hjp
/
simple
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

Support for GRE tunnels

This commit is contained in:
hjp 2014-05-05 11:14:20 +00:00
parent 9a4119c6f0
commit e999d2e7b2
1 changed files with 16 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

16
tcpdump_tools/by_hosts
View File

@ -1,10 +1,16 @@
#!/usr/bin/perl -w #!/usr/bin/perl -w
use strict; use strict;
# 15:20:56.789680 P 0:48:54:5c:4d:f1 0:0:0:0:0:1 ip 1514: wsrppp15.wsr.ac.at.1605 > 195.202.170.227.smtp: P 420284195:420285643(1448) ack 3689574287 win 32120 <nop,nop,timestamp 2363951 3391664> (DF) # 15:20:56.789680 P 0:48:54:5c:4d:f1 0:0:0:0:0:1 ip 1514: wsrppp15.wsr.ac.at.1605 > 195.202.170.227.smtp: P 420284195:420285643(1448) ack 3689574287 win 32120 <nop,nop,timestamp 2363951 3391664> (DF)
# 09:29:10.114541 In ethertype IPv4 (0x0800), length 457: 199.19.109.76.5070 > 143.130.145.221.5060: SIP, length: 413
# 09:29:10.114541 Out ethertype IPv4 (0x0800), length 457: 199.19.109.76.5070 > 143.130.145.221.5060: SIP, length: 413
# 09:29:10.114541 In ethertype IPv4 (0x0800), length 60: 46.137.105.92.80 > 143.130.28.14.29878: Flags [S.], seq 790291952, ack 2509176833, win 17922, options [mss 1436], length 0
# 09:29:10.114541 Out ethertype IPv4 (0x0800), length 60: 46.137.105.92.80 > 143.130.28.14.29878: Flags [S.], seq 790291952, ack 2509176833, win 17922, options [mss 1436], length 0
my %octets; my %octets;
while (<>) { while (<>) {
if (/([\d.:]+) ([\w:]+) ([\w:]+) ip (\d+): ([-\w.]+)\.(\w+) > ([-\w.]+)\.(\w+):/) { if (/([\d.:]+) ([\w:]+) ([\w:]+) ip (\d+): ([-\w.]+)\.(\w+) > ([-\w.]+)\.(\w+):/) {
# ethernet
# print; # print;
# print "-> $1 $2 $3 $4 $5 $6 $7 $8\n"; # print "-> $1 $2 $3 $4 $5 $6 $7 $8\n";
my $octets = $4; my $octets = $4;
@ -14,6 +20,16 @@ while (<>) {
my $dport = $8; my $dport = $8;
# print "-> proto = $proto\n"; # print "-> proto = $proto\n";
$octets{"$sip - $dip"} += $octets; $octets{"$sip - $dip"} += $octets;
} elsif (/(In|Out) ethertype IPv[46] \(0x....\), length (\d+): ([-\w.]+)\.(\w+) > ([-\w.]+)\.(\w+):/) {
# GRE tunnel
my $octets = $2;
my $sip = $3;
my $sport = $4;
my $dip = $5;
my $dport = $6;
# print "-> proto = $proto\n";
$octets{"$sip - $dip"} += $octets;
} }
} }
for my $i (sort { $octets{$a} <=> $octets{$b} } keys %octets) { for my $i (sort { $octets{$a} <=> $octets{$b} } keys %octets) {