#!/usr/bin/perl
use strict;
use warnings;
my $logfile = $ARGV[0];
my $start_date;
my $end_date;
my %log_totals;
open (FILE< $logfile) or die "Could not open $logfile: $!\n";
for (<FILE>) {
if (/^\d+/) {
($start_date) = m/^(\d+)/o unless ($start_date);
($end_date) = m/^(\d+)/o;
} elsif (/^\s+\d+/o) {
my ($bytes,$source,$destination,$ports) =
m/
^\s+\d+\s+(\d+) # pkts & bytes
.+ # bla bla bla
\s+(\S+) # source
\s+(\S+) # destination
\s+(n\/a|\w+\s+->\s+\w+)$ # ports
/ox;
my ($src_port,$dest_port) = ('any','any');
($src_port,$dest_port) = $ports =~ m/(\w+)\s+->\s+(\w+
+)/o
unless ($ports eq 'n/a');
&data2hash($bytes,$source,$src_port,$destination,$dest
+_port);
# print "$bytes,$source,$src_port,$destination,$dest_p
+ort\n";
}
}
my $start = localtime($start_date);
my $end = localtime($end_date);
print "From: $start\n";
print "To: $end\n";
print "Source Address,Source Port,Destination Address,Destination Port
+,Bytes\n";
for my $key (keys %log_totals) {
print "$key,$log_totals{$key}\n";
}
sub data2hash {
my ($bytes,$src_addr,$src_port,$dest_addr,$dest_port) = @_;
if ($src_addr ne 'anywhere') { # we have a src address match
if ($src_port ne 'any') { # we have a src port match
$log_totals{"$src_addr,$src_port,,"} += $bytes
+;
} elsif ($dest_port ne 'any') { # we have a dest port
+match
$log_totals{"$src_addr,,,$dest_port"} += $byte
+s;
} else { # only src address match
$log_totals{"$src_addr,,,"} += $bytes;
}
} elsif ($dest_addr ne 'anywhere') { # we have a dest address
+match
if ($src_port ne 'any') { # we have a src port match
$log_totals{",$src_port,$dest_addr,"} += $byte
+s;
} elsif ($dest_port ne 'any') { # we have a dest port
+match
$log_totals{",,$dest_addr,$dest_port"} += $byt
+es;
} else { # only dest address match
$log_totals{",,$dest_addr,"} += $bytes;
}
} else { # shouldn't get here
print STDERR "eh?\n";
}
}
close FILE;
#!/bin/bash
/bin/date +%s >>/var/log/ip-acc/ip-acc.log
/sbin/ipchains -L ip-acc -v -x >>/var/log/ip-acc/ip-acc.log
/sbin/ipchains -Z ip-acc
-
Are you posting in the right place? Check out Where do I post X? to know for sure.
-
Posts may use any of the Perl Monks Approved HTML tags. Currently these include the following:
<code> <a> <b> <big>
<blockquote> <br /> <dd>
<dl> <dt> <em> <font>
<h1> <h2> <h3> <h4>
<h5> <h6> <hr /> <i>
<li> <nbsp> <ol> <p>
<small> <strike> <strong>
<sub> <sup> <table>
<td> <th> <tr> <tt>
<u> <ul>
-
Snippets of code should be wrapped in
<code> tags not
<pre> tags. In fact, <pre>
tags should generally be avoided. If they must
be used, extreme care should be
taken to ensure that their contents do not
have long lines (<70 chars), in order to prevent
horizontal scrolling (and possible janitor
intervention).
-
Want more info? How to link
or How to display code and escape characters
are good places to start.