Sorry for the delay in getting back to you. Work 4-on/4-off and some days I just choose to leave the computer off.


Ok, you want your tcpfile.delete to actually contain the lines that are (to be) deleted. That's the problem. For this to work, using the !d for the delete, you would have to build a single regular expression that matches every line to be deleted. That is no small task.

A couple of suggestions.

1. Since nothing is really being deleted, and tcpfile.delete really just identifies those lines that need to be deleted, you could use the /p to identify them.

Assuming you're not doing it this way because you want to use the /d, then I have two other suggestions.

2. If you use /d in delete.sed, tcpfile.delete ends up containing the contents of tcpfile minus those lines which would be deleted by the delete expressions. You could then use comm, or some other utility, to compare tcpfile and tcpfile.delete to produce a list of the lines which were deleted. I ran a quick test with comm and, on my system, anyway, it was producing one extra line of output that it shouldn't have been.

3. To generate a file tcpfile.delete that contains the (to be) deleted lines, and using the !d form for delete, you could use multiple delete.sed files.

Code:

 
delete1.sed
/=315[89]$/!d
 
delete2.sed
/=1447$/!d
 
for i in delete*.sed;do sed -f $i tcpfile >> tcpfile.delete;done

There are probably other ways, as well. Just need to decide what's easiest for you. Note the $ in the expressions. That matches the end-of-line in the input. In your last example for matching port 451, you still have the potential to match more than you want (451, 4510, 4511, etc).