i have a data that i got from analysing tcpdump file. the result is below.

First column is time, follow by src mac, dest_mac, src_ip & src_port and dest_ip_dest_ip.

i have data from one source ip to a destination ip which appears in different rows, only with the same information except little different in time. Instead of displaying all this information, i will like to loop through the file, if destination ip is the same, record the start time and the end time, the take the difference and print just one row with the difference

My result at the moment

 03-23 00:37:28.174515 | 8ca982044d00 | c04a00332142 | 192.168.1.100 |
+ 49671 | 180.149.153.11 | 80 
 03-23 00:37:28.174536 | 8ca982044d00 | c04a00332142 | 192.168.1.100 |
+ 49671 | 180.149.153.11 | 80 
 03-23 00:41:36.422588 | 8ca982044d00 | c04a00332142 | 192.168.1.100 |
+ 49672 | 180.149.153.11 | 80 
 03-23 00:44:18.584080 | 8ca982044d00 | c04a00332142 | 192.168.1.100 |
+ 49671 | 180.149.153.11 | 80 
 03-23 00:44:22.588592 | 8ca982044d00 | c04a00332142 | 192.168.1.100 |
+ 35660 | 180.149.134.61 | 80 
 03-23 00:45:12.636571 | 8ca982044d00 | c04a00332142 | 192.168.1.100 |
+ 35661 | 180.149.134.61 | 80
[download]

What i am expecting instead is:

 (00:44:22 - 00:37:28) | 8ca982044d00 | c04a00332142 | 192.168.1.100 |
+ 35661 | 180.149.134.61 | 80
[download]

Any help will be appreciated thank you

---

---

Posts are HTML formatted. Put <p> </p> tags around your paragraphs. Put <code> </code> tags around your code and data!

Titles consisting of a single word are discouraged, and in most cases are disallowed outright.

Read Where should I post X? if you're not absolutely sure you're posting in the right place.

Please read these before you post! —

• How do I compose an effective node title?
• How do I post a question effectively?
• Markup in the Monastery

Posts may use any of the Perl Monks Approved HTML tags:

a, abbr, b, big, blockquote, br, caption, center, col, colgroup, dd, del, details, div, dl, dt, em, font, h1, h2, h3, h4, h5, h6, hr, i, ins, li, ol, p, pre, readmore, small, span, spoiler, strike, strong, sub, summary, sup, table, tbody, td, tfoot, th, thead, tr, tt, u, ul, wbr

You may need to use entities for some characters, as follows. (Exception: Within code tags, you can put the characters literally.)

	For:		Use:
	&		&
	<		&lt;
	>		&gt;
	[		&#91;
	]		&#93;

Link using PerlMonks shortcuts! What shortcuts can I use for linking?

See Writeup Formatting Tips and other pages linked from there for more info.