src=2.2.2.2 dst=1.1.1.1 src_port=50232 dst_port=514 reason=AGE OUT src=2.2.2.2 dst=1.1.1.1 src_port=50232 dst_port=514 reason=Traffic Denied src=3.3.3.3 dst=4.4.4.4 src_port=50235 dst_port=123 reason=AGE OUT src=3.3.3.3 dst=4.4.4.4 src_port=50235 dst_port=123 reason=AGE OUT #### #!/usr/bin/perl use strict; use warnings; my $file = 'tmpfile'; my $match; my $numelements; open my $info, $file or die "Could not open $file: $!"; while( my $line = <$info>) { if ( $line =~ m/(src\=\d+\.\d+\.\d+\.\d+\sdst\=\d+\.\d+\.\d+\.\d+\ssrc\_port\=\d+\sdst\_port\=\d+).*AGE OUT/ ) { $match = "$1"; push (my @dups, $line); while( my $twoline = <$info> ) { if ( $twoline =~ /$match/ ) { push @dups, $twoline; } } $numelements = @dups; print "$match has $numelements elements\n"; if ( $numelements > 1 ) { print join("\n", @dups); } } } close $info; #### $./tcprst.pl src=2.2.2.2 dst=1.1.1.1 src_port=50232 dst_port=514 has 2 elements src=2.2.2.2 dst=1.1.1.1 src_port=50232 dst_port=514 reason=AGE OUT src=2.2.2.2 dst=1.1.1.1 src_port=50232 dst_port=514 reason=Traffic Denied $ #### src=2.2.2.2 dst=1.1.1.1 src_port=50232 dst_port=514 has 2 elements src=2.2.2.2 dst=1.1.1.1 src_port=50232 dst_port=514 reason=AGE OUT src=2.2.2.2 dst=1.1.1.1 src_port=50232 dst_port=514 reason=Traffic Denied src=3.3.3.3 dst=4.4.4.4 src_port=50235 dst_port=123 has 2 elements src=3.3.3.3 dst=4.4.4.4 src_port=50235 dst_port=123 reason=AGE OUT src=3.3.3.3 dst=4.4.4.4 src_port=50235 dst_port=123 reason=AGE OUT