simple/tcpdump_tools/by_hosts

#!/usr/bin/perl -w
use strict;
# 01:06:43.508117 00:00:24:d0:61:81 > 00:0e:0c:a9:5d:a4, ethertype IPv4 (0x0800), length 58: 93.174.93.51.35728 > 143.130.45.7.16719: Flags [S], seq 72688474, win 65535, options [mss 1436], length 0
my %octets;

while (<>) {
    if (/ethertype\ IPv4\ \(0x0800\), \s
         length\ (?<octets>\d+): \s
         (?<sip> \d+\.\d+\.\d+\.\d+) .*?
         > \s
         (?<dip> \d+\.\d+\.\d+\.\d+) .*?
        /x) {
	$octets{"$+{sip} - $+{dip}"} += $+{octets};
    } elsif (/ethertype\ IPv6\ \(0x86dd\), \s
         length\ (?<octets>\d+): \s
         (?<sip> [0-9a-f:]+) .*?
         > \s
         (?<dip> [0-9a-f:]+) .*?
        /x) {
	$octets{"$+{sip} - $+{dip}"} += $+{octets};
    }
}
for my $i (sort { $octets{$a} <=> $octets{$b} } keys %octets) {
    printf "%10d %s\n", $octets{$i}, $i;
}

#vim:sw=4