Text Processing for Network Engineers Part 6: vim on a Box With No GUI

Every appliance rescue shell, every minimal container, every jump box stripped down for security has one editor guaranteed to be there: some form of vi. It’s been a POSIX requirement since the standard existed, which means the return on learning it properly is unusually high: the skill works on literally every Linux and Unix box you’ll ever touch, with no installation, no GUI, and no dependency on anything else being configured right.

This part isn’t a vim tutorial from scratch. It assumes you can already open a file, move around, and save it. It’s the features that turn vim from “an editor that’s always there” into the fastest tool on the machine for a specific class of repetitive config edit.

Modes, briefly, because everything below depends on it

Normal mode: keys are commands, not text. Insert mode: keys are text. Visual mode: keys select a range, then a command acts on it. Esc always gets you back to normal mode. That’s the whole model. Everything from here assumes you’re starting in normal mode.

Macros: recording a repetitive edit once, replaying it N times

This is the single highest-value vim feature for network engineering work, because so much config editing is “do this exact same small edit to 40 different lines.”

Record a macro into register q with qq, do the edit once, stop recording with q:

qq                    " start recording into register q
0                     " go to start of line
i no                  " insert "no " at the start (turning a permit line into a shutdown/negate, or similar)
<Esc>
j                     " move down one line, ready for the next repetition
q                     " stop recording

Replay it with @q, or replay it N times with 5@q, or replay it against every remaining line with 999@q (vim just stops when it runs out of lines, so an oversized count is a safe way to say “the rest of the file”):

10@q                  " replay the recorded macro 10 more times

The concrete case this solves: 200 lines of interface config need the same two-line change (add a description, add an MTU statement) applied identically to each. Recording the macro once and replaying it 199 times takes seconds. Doing the same edit by hand, even fast, takes considerably longer, and is where transcription errors creep in on line 140 that nobody catches until the config is already pushed.

Visual block mode: editing a column, not a line

Ctrl-V (or Ctrl-Q on some terminals where Ctrl-V is bound to paste) enters visual block mode: a rectangular selection across multiple lines, at a fixed column range, rather than a normal line-based selection.

The case this solves: a file has 50 lines, each starting with an interface name in a fixed column, and every one needs a common prefix added, or a specific column of characters changed (say, every third octet in a column of IP addresses, all lined up because the file is fixed-width). Select the block with Ctrl-V, extend down with j repeatedly (or G to the end of file, or a count like 50j), then:

• I, type the text, Esc, inserts that text at the start of the block on every selected line, not just the first.
• A, type the text, Esc, appends at the end of the block on every line.
• c, type the replacement, Esc, replaces the selected block on every line.
• d deletes the selected block on every line.

This is the vim feature that most directly maps to “spreadsheet-style column editing,” except it works on a plain text file over an SSH session with no GUI at all.

:g, the command that applies a normal-mode command to every matching line

:g/pattern/command runs command on every line matching pattern, across the whole file, in one pass. Combined with normal, it can run an arbitrary sequence of normal-mode keystrokes on every matching line:

:g/^interface/normal A shutdown

That appends shutdown to every line starting with interface, in effect shutting down every interface in the file, useful for building a “confirm before applying” draft of a maintenance-window config. Delete every line matching a pattern, without leaving normal mode at all:

:g/^!$/d

:g with a negated match (:g! or :v) runs the command on every line that does not match:

:v/^interface/d

That deletes every line that isn’t an interface header, leaving only the interface declaration lines, a fast way to get a flat list of every interface a config touches.

Search and replace: :%s, the whole-file version of sed’s s///

:%s/old/new/g is vim’s own version of the sed substitution from Part 3, and it uses the same regex engine family (vim’s own dialect, closer to BRE than ERE by default, with \v available to switch to a “very magic” mode that behaves more like ERE/PCRE for that one command):

:%s/10\.50\.0\./10.60.0./g
:%s/\v10\.50\.0\./10.60.0./g    " \v mode: fewer characters need escaping

The difference from doing the same substitution with sed is entirely about workflow: sed is for batch, unattended, scriptable changes across many files. :%s inside vim is for the interactive case, editing one file, watching the change happen, able to u (undo) instantly if the pattern was wrong, before saving.

Registers: named clipboards for moving blocks of config around

Yank into a named register with "ay (register a), paste from it with "ap, from anywhere in the file or even a different file opened in the same vim session:

"ayy      " yank the current line into register a
"ap       " paste register a's contents after the cursor

For moving a whole ACL block, or a chunk of interface config, from one place in a large file to another, without it getting overwritten by whatever you yank next (the way the default unnamed register would), naming the register keeps it safe across other edits in between.

Why this is worth the up-front cost

Every one of these features has a GUI-editor equivalent that’s arguably easier to learn: find-and-replace-in-selection, multi-cursor editing, and so on. The reason to learn vim’s version anyway is availability, not elegance: it’s the one editing environment guaranteed to be present on the device you’re actually SSH’d into at 3am, with no ability to install anything, on a locked-down management network with no internet-facing package repo in reach. Part 7 covers the editor that’s the other guaranteed option on most boxes, nano, and when reaching for it instead is actually the right call.