I have found a solution on stackoverflow to replace ALL the 6 Octets of a MAC address with XX.

I use this when I post router logs, for privacy reasons.

It uses

's/([0-9a-eA-E]{2}:){5}[0-9a-eA-E]{2}/XX:XX:XX:XX:XX:XX/g'

or a simplified version

's/..:..:..:..:..:../XX:XX:XX:XX:XX:XX/g'

However to help troubleshoot specific devices I would like to retain the FIRST 3 Octets of the MAC address and replace only the LAST 3 Octets with XX e.g.

AA:22:CC:44:DD:66 becomes AA:22:CC:XX:XX:XX

I tried to delve into regex but the pattern matching for the replace element is pretty tough.
I tried a simple:

‘s/..:..:..:/XX:XX:XX:/g’ which to my surprise actually works but seems more by good luck than by design and I am not sure if there is anything which would trip it up.

If there was a similar solution for the (first) more robust expression above that would be useful.

Secondly, I noticed that the first (more rigorous) expression above:

's/([0-9a-eA-E]{2}:){5}[0-9a-eA-E]{2}/XX:XX:XX:XX:XX:XX/g'

Works on AA:22:CC:DD:EE:66

but does **not **work on AA:22:CC:DD:EE:FF

What needs to be changed, so as to work on ANY MAC address?