today i was doing some forensics to find mac address inside syslog in linux systems
i wrote this simple grep command to filter mac address from log files

grep ‘[0-9a-zAz]\{2\}:[0-9a-zAz]\{2\}:[0-9a-zAz]\{2\}:[0-9a-zAz]\{2\}:[0-9a-zAz]\{2\}:[0-9a-zAz]\{2\}’

have fun