open NETSTAT, '-|', '/bin/netstat', '-na' or die $!; while () { next if /^Active/ or /^\s+Proto/ or /^$/; my @sockdata = map {split ':'} split " "; print "$/Warning: SYN! I think we're being SYN'ed$/$/" if $sockdata[7] =~ /syn/i; printf "Local: %s:%s - External: %s:%s - %s$/", @sockdata[3..7]; }