Your grep doesn't match anything. [tc,ud]\*\\/.* looks for one occurrence of either t, or c, or , or u or d, followed by a literal * character, then a p and a backslash. You probably meant grep -Eo '(tc|ud)p/.* ' file | awk '{print $1}'. But then, if you're using awk, you may as well do the whole thing in awk: awk -F'[= ]' '/(tc|ud)p/{print $2}' file.

Someone modified my original, there was an extra Backslash before star, which I just removed Sir.

Thanks for editing, but I'm afraid that only works by chance. As I explained before, [tc,ud]p means "one of t, c, ,, u or d followed by a p. So it matches here only because tcp has cp and udp has dp. But it would also match ,p or tp etc. Also, now that you have the *, it will match ppp as well (the * means "0 or more" so it will match even when it doesn't match). You don't want a character class ([ ]), what you want is a group: (tc|ud) (use with the -E flag of grep). Also, the .* makes it match the entire line.

@Jesse_b: While mkzia is not technically a “New contributor”, they are an inexperienced user, as evidenced by the fact that they didn’t use code formatting for their command.  And yet they were smart enough to type \* to get the first * in their command to appear as an * and not as italics markdown.  When you put the command into code format, you caused the \ before the * to appear (thus causing the command to fail).  When you edit other people’s posts, please watch out for changing the appearance of the post like this.

@terdon: (1) No, actually it won’t match ppp.  Of course you’re right that it will match ,p or tp — or uucp, ttp, cutp, ductp or d,up. (2) I have been banging my head against the wall for years over questions where the question describes a problem, and then gives an example of the input, and people post answers that work for example, but not the general problem, as described.  For example, most of the answers here — including yours — … (Cont’d)

(Cont’d) …  assume that proto= is the first thing on the line, and that the proto value is always tcp/something or udp/something.  Kusalananda offers an answer that assumes that something matches [[:alnum:]]* (counterexamples: ftp-data is a standard name for port 20; netbios-ns, netbios-dgm, netbios-ssn, dhcpv6-client and dhcpv6-server are also standard service names). … (Cont’d)

(Cont’d) …  bu5hman’s answer assumes that the network protocol (the part before the /) matches ..p; Wikipedia offers counterexamples DCCP, RSVP,·SCTP and SPX.  Freddy’s answer assumes that the proto will be the only value on the line that contains a /. … (Cont’d)

(Cont’d) …  My point is, I believe that, to be correct, an answer should find proto= anywhere on the line, and match/extract the following string of printing characters.  By that standard, user000001’s answer is the only one that’s right.  But the community seems to accept a lower standard.  By that standard, mkzia’s answer is fine, because it works for the provided input data.  Sure, it reflects a misunderstanding of how […] works, and it could be reduced to [tucd]*p, but that really isn’t any worse than ..p. … (Cont’d)

(Cont’d) …  P.S. @mkzia: You don’t need the \ before the / (i.e., you can reduce the \/ to /).

@G-man wow. Please don't do this sort of thing in the comments, take it to meta.

@terdon: Do you mean my comments critiquing your comments?  Because that seems to be way too narrow in scope for Meta.   Or do you mean the larger issue of answers that address the example data only?  I suppose I agree that that should be discussed widely.

@G-Man It will actually match ppp:

$ echo ppp | grep -o "[tc,ud]*p"
p
p
p

As for the other issue, to be honest, I see no benefit in generalizing too much. The data here clearly all have proto as the first word. So why provide solutions where proto isn't the first word?

And the post quite clearly states that the values will always be one of tcp/http, tcp/https, udp/dns.

So an answer that finds proto anywhere on the line and doesn't limit itself to only the specific strings asked for might theoretically be better, yes, but it could also be worse. What if there's a line like this:

proto=udp/dns  sent=144        proto=52 spkt=3

Why would you assume the OP would want the 2nd proto as well as the first?

I guess my point is that we should only generalize as far as the actual question permits.

Anyway, sorry for bringing this in here, I just didn't want to have a whole conversation under a new user's post since they get a notification for every comment we leave. I think the point you raise is valid and is worth discussing, but let's do so here or in the main chat room or on meta.