my ($src, $tgt, $prt, $r); while(<>){ ($src, $tgt, $prt) = $_ =~ m/\s+(\S+)\s*\d+ dst outside (.*?) (\d+) by access-gr/; die "notgood: $_\n" unless $prt; $r->{$src}->{$tgt}->{$prt}++; } foreach $src (keys %{$r}) { # foreach source ip foreach $tgt (keys %{$r->{$src}}) { # foreach target ip foreach $prt (keys %{$r->{$src}->{$tgt}}) { printf "%-16s %-16s %-6s counted %d times\n", $src, $tgt, $prt, $r->{$src}->{$tgt}->{$prt}; } } } #### 10.10.10.10 4.4.4.4 80 counted 1 times 10.10.10.10 6.6.6.6 80 counted 1 times 1.1.1.1 7.7.7.7 53 counted 1 times 1.1.1.1 3.3.3.3 53 counted 1 times 1.1.1.1 4.4.4.4 80 counted 2 times 1.1.1.1 9.9.9.9 53 counted 1 times 1.1.1.1 9.9.9.9 443 counted 1 times 1.1.1.1 9.9.9.9 80 counted 1 times 5.5.5.5 3.3.3.3 1433 counted 1 times 5.5.5.5 6.6.6.6 161 counted 1 times 5.5.5.5 6.6.6.6 443 counted 1 times 5.5.5.5 6.6.6.6 80 counted 1 times 8.8.8.8 4.4.4.4 80 counted 1 times 8.8.8.8 6.6.6.6 80 counted 1 times 2.2.2.2 7.7.7.7 80 counted 2 times 2.2.2.2 3.3.3.3 80 counted 2 times 2.2.2.2 4.4.4.4 80 counted 1 times