#!/usr/bin/awk -f # tcpdump -qln -nn -X -i em1 port 514 | awk ' BEGIN { if ( ! re ) { re = "." } } /^\t/ { for (i = 2; i < NF ; i++ ) { bin = bin " " $i } txt = txt $NF; next; } /^[^\t]/ { if ( txt ~ re ) { print hdr, txt, binary ? bin : ""; } hdr = $0; txt = ""; bin = ""; }