src=2.2.2.2 dst=1.1.1.1 src_port=50232 dst_port=514 reason=AGE OUT
src=2.2.2.2 dst=1.1.1.1 src_port=50232 dst_port=514 reason=Traffic Denied
src=3.3.3.3 dst=4.4.4.4 src_port=50235 dst_port=123 reason=AGE OUT
src=3.3.3.3 dst=4.4.4.4 src_port=50235 dst_port=123 reason=AGE OUT
####
#!/usr/bin/perl
use strict;
use warnings;
my $file = 'tmpfile';
my $match;
my $numelements;
open my $info, $file or die "Could not open $file: $!";
while( my $line = <$info>) {
if ( $line =~ m/(src\=\d+\.\d+\.\d+\.\d+\sdst\=\d+\.\d+\.\d+\.\d+\ssrc\_port\=\d+\sdst\_port\=\d+).*AGE OUT/ ) {
$match = "$1";
push (my @dups, $line);
while( my $twoline = <$info> ) {
if ( $twoline =~ /$match/ ) {
push @dups, $twoline;
}
}
$numelements = @dups;
print "$match has $numelements elements\n";
if ( $numelements > 1 ) {
print join("\n", @dups);
}
}
}
close $info;
####
$./tcprst.pl
src=2.2.2.2 dst=1.1.1.1 src_port=50232 dst_port=514 has 2 elements
src=2.2.2.2 dst=1.1.1.1 src_port=50232 dst_port=514 reason=AGE OUT
src=2.2.2.2 dst=1.1.1.1 src_port=50232 dst_port=514 reason=Traffic Denied
$
####
src=2.2.2.2 dst=1.1.1.1 src_port=50232 dst_port=514 has 2 elements
src=2.2.2.2 dst=1.1.1.1 src_port=50232 dst_port=514 reason=AGE OUT
src=2.2.2.2 dst=1.1.1.1 src_port=50232 dst_port=514 reason=Traffic Denied
src=3.3.3.3 dst=4.4.4.4 src_port=50235 dst_port=123 has 2 elements
src=3.3.3.3 dst=4.4.4.4 src_port=50235 dst_port=123 reason=AGE OUT
src=3.3.3.3 dst=4.4.4.4 src_port=50235 dst_port=123 reason=AGE OUT