#!/usr/bin/perl

use strict;
use warnings;

my $logfile = $ARGV[0];

my $start_date;
my $end_date;
my %log_totals;


open (FILE< $logfile) or die "Could not open $logfile: $!\n";

for (<FILE>) {
        if (/^\d+/) {
                ($start_date) = m/^(\d+)/o unless ($start_date);
                ($end_date) = m/^(\d+)/o;
        } elsif (/^\s+\d+/o) {
                my ($bytes,$source,$destination,$ports) =
                m/
                        ^\s+\d+\s+(\d+)                 # pkts & bytes
                        .+                              # bla bla bla
                        \s+(\S+)                        # source
                        \s+(\S+)                        # destination
                        \s+(n\/a|\w+\s+->\s+\w+)$       # ports
                /ox;

                my ($src_port,$dest_port) = ('any','any');

                ($src_port,$dest_port) = $ports =~ m/(\w+)\s+->\s+(\w+)/o
                        unless ($ports eq 'n/a');
                &data2hash($bytes,$source,$src_port,$destination,$dest_port);
                # print "$bytes,$source,$src_port,$destination,$dest_port\n";
        }
}

my $start = localtime($start_date);
my $end = localtime($end_date);

print "From: $start\n";
print "To: $end\n";
print "Source Address,Source Port,Destination Address,Destination Port,Bytes\n";
for my $key (keys %log_totals) {
        print "$key,$log_totals{$key}\n";
}

sub data2hash {
        my ($bytes,$src_addr,$src_port,$dest_addr,$dest_port) = @_;

        if ($src_addr ne 'anywhere') { # we have a src address match
                if ($src_port ne 'any') { # we have a src port match
                        $log_totals{"$src_addr,$src_port,,"} += $bytes;
                } elsif ($dest_port ne 'any') { # we have a dest port match
                        $log_totals{"$src_addr,,,$dest_port"} += $bytes;
                } else { # only src address match
                        $log_totals{"$src_addr,,,"} += $bytes;
                }
        } elsif ($dest_addr ne 'anywhere') { # we have a dest address match
                if ($src_port ne 'any') { # we have a src port match
                        $log_totals{",$src_port,$dest_addr,"} += $bytes;
                } elsif ($dest_port ne 'any') { # we have a dest port match
                        $log_totals{",,$dest_addr,$dest_port"} += $bytes;
                } else { # only dest address match
                        $log_totals{",,$dest_addr,"} += $bytes;
                }
        } else { # shouldn't get here
                print STDERR "eh?\n";
        }
}

close FILE;


#!/bin/bash
/bin/date +%s >>/var/log/ip-acc/ip-acc.log
/sbin/ipchains -L ip-acc -v -x >>/var/log/ip-acc/ip-acc.log
/sbin/ipchains -Z ip-acc