#!perl use strict; use warnings; use Data::Dumper; my %occur; my $data_pos = tell DATA; # save the position, for later use while () { chomp; #elimnates newline s/\s*

\s*//g;#remove tags and unecessary withespaces my ($time,$src_mac,$dest_mac,$src_ip,$src_port,$dest_ip,$dest_port) = split /\s\|\s/, $_; #check lesser time # be AWARE of the poor time comparison implementation: maybe better transform each time #in seconds from epoch, do the comparison numerically (ie: < or > instead of lt gt), riconvert in what you want if (defined $occur{$dest_ip}{'mintime'}) { $occur{$dest_ip}{'mintime'} = $time if $time lt $occur{$dest_ip}{'mintime'}; } else {$occur{$dest_ip}{'mintime'} = $time} #check greater time if (defined $occur{$dest_ip}{'maxtime'}) { $occur{$dest_ip}{'maxtime'} = $time if $time gt $occur{$dest_ip}{'maxtime'}; } else {$occur{$dest_ip}{'maxtime'} = $time} #you can save in the hash entry other fields you may need.. # $occur{$dest_ip}{'src_mac'} = $src_mac; and so on.. } print Dumper (\%occur); #or to be precise we need unique connections i think undef %occur; seek DATA, $data_pos, 0; #rewind DATA while (){ chomp; s/\s*

\s*//g; my ($time,$src_mac,$dest_mac,$src_ip,$src_port,$dest_ip,$dest_port) = split /\s\|\s/, $_; #change only the hash key creation my $connection = 'from_'.$src_ip.'_to_'.$dest_ip.'_port_'.$dest_port; #all the same now if (defined $occur{$connection}{'mintime'}) { $occur{$connection}{'mintime'} = $time if $time lt $occur{$connection}{'mintime'}; } else {$occur{$connection}{'mintime'} = $time} #check greater time if (defined $occur{$connection}{'maxtime'}) { $occur{$connection}{'maxtime'} = $time if $time gt $occur{$connection}{'maxtime'}; } else {$occur{$connection}{'maxtime'} = $time} } print Dumper (\%occur); __DATA__

03-23 00:37:28.174515 | 8ca982044d00 | c04a00332142 | 192.168.1.100 | 49671 | 180.149.153.11 | 80

03-23 00:37:28.174536 | 8ca982044d00 | c04a00332142 | 192.168.1.100 | 49671 | 180.149.153.11 | 80

03-23 00:41:36.422588 | 8ca982044d00 | c04a00332142 | 192.168.1.100 | 49672 | 180.149.153.11 | 80

03-23 00:44:18.584080 | 8ca982044d00 | c04a00332142 | 192.168.1.100 | 49671 | 180.149.153.11 | 80

03-23 00:44:22.588592 | 8ca982044d00 | c04a00332142 | 192.168.1.100 | 35660 | 180.149.134.61 | 80

03-23 00:45:12.636571 | 8ca982044d00 | c04a00332142 | 192.168.1.100 | 35661 | 180.149.134.61 | 80

####OUTPUT $VAR1 = { '180.149.153.11' => { 'maxtime' => '03-23 00:44:18.584080', 'mintime' => '03-23 00:37:28.174515' }, '180.149.134.61' => { 'maxtime' => '03-23 00:45:12.636571', 'mintime' => '03-23 00:44:22.588592' } }; $VAR1 = { 'from_192.168.1.100_to_180.149.153.11_port_80' => { 'maxtime' => '03-23 00:44:18.584080', 'mintime' => '03-23 00:37:28.174515' }, 'from_192.168.1.100_to_180.149.134.61_port_80' => { 'maxtime' => '03-23 00:45:12.636571', 'mintime' => '03-23 00:44:22.588592' } };