hjp
/
simple
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

tcpdump version 3.6.3

This commit is contained in:
hjp 2005-04-20 10:08:25 +00:00
parent 029195aa65
commit a52fa0d688
2 changed files with 30 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
tcpdump_tools/by_hosts
View File

@ -4,7 +4,7 @@ use strict;
my %octets; my %octets;
while (<>) { while (<>) {
if (/([\d.:]+) . ([\w:]+) ([\w:]+) ip (\d+): ([\w.]+)\.(\w+) > ([\w.]+)\.(\w+):/) { if (/([\d.:]+) ([\w:]+) ([\w:]+) ip (\d+): ([-\w.]+)\.(\w+) > ([-\w.]+)\.(\w+):/) {
# print; # print;
# print "-> $1 $2 $3 $4 $5 $6 $7 $8\n"; # print "-> $1 $2 $3 $4 $5 $6 $7 $8\n";
my $octets = $4; my $octets = $4;

29
tcpdump_tools/hourly_by_hosts Executable file
View File

@ -0,0 +1,29 @@
#!/usr/bin/perl -w
use strict;
# expect output of tcpdump -e -tt:
# 1112435754.534889 0:a0:24:b5:24:a4 0:1:2:f9:fa:67 ip 74:
# posbi.wsr.ac.at.2592 > lipo.at0.net.nntp: S 3984513449:3984513449(0)
# win 32120 <mss 1460,sackOK,timestamp 3461018906 0,nop,wscale 0> (DF)
my %octets;
while (<>) {
if (/([\d.]+) ([\w:]+) ([\w:]+) ip (\d+): ([-\w.]+)\.(\w+) > ([-\w.]+)\.(\w+):/) {
# print;
# print "-> $1 $2 $3 $4 $5 $6 $7 $8\n";
my $ts = int($1/3600)*3600;
my $octets = $4;
my $sip = $5;
my $sport = $6;
my $dip = $7;
my $dport = $8;
# print "-> proto = $proto\n";
$octets{"$ts $sip $dip"} += $octets;
}
}
for my $i (sort keys %octets) {
print $i, " ", $octets{$i}, "\n";
}
#vim:sw=4