Alright, I have a network trace file that I want to parse through.

The file looks like this:

+ 1.002 /NodeList/1/DeviceList/0/$ns3::PointToPointNetDevice/TxQueue/Enqueue ns3::PppHeader (Point-to-Point Protocol: IP (0x0021)) ns3::Ipv4Header (tos 0x0 ttl 62 id 0 protocol 6 offset 0 flags [none] length: 40 10.2.1.1 > 10.1.1.1) ns3::TcpHeader (49153 > 26 [ SYN ] Seq=0 Ack=0 Win=65535)
- 1.002 /NodeList/1/DeviceList/0/$ns3::PointToPointNetDevice/TxQueue/Dequeue ns3::PppHeader (Point-to-Point Protocol: IP (0x0021)) ns3::Ipv4Header (tos 0x0 ttl 62 id 0 protocol 6 offset 0 flags [none] length: 40 10.2.1.1 > 10.1.1.1) ns3::TcpHeader (49153 > 26 [ SYN ] Seq=0 Ack=0 Win=65535)
- 1.32033 /NodeList/1/DeviceList/0/$ns3::PointToPointNetDevice/TxQueue/Dequeue ns3::PppHeader (Point-to-Point Protocol: IP (0x0021)) ns3::Ipv4Header (tos 0x0 ttl 62 id 4406 protocol 6 offset 0 flags [none] length: 576 10.2.3.1 > 10.1.54.1) ns3::TcpHeader (143 > 49152 [ ACK ] Seq=75041 Ack=9 Win=65535) Payload Fragment [160:696]
......


All I want to extract from this very large file is the time and the length from each packet flow. And then output it to a new csv file.
Is this possible?

For example:

1.002, 40
1.002, 40
1.32033, 576
...

Thank you for the help!

Yes, it's possible. Sed or awk could do it easily. But since you didn't wrap the data above in [code][/code] tags, I'm not sure about the exact formatting of the file. The "length" value in the last entry wraps to another line on my screen, for example. It's much easier to extract data when everything is on one line, and even easier if the entries are consistently formatted, so it would help to know exactly how the lines break.

Edit: If I assume that each entry is on a single line, that the fields are uniform (that the number of blank spaces is the same on each line), and that there are no lines in the file other than ones like these, then something like this would do it:
Again, modifications would be needed if the formatting is different.

Please post your thread in only one forum. Posting a single thread in the most relevant forum will make it easier for members to help you and will keep the discussion in one place. This thread is being closed because it is a duplicate.