01/02/2009 - 14:47
User Badges:
  • Bronze, 100 points or more

Heres a few examples that might help.

Match routes originated in AS 100


The ^ is for the start of string

The _ matches a start of string, end of string, a space or a comma.


Match 100 only.


$ represents the end of the string


Match routes originated in the local autonomous system.


Start of string immediately followed by end of string, an empty string in other words.


Match routes that passed at some point through AS 100


The _ will match start of string, end of string and a space or comma. so we would match "100", "111 100", "111 200 222", "10 100"

we would not match "1000" as the character after the second zero has to match the _


Routes that originated in either AS 100 or 200


Ranges area enclosed in brackets so this basically says "start of string, followed by a number between 1 and 2, followed by 2 zeros, followed by a space,end of string or comma.

Without the underscore at the end we would also match AS's such as 1001,20028 and fail to meet the requirements.


Routes that originated in from any AS between 100 and 199.


The . represents any single character.


Routes that originated in any of AS 1,10,100,1000,10000


The + represents 1 or more instance of the preceding expression.


Routes that originated in either AS

1 or 10


The ? represents zero or more instance of the preceding expression.


Match ony routes that have passed through AS 122 or 12222.


Enclose items in brackets to group together for the trailing sign.

This would match 1222222 also but as the AS value does no go that high we have met the requirements.

They can get a lot more complex than this but mostly they involve putting together pieces similar to the above.



ryel.dsouza Sat, 01/03/2009 - 03:04
User Badges:

what is the difference between "[ ]" & "( )" regular expressions ????



scottmac Sat, 01/03/2009 - 07:12
User Badges:
  • Green, 3000 points or more

"[]" denote a list of desired characters for that position (putting a "^" as the first bracketed character negates .... anything EXCEPT ...)

"()" is used for grouping to make sure the expressions are evaluated in the proper order (from the "most inside" to the "most outside").

In programming language uses of REGEX, the parenthesis also assigns an internal variable ($1 = the first parenthetic match, $2 = the second paren match, and so on), so you can do something like 'if $1="Foo" then ...'

So, "[Cc][aeiou]t" would match cat,Cat,cet,Cet,cit,Cit,cot,Cot,cut, or Cut

and "if ($_=~m/(cat)/concatenate)" would result in $1 being assigned the value "cat" in Perl.

Good Luck


ryel.dsouza Tue, 01/06/2009 - 05:27
User Badges:

What would ^4_[0-9]*$ match

i have understood that the AS path should begin with AS4 followed by this is where i am getting confused a match of 1 or 11 or 111 etc followed by the same way with AS 2 upto AS9 ???

scottmac Tue, 01/06/2009 - 08:14
User Badges:
  • Green, 3000 points or more

^ = Beginning of the LIne

4 = the literal number four

_ = space, comma, beginning or end of a string

[0-9] = any single digit in the range of 0-9

* = the above (single digit 0-9), repeated zero or more times

$ =The end of the line

so it would match {beginning of the line}4{space, comma, string}{any number of digits in the range of 0-9}{End of the line}

Good Luck


ryel.dsouza Sat, 01/03/2009 - 05:24
User Badges:

Steve u said that ^10+_ will match

Routes that originated in any of AS 1,10,100,1000,10000 how come it will match routes originated from AS 1 should it only match routes originated from AS 10,100,1000,10000 only ??? cause + will match one or more instances not zero or more instances !!!

peterlmyers Mon, 02/09/2009 - 05:13
User Badges:

These origin examples are not correct.

If you want to match the origin AS the syntax should be _100$ as it will be at the end of the AS_PATH string, not the beginning.


Marwan ALshawi Mon, 02/09/2009 - 14:15
User Badges:
  • Purple, 4500 points or more
  • Community Spotlight Award,

    Best Publication, December 2015

Hi there

the _100$

means traffic orginated from AS 100

in ther words this means that u can use this to match any traffic going to AS 100

while ^100 .* or ^100_

mens traffic transmeted from AS 100

or sent to you from AS 100 ( sourced from AS 100)

this is the defrences

hope this helps

peterlmyers Mon, 02/09/2009 - 14:27
User Badges:

_100$ means PREFIXES originated from AS100

^100_ will match PREFIXES with a next AS hop of AS100


Marwan ALshawi Mon, 02/09/2009 - 16:14
User Badges:
  • Purple, 4500 points or more
  • Community Spotlight Award,

    Best Publication, December 2015

you are right

for details and simplicity

^100_ | Learned from AS 100

This means that the string must start with the number 100 followed by any non-alphanumeric character. In the scope of BGP this means that routes which are learned from the AS 100 will be matched, as 100 will be the first AS in the path when AS 100 is sending us routes

_100$ | Originated in AS 100

This means that AS 100 is the last AS in the path, or in other words that the prefix in question was originated by AS 100.

Marwan ALshawi Thu, 01/22/2009 - 20:03
User Badges:
  • Purple, 4500 points or more
  • Community Spotlight Award,

    Best Publication, December 2015

mybe you have case that you need to match a directly connected ASs and/or their customers

in this case the following will be the regex



while ? in the above means Zero or one instance

good luck


This Discussion