From e999d2e7b2dfe46e2d4bba7ad909966f64261e1e Mon Sep 17 00:00:00 2001 From: hjp Date: Mon, 5 May 2014 11:14:20 +0000 Subject: [PATCH] Support for GRE tunnels --- tcpdump_tools/by_hosts | 16 ++++++++++++++++ 1 file changed, 16 insertions(+) diff --git a/tcpdump_tools/by_hosts b/tcpdump_tools/by_hosts index 685ab95..3394ab9 100755 --- a/tcpdump_tools/by_hosts +++ b/tcpdump_tools/by_hosts @@ -1,10 +1,16 @@ #!/usr/bin/perl -w use strict; # 15:20:56.789680 P 0:48:54:5c:4d:f1 0:0:0:0:0:1 ip 1514: wsrppp15.wsr.ac.at.1605 > 195.202.170.227.smtp: P 420284195:420285643(1448) ack 3689574287 win 32120 (DF) +# 09:29:10.114541 In ethertype IPv4 (0x0800), length 457: 199.19.109.76.5070 > 143.130.145.221.5060: SIP, length: 413 +# 09:29:10.114541 Out ethertype IPv4 (0x0800), length 457: 199.19.109.76.5070 > 143.130.145.221.5060: SIP, length: 413 +# 09:29:10.114541 In ethertype IPv4 (0x0800), length 60: 46.137.105.92.80 > 143.130.28.14.29878: Flags [S.], seq 790291952, ack 2509176833, win 17922, options [mss 1436], length 0 +# 09:29:10.114541 Out ethertype IPv4 (0x0800), length 60: 46.137.105.92.80 > 143.130.28.14.29878: Flags [S.], seq 790291952, ack 2509176833, win 17922, options [mss 1436], length 0 + my %octets; while (<>) { if (/([\d.:]+) ([\w:]+) ([\w:]+) ip (\d+): ([-\w.]+)\.(\w+) > ([-\w.]+)\.(\w+):/) { + # ethernet # print; # print "-> $1 $2 $3 $4 $5 $6 $7 $8\n"; my $octets = $4; @@ -14,6 +20,16 @@ while (<>) { my $dport = $8; # print "-> proto = $proto\n"; $octets{"$sip - $dip"} += $octets; + } elsif (/(In|Out) ethertype IPv[46] \(0x....\), length (\d+): ([-\w.]+)\.(\w+) > ([-\w.]+)\.(\w+):/) { + # GRE tunnel + my $octets = $2; + my $sip = $3; + my $sport = $4; + my $dip = $5; + my $dport = $6; + # print "-> proto = $proto\n"; + $octets{"$sip - $dip"} += $octets; + } } for my $i (sort { $octets{$a} <=> $octets{$b} } keys %octets) {