Hi Brian,

Can you explain the easiest way to construct a regular expression in BGP?



Hi Rowan,

Regular expressions are strings of special characters that can be used to search and find character patterns. Within the scope of BGP in Cisco IOS regular expressions can be used in show commands and AS-Path access-lists to match BGP prefixes based on the information contained in their AS-Path.

In order to understand how to build regular expressions we first need to know what the character definitions are for the regex function of IOS. The below table illustrates the regex characters and their usage. This information is contained in the Cisco IOS documentation under the Appendix of Cisco IOS Terminal Services Configuration Guide, Release 12.2.

| CHAR | USAGE                                         |
|  ^   | Start of string                               |
|  $   | End of string                                 |
|  []  | Range of characters                           |
|  -   | Used to specify range ( i.e. [0-9] )          |
|  ( ) | Logical grouping                              |
|  .   | Any single character                          |
|  *   | Zero or more instances                        |
|  +   | One or more instance                          |
|  ?   | Zero or one instance                          |
|  _   | Comma, open or close brace, open or close     |
|      | parentheses, start or end of string, or space |

Some commonly used regular expressions include:

| Expression  | Meaning                   |
| .*          | Anything                  |
| ^$          | Locally originated routes |
| ^100_       | Learned from AS 100       |
| _100$       | Originated in AS 100      |
| _100_       | Any instance of AS 100    |
| ^[0-9]+$    | Directly connected ASes   |

Let’s break some of the above expressions down step-by-step. The first one “.*” says to match any single character (“.”), and then find zero or more instances of that single character (“*”). This means zero or more instances or any character, which effectively means anything.

The next string “^$” says to match the beginning of the string (“^”), and then immediately match the end of the string (“$”). This means that the string is null. Within the scope of BGP the only time that the AS-Path is null is when you are looking at a route within your own AS that you or one of your iBGP peers has originated. Hence this matches locally originated routes.

The next string “^100_” says to match the beginning of the string (“^”), the literal characters 100, and then a comma, an open or close brace, an open or close, a parentheses, the start or end of the string, or a space (“_”). This means that the string must start with the number 100 followed by any non-alphanumeric character. In the scope of BGP this means that routes which are learned from the AS 100 will be matched, as 100 will be the first AS in the path when AS 100 is sending us routes.

The next string “_100$” is the exact opposite of the previous one. This string says to start with any non-alphanumeric character (“_”), followed by the literal characters 100, followed by the end of the string (“$”). This means that AS 100 is the last AS in the path, or in other words that the prefix in question was originated by AS 100.

The next string “_100_” is the combination of the two previous strings with some extra matches. This string means that the literal characters 100 are set between any two non-alphanumeric characters. The first of these could be the start of the string, which would match routes learned from AS 100, while the second of these could be the end of the string, which would match routes originated in AS 100. Another case could be that the underscores represent spaces, in which the string would match any other AS path information as long as “ 100 ” is included somewhere. This would match any routes which transit AS 100, and therefore “_ASN_” is generally meant to match routes that transit a particular AS as defined by the number “ASN”.

The final string “^[0-9]+$” is a little more complicated match. Immediately we can see that the string starts (“^”), and we can see later that it ends (“$”). In the middle we see a range of numbers 0-9 in brackets, followed by the plus sign. The numbers in brackets mean that any number from zero to nine can be matched, or in other words, any number. Next we have the plus sign which means one or more instances. This string “[0-9]+” therefore means one or more instance of any number, or in other words any number including numbers with multiple characters (i.e. 1, 12, 123, 1234, 12345678, etc.). When we combine these all together this string means routes originated in any directly connected single AS, or in other words, the routes directly originated by the peers of your AS.

Now let’s look at a more complicated match, and using the above character patterns we will see how we can construct the expression step by step. Suppose we have the following topology below, where we are looking at the network from the perspective of AS 100.

+--------+ +--------+ +--------+ +--------+
| AS 200 |-| AS 201 |-| AS 202 |-| AS 203 |\
+--------+ +--------+ +--------+ +--------+ \
           +--------+ +--------+ +--------+\  \
           | AS 300 |-| AS 301 |-| AS 302 | \  \
           +--------+ +--------+ +--------+  \  -+--------+
                                              >--| AS 100 |
                      +--------+ +--------+  /  -+--------+
                      | AS 400 |-| AS 401 | /  /
                      +--------+ +--------+/  /
                                 +--------+ /
                                 | AS 500 |/

AS 100 peers with ASes 203, 302, 401, and 500, who each have peers as diagramed above. AS 100 wants to match routes originated from its directly connected customers (ASes 203, 302, 401, and 500) in addition to routes originated from their directly connected customers (ASes 202, 301, and 400). The easiest way to create this regular expression would be to think about what we are first trying to match, and then write out all possibilities of these matches. In our case these possibilities are:

203 202
302 301
401 400

Now we could simply create an expression with multiple lines (7 lines to be exact) that would match all of the possible AS paths, but suppose that AS 100 wants to keep this match as flexible as possible so that it will apply to any other ASes in the future. Now let’s try to generalize the above AS-Path information into a regex.

First off we know that each of the matches is going to start and going to end. This means that the first character we will have is “^” and the last character is “$”. Next we know that between the “^” and “$” there will be either one AS or two ASes. We don’t necessarily know what numbers these ASes will be, so for the time being let’s use the placeholder “X”. Based on this our new possible matches are:

^X X$

Next let’s reason out what X can represent. Since X is only one single AS, there will be no spaces, commas, parentheses, or any other special type characters. In other words, X must be a number. However, since we don’t know what the exact path is, we must take into account that X may be a number with more than one character (i.e. 10, 123, or 10101). This essentially equates to one or more instance of any number zero through nine. In regular expression syntax our two matches would therefore now read:

^[0-9]+ [0-9]+$

This expressions reads that we either have a number consisting of one or more characters zero through nine, or a number consisting of one or more characters zero through nine followed by a space and then another number consisting of one or more characters zero through nine. This brings our expression down to two lines as opposed to our original seven, but let’s see how we can combine the above two as well. To combine them, first let us compare what is different between them.

^[0-9]+ [0-9]+$

From looking at the expressions it is evident that the sequence “ [0-9]+” is the difference. In the first case “ [0-9]+” does not exist in the expression. In the second case “ [0-9]+” does exist in the expression. In other words, “ [0-9]+” is either true or false. True or false (0 or 1) is represented by the character “?” in regex syntax. Therefore we can reduce our expression to:

^[0-9]+ [0-9]+?$

At this point we run into a problem with the order of operations of the regex. As denoted above the question mark will apply only to the plus sign, and not to the range [0-9]. Instead, we want the question mark to apply to the string “ [0-9]+” as a whole. Therefore this string needs to be grouped together using parentheses. Parentheses are used in regular expressions as simply a logical grouping. Therefore our final expression reduces to:

^[0-9]+( [0-9]+)?$

Note that to match a question mark in IOS, the escape sequence CTRL-V or ESC-Q must be entered first, otherwise the IOS parser will interpret the question mark as an attempt to invoke the context sensitive help.

About Brian McGahan, CCIE #8593, CCDE #2013::13:

Brian McGahan was one of the youngest engineers in the world to obtain the CCIE, having achieved his first CCIE in Routing & Switching at the age of 20 in 2002. Brian has been teaching and developing CCIE training courses for over 10 years, and has assisted thousands of engineers in obtaining their CCIE certification. When not teaching or developing new products Brian consults with large ISPs and enterprise customers in the midwest region of the United States.

Find all posts by Brian McGahan, CCIE #8593, CCDE #2013::13 | Visit Website

You can leave a response, or trackback from your own site.

35 Responses to “Understanding BGP Regular Expressions”

  1. shef says:

    And what we should do with 2-byte AS’s?

  2. What is an example case of this?

  3. shef says:


    2-byte AS have dot: 65000.65000 for example. Dot in regexp – any single character :)

  4. You need to escape the dot with a backslash. You could say 65000\.65000

  5. Nizami says:

    hi Brian. i have a question.how to match on AS and all its directly connected customers with taking into consideration the future growth.
    what is the difference between theese regular expressions? Say we have AS 100.


    will result be the same?

  6. It should match the same thing. Test it on a route server to be 100% sure.

  7. [...] is a nice article wrote by Brian McGahan about Regular Expression Possibly related posts: (automatically generated)HTTP/1.1 Pipelining « [...]

  8. Harpreet Singh says:

    Sharing another good link for regular expression:-


    See the table at bottom of the page..

    Harpreet Singh

  9. [...] List Posted in June 6, 2009 ¬ 1:05 amh.adminNo Comments » Easy AdSense by Unrealhttp://blog.internetworkexpert.com/2008/01/06/understanding-bgp-regular-expressions/ Thanking [...]

  10. miodragpro says:

    Great explanations…

  11. noobie7 says:

    Fabulous post!

  12. examguy says:

    thanks for detailed explanation

  13. [...] did a good job explaining the regex in his blog. Please refer it to get more examples and how to use these expressions to match AS_PATH [...]

  14. Kamran says:

    Nice post Brian. This will help me understand BGP regex.

    Thanks a lot..!

  15. Smith says:

    Hi Brian,

    Can you please explain what the below line indicates:

    seq 10 permit reg-exp 64514:11[1267].3

    PS: The config is not from Cisco

    Thanks in Advance

  16. harry says:

    Great article dude

  17. Ayyappan says:

    Hey Brian,

    The Regex in your result ‘^[0-9]+( [0-9]+)?$’ did not include a character representing a space between the 2 ASes for eg: the space between ’203 202′. Why is this so ?

    See Nizami has included this. But there as well
    ^100_[0-9]*$ picks for instance 100 200 and not any more ASes.
    while ^100(_[0-9]+)?$ can pick 100 200 and 100 200 300 ….

  18. Ayyappan says:

    ^[0-9]+( [0-9]+)?$ seem to represent a varying length of single AS match ???

  19. Dom says:

    Thanks for the detailed explanation =]

  20. Ganesh V says:

    Thanks for your clear explanation. Before referring this I was fearing on how to learn this regular expressions.

  21. Eugene Uy says:

    Great explanation!

  22. rewan says:

    gr8 post!!!

  23. Eugene says:

    Hi, Dennis!
    May i ask you a question concerning regular expressions in BGP?
    What regular expression should be used to display only BGP routes on which as path prepending was done, say, more than 20 times (by the same AS)?
    The question was born after reading the article: http://www.renesys.com/blog/2009/02/longer-is-not-better.shtml.
    The task is to find whether there are such suspicious internet routes, on which some ISP executed as-path prepending procedure unusually many times.

    I thought that _([0-9]+)(_\1){20,} would work (repeat delimiter and backreference 20 or more times), but public route server @ Optus, Australia, said otherwise:


    route-views.optus.net.au>sh ip bgp reg _([0-9]+)(_\1){3,}



    - actually, nothing. That is, even at least triple prepending is not discovered, although the standard expression _([0-9]+)(_\1)+ works fine:

    route-views.optus.net.au>sh ip bgp reg _([0-9]+)(_\1)+
    BGP table version is 150012938, local router ID is
    Status codes: s suppressed, d damped, h history, * valid, > best, i – internal,
    r RIB-failure, S Stale, m multipath, b backup-path, x best-external
    Origin codes: i – IGP, e – EGP, ? – incomplete

    Network Next Hop Metric LocPrf Weight Path
    *> 0 7473 6453 7545 7545 7545 56203 i
    * 20 0 7474 7545 7545 7545 7545 7545 56203 i
    * 10 0 7474 7545 7545 7545 7545 7545 56203 i
    * 1 0 7474 7545 7545 7545 7545 7545 56203 i
    * 10 0 7474 7545 7545 7545 7545 7545 56203 i
    * 20 0 7474 7545 7545 7545 7545 7545 56203 i
    * 0 7474 7545 7545 7545 7545 7545 56203 i
    * 20 0 7474 7545 7545 7545 7545 7545 56203 i
    * 1 0 7474 7545 7545 7545 7545 7545 56203 i
    * 20 0 7474 7545 7545 7545 7545 7545 56203 i
    * 1 0 7474 7545 7545 7545 7545 7545 56203 i

    Best regards, Eugene Smirnov. CCSI #32361

    • I don’t think IOS regex supports { } You could just keep repeating the (_\1) but there is a limit to the depth it will accept:

      route-server.ams2>$show ip bgp regex _([0-9]+)(_\1)(_\1)(_\1)(_\1)(_\1)(_\1)(_\1)(_\1)(_\1)
      % too many ()
      % Invalid regular expression

  24. Eugene says:

    Sorry, Brian, of course!

  25. [...] Some time ago INE has posted a very explanatory post about Regular Expressions  in BGP [...]

  26. Babbadubbi says:

    Brian rules!
    This concepts are quite clear, pretty much easier to understand than in cisco itself. Thanx.

  27. Toyin says:

    Hi Brian, should there be an underscore in the Regex?

    ^[0-9]+_( [0-9]+)?$

  28. Firas Ashour says:

    thanks alot

  29. ipermo says:


    could anyone tell me what “ip as-path access-list 100 deny .+_.+_.+_.+_.+_.+_.+_.+_.+_.+_.+_.+” stands for?!
    I searched over Internet for this “.+_.+_.+_.+_.+_.+_.+_.+_.+_.+_.+_.+” but I was unable to find any info.

    Thank you for answering to this question.

    Best regards

  30. [...] with BGP. The first is the BGP cheat sheet from PacketLife.net. The second is an INE blog post on BGP Regular Expressions. This article was posted in BGP. Bookmark the permalink. Follow comments with the RSS feed for [...]

  31. Ateeq says:

    Nice post Brian. This will helped me to clear my doubts…


Leave a Reply


CCIE Bloggers