TechKnowSurge

Cisco CCST Networking 5.5 Cisco CCST Networking 5.4

VideoNetworkFree

DEMO: Filtering Show Commands

Cisco IOS output filters allow network administrators to narrow down the results of verbose show commands using pipe operators with keywords like begin, include, exclude, and section.

⚑ Complete this video to capture a CTF flag worth 1 point.

About this video

Cisco IOS show commands are essential tools for inspecting device configurations, but on even moderately complex switches and routers, the output can span hundreds of lines. Scrolling through an entire running configuration to find a single interface or parameter wastes time and increases the chance of missing critical details. Output filtering through the IOS pipe operator provides a practical solution by allowing administrators to refine command output in real time without modifying the configuration itself. Four core filter keywords cover most common use cases. The begin filter scans the output and starts displaying from the first line that matches the specified string, showing everything that follows regardless of whether subsequent lines also match. The include filter returns only the lines that contain the matching string, making it useful for quickly listing all instances of a particular element such as every Fast Ethernet interface. The exclude filter does the opposite, displaying all output lines except those containing the match, which is effective for removing noise from repetitive entries. The section filter returns complete configuration blocks associated with any match, so related sub-commands and descriptions tied to an interface appear together rather than in isolation. All four filters are case-sensitive, meaning the search string must exactly match the capitalization used in the configuration output. Together these tools allow network engineers and administrators to work with IOS output precisely and efficiently, reducing troubleshooting time and improving accuracy when auditing or verifying device configurations.

What you'll learn

Apply IOS output filter commands — begin, include, exclude, and section — to refine the results of show commands on a Cisco switch

What's covered

IOS Show Command Filters

Why Use Filters
- Show commands verbose
- Narrow output efficiently
Pipe Filter Syntax
- Use pipe character
- Case sensitive input
Filter Types
- Begin filter
  - Starts at match point
  - Shows all content after
- Include filter
  - Shows matching lines only
  - Omits non-matching lines
- Exclude filter
  - Hides matching lines
  - Shows all other lines
- Section filter
  - Shows matched sections
  - Includes associated config
Demo Context
- Show running config
- Interface FastEthernet examples
- Description on port 014

Aligned to

Cisco CCST Networking

5.5 Run basic show commands on a Cisco network device

5.4 Differentiate between different ways to access and collect data about network devices

Key terms

show running config: A Cisco IOS command that displays the active configuration currently running on a device.
Output Filter: A pipe-based modifier appended to a Cisco IOS show command to narrow displayed results to relevant lines or sections.
begin: An IOS output filter that displays all output starting from the first line matching a specified keyword.
include: An IOS output filter that displays only the lines of output that contain a specified keyword.
exclude: An IOS output filter that displays all lines of output except those containing a specified keyword.
section: An IOS output filter that displays complete configuration sections whose heading line matches a specified keyword.

Topics

Cisco Ios Show Commands Output Filtering Cli Cisco Switches Networking

Transcript

We took a look at some of those show commands, but those show commands can give us a lot of output sometimes. For instance, that show running-config, even on a simpler switch, can be fairly extensive. So we're going to start using some filters to narrow down to the information that you're really looking for.

The full running config

I have a switch here, and I'm just going to type in show running-config and hit enter on that, and then it's going to list out the full running config file. I'm going to just hit spacebar every time I see "more" to scroll through this.

I do want to point out that on 014 I added a description, so we could see how some of these commands that I'm about to go over interplay with this. Just know that the description "demo laptop" is under 0 14. Then I'm going to go through the rest of these, and there we get to the end of the running config.

Piping into a filter

What I'm going to do is actually pipe this into a filter command, so I'm going to use the pipe to do this. I add the pipe and then I'm going to use the question mark, and you can see there's a lot of ways I can filter this out: I can append, I can begin, count, exclude, format, include. The ones we're actually going to go over today are four: the begin, the include, the exclude, and the section. Let's take a look at those four and see what they look like.

begin

First of all I'm going to do the begin. Let's say I want to just see from the fast ethernet connections and beyond within the running config file. So I'm going to say begin, and I'm going to say interface FastEthernet. Notice that it's case sensitive, so I had to use the capital F and capital E in FastEthernet.

I'm going to hit enter, and now what it's doing is sorting through the running config file, and then, once it found the interface FastEthernet, it started listing everything after that — including those things that aren't even fast ethernet, so it's showing me the end of the file as well. So it begins at a certain point and shows you all of the rest of it.

include

The next one that we'll take a look at is the include. I'm going to do the include here and hit enter, and now what it's looking for is any line that includes interface FastEthernet, and then it will include that. So it's including all of my interfaces in there, no details of those interfaces. Notice when we look at the FastEthernet 014 there's no description in it.

And then it's not going to list the end of the file either, because the end of this running config doesn't have interface FastEthernet in it. So it just includes up to the last interface FastEthernet, and then that's it.

exclude

Now let's take a look at exclude. I'm going to change this to exclude and — if you guessed it right — now what's happening is it's looking through and it's going to list out everything unless it has interface FastEthernet in it. It's even to the point that it didn't include the interface FastEthernet 014, but it did include the description of that interface. And then we cycle through to the end here.

section

Finally, we're going to do a section, and that's going to show certain sections. When I do section interface FastEthernet, then it's going to show any of the sections that include interface FastEthernet. So now it's showing us all of the fast ethernet interfaces, including the programming that's associated with it. So the description "demo laptop" is associated with 0 14, so it's showing that as well. And then we get to the end here, and it doesn't show the end of the file.

So that is begin, include, exclude and section. Those are just a few — we saw a few more in there as well — that we can use to filter out our show commands, or what's displaying on our screen, so we can get to the exact information that we want to get to and be able to pull that information very efficiently.

Read the full transcript Show less

About TechKnowSurge

TechKnowSurge builds IT and cybersecurity professionals through hands-on, concept-first training built around real understanding — not memorization. Free interactive tools, structured programs, and 25+ years of real-world experience, all in one place.

Explore free tools and programs →