For example, I have a MAC address which i know is the MAC address on one of the interfaces. However when I search to what interface the MAC address belongs, it does not show me to what interface it belongs as this is on a separate line.

When using grep to go through a router config I can use grep -5 [MAC ADDRESS] to show 5 lines above and 5 lines below the line on which the search string is found. How ever MAC addresses are not in the running config, so is this possible?

A sort of workaround I use now is use sh interaces | begin [MAC ADDRESS]

If I know the interface below I know what interface the MAC address belongs to.

So is there an equivalent of grep -5 [MAC ADDRESS]?


2 Answers 2


I got this awnser from another forum:

I figured it out, but you need an IOS version that has IOS.sh:

term shell
sh ru | grep -u H.H.H | tail 10

The -u flag will show all of the lines above the mac address you're searching and then the tail command will just show the last ten lines of that output. You can substitute "10" with however many lines you want.

Prerequisites for Cisco IOS.sh

• Cisco IOS Release 15.1(4)M, 15.1(2)S, and later releases.

• Cisco IOS.sh must be configured and enabled to use the Cisco IOS.sh features and functions on yourrouter.


  • You should accept your answer so that the question doesn't keep popping up forever, looking for an answer.
    – Ron Maupin
    Dec 19, 2016 at 13:18
  • I have accepted my awnser Dec 20, 2016 at 0:07

According to the following Cisco documentation there is no such equivalent grep-5 command. The pipe command does support regular expressions to help filter the output.


The following command could make the output more readable. (Alternation)

show interfaces | include Gig|0000.0000.0000

Switch#show interfaces | in Gig|000c.5e48.0801
GigabitEthernet0/0 is up, line protocol is up (connected) 
GigabitEthernet0/1 is up, line protocol is up (connected) 
  Hardware is iGbE, address is 000c.5e48.0801 (bia 000c.5e48.0801)
GigabitEthernet0/2 is up, line protocol is up (connected) 
GigabitEthernet0/3 is up, line protocol is up (connected) 
GigabitEthernet1/0 is up, line protocol is up (connected) 
GigabitEthernet1/1 is up, line protocol is up (connected) 
GigabitEthernet1/2 is up, line protocol is up (connected) 
GigabitEthernet1/3 is up, line protocol is up (connected) 

Some switch IOS code will list the MAC addresses of its interfaces with the following.

show mac address-table


show mac-address-table
  • I figured as much as I did a lot of googling. Thank for the tips. Dec 15, 2016 at 17:44
  • @frankguthrie, don't forget to mark the answer as accepted if you're happy with it.
    – OzNetNerd
    Dec 15, 2016 at 23:16
  • The | section command is a fantastic alternative to | include when it's available. For example: show run | section aaa will show you the aaa new-model command AND all of it's sub-commands AND any other line in the config that contains aaa. Very handy. Dec 16, 2016 at 12:25

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.