#!/usr/bin/perl
use strict;
use warnings;
my $logfile = $ARGV[0];
my $start_date;
my $end_date;
my %log_totals;
open (FILE< $logfile) or die "Could not open $logfile: $!\n";
for (<FILE>) {
if (/^\d+/) {
($start_date) = m/^(\d+)/o unless ($start_date);
($end_date) = m/^(\d+)/o;
} elsif (/^\s+\d+/o) {
my ($bytes,$source,$destination,$ports) =
m/
^\s+\d+\s+(\d+) # pkts & bytes
.+ # bla bla bla
\s+(\S+) # source
\s+(\S+) # destination
\s+(n\/a|\w+\s+->\s+\w+)$ # ports
/ox;
my ($src_port,$dest_port) = ('any','any');
($src_port,$dest_port) = $ports =~ m/(\w+)\s+->\s+(\w+
+)/o
unless ($ports eq 'n/a');
&data2hash($bytes,$source,$src_port,$destination,$dest
+_port);
# print "$bytes,$source,$src_port,$destination,$dest_p
+ort\n";
}
}
my $start = localtime($start_date);
my $end = localtime($end_date);
print "From: $start\n";
print "To: $end\n";
print "Source Address,Source Port,Destination Address,Destination Port
+,Bytes\n";
for my $key (keys %log_totals) {
print "$key,$log_totals{$key}\n";
}
sub data2hash {
my ($bytes,$src_addr,$src_port,$dest_addr,$dest_port) = @_;
if ($src_addr ne 'anywhere') { # we have a src address match
if ($src_port ne 'any') { # we have a src port match
$log_totals{"$src_addr,$src_port,,"} += $bytes
+;
} elsif ($dest_port ne 'any') { # we have a dest port
+match
$log_totals{"$src_addr,,,$dest_port"} += $byte
+s;
} else { # only src address match
$log_totals{"$src_addr,,,"} += $bytes;
}
} elsif ($dest_addr ne 'anywhere') { # we have a dest address
+match
if ($src_port ne 'any') { # we have a src port match
$log_totals{",$src_port,$dest_addr,"} += $byte
+s;
} elsif ($dest_port ne 'any') { # we have a dest port
+match
$log_totals{",,$dest_addr,$dest_port"} += $byt
+es;
} else { # only dest address match
$log_totals{",,$dest_addr,"} += $bytes;
}
} else { # shouldn't get here
print STDERR "eh?\n";
}
}
close FILE;
#!/bin/bash
/bin/date +%s >>/var/log/ip-acc/ip-acc.log
/sbin/ipchains -L ip-acc -v -x >>/var/log/ip-acc/ip-acc.log
/sbin/ipchains -Z ip-acc
|
