$ perl -wE'say 5.5*1024 / length("Nov 17 11:09:25 proxy02 kernel: OUTPUT LOGIN= OUT=eth0 SRC=11.11.11.0 DST=192.168.3.1 LEN=1420 TOS=0x00 PREC=0x00 TTL=64 ID=10523 DF PROTO=TCP SPT=3128 DPT=1921 WINDOW=16659 RES=0x00 ACK URGP=0\n")'
29.0309278350515
####
$ perl -MDevel::Size=total_size -wE'my %h; for (1..100) { ++$h{ pack "C4", 1,2,3,$_ } } say total_size(\%h)/100'
47.56
####
use strict;
use warnings;
my $fn_in = 'internal.out';
my $fn_ex = 'external.out';
my @internals = (
[ pack('C4', 10,0,0,0 ), pack('C4', 255,0,0,0 ) ],
# [ pack('C4', 10,10,0,0 ), pack('C4', 255,255,0,0 ) ],
[ pack('C4', 192,3,3,0 ), pack('C4', 255,255,254,0 ) ],
[ pack('C4', 192,168,0,0 ), pack('C4', 255,255,0,0 ) ],
# [ pack('C4', 192,168,24,0 ), pack('C4', 255,255,248,0 ) ],
);
sub is_internal {
my $packed_ip = shift;
for (@internals) {
return 1 if $packed_ip & $_->[1] eq $_->[0];
}
return 0;
}
sub extract {
open(my $fh_in, '>', $fn_in)
or die("Can't create file $fn_in: $!\n");
open(my $fh_ex, '>', $fn_ex)
or die("Can't create file $fn_ex: $!\n");
my %seen;
while (<>) {
my $ip = /DST=(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})/
or next;
my $packed_ip = pack('C4', split(/\./, $ip));
next if $seen{$packed_ip}++;
print { is_internal($packed_ip) ? $fh_in : $fh_ex } "$ip\n";
}
undef %seen; # Free mem.
}
sub sort {
my ($fn) = @_;
my @packed_ips;
{
open(my $fh, '<', $fn)
or die("Can't open file $fn: $!\n");
while (<$fh>) {
chomp;
my $packed_ip = pack('C4', split(/\./, $ip));
push @packed_ips = $packed_ip;
}
}
@packed_ips = sort @packed_ips;
{
open(my $fh, '>', $fn)
or die("Can't create file $fn: $!\n");
for (@packed_ips) {
my $ip = join('.', unpack('C4', $packed_ip));
print("$ip\n");
}
}
}
sub main {
extract();
sort_file($fn_in);
sort_file($fn_ex);
}
main();