(1) You’re playing games with words.  [tc,ud]*p doesn’t match ppp; it matches p three times (as can be seen in the output you present).  Compare your little demonstration to echo xyzuucp | grep -o "[tc,ud]*p".  Or try echo "proto=ppp/dns sent=144" | grep -o "[tc,ud]*p".  (2) Why generalize?  (2a) It seems to happen fairly often that people post answers that work for the sample data only, and the OP comes back and says “That doesn’t work for my real data.”  … (Cont’d)

(Cont’d) …  Overly narrow / specific answers risk not really helping the OP.   (2b) Stack Exchange’s purpose is to build a knowledge base; a repository of high-quality questions and definitive answers that will be applicable and useful to others in the future.   To teach people how to fish, rather than to hand out fish sandwiches.   Overly narrow / specific answers are less likely to be useful to others.   … (Cont’d)

(Cont’d) …  (3) You say, “the post quite clearly states that the values will always be one of tcp/http, tcp/https, udp/dns.”  Well, the question is just all kinds of unclear.  I interpreted that sentence as meaning “I need to extract the value of proto from input that is formatted like the above example.  The output I’m expecting from the above (example) data is tcp/http, tcp/https, udp/dns.”   … (Cont’d)

(Cont’d) …  (4) “Why would you assume the OP would want the 2nd proto as well as the first?”  Counterpoint: why would you assume that they don’t?  That seems like one of the many follow-up / clarification questions that should have been asked of the OP. … (Cont’d)

(Cont’d) …  (5) OK, I don’t want to bombard mkzia with notifications about stuff not related to their answer. But I don’t want them to be told that their answer “only works by chance” — by a ♦ moderator — when it is just as good as the others. (6) Leaving comments under your answer wouldn’t have made any sense. I wasn’t critiquing your answer (except to the extent that I was critiquing all of the answers, except for user000001’s); I was critiquing your critique of mkzia’s answer.

@G-Man Agreed. But where one draws the line between too narrow and too broad is a personal call.

@G-Man OK, I don't see how you could interpret it that way though. The specific sentence was I need to extract the value of proto which is tcp/http, tcp/https, udp/dns. So that's what the OP needs.

@G-Man Yes, both are assumptions and both as valid as each other.

@G-Man It does only work by chance though. That command will match anything with a p!

By the way, please don't put "Cont'd" after each chat message, it just makes you posts harder to read. This is chat, after all, so it's always "continued" :)