Monks,

I consider myself fairly decent at Perl, but when it comes to what I consider complex data structures (hash of hashes, hashes of arrays), I'm lost. I've been reading Chapter 9: Data Structures of the Camel for the past few days now trying to avoid posting here, but I finally broke down. I have the following data from a portscanning program:

* + 192.168.99.199   salamander.acme.com
        |___   135  DCE endpoint resolution
        |___   139  NETBIOS Session Service
        |___  1031  BBN IAD
        |___  5800  Virtual Network Computing server
        |___  5900  Virtual Network Computing server
                |___ RFB 003.003.
* + 192.168.99.131   AMSPWD099WKG
        |___   135  DCE endpoint resolution
        |___   139  NETBIOS Session Service
        |___   445  Microsoft-DS
        |___  1027  ICQ?
        |___  1099  BBN IAD
* + 192.168.99.133   VLW4S
        |___   139  NETBIOS Session Service
* + 192.168.99.136   WKBX0010B-A
        |___    80  World Wide Web HTTP
                |___ HTTP/1.1 200 OK..Server: Microsoft-IIS/5.0..Date:
+ Thu, 14 Mar 2002 14:37:54 GMT..Connection: Keep-Alive..Content-Lengt
+h: 
1270..
        |___   135  DCE endpoint resolution
        |___   139  NETBIOS Session Service
        |___   443  https  MCom
        |___   445  Microsoft-DS
        |___  1058  nim
        |___  1059  nimreg
        |___  1433  Microsoft-SQL-Server
        |___  5003  Claris FileMaker Pro
[download]

I wrote a CGI interface on a secure internal webserver that allows my team to upload a file and add the data to a MySQL DB via DBI. I'm not having any problems with .csv files, but this one is throwing me for a loop. I contemplated telling the team only to use programs that have the ability to produce .csv files, but that limits them to only a few useless programs and I would like to figure this out anyhow. I'm thinking the easiest way to add this data to the MySQL DB would be to build a hash that uses the ip as the key and the rest of the data will be the values, but then I have the scenario, where the banner for certain ports (ie. 80) have to stay with that port, so I guess I need another hash that uses the port number as the key and the banner as the value? Well, I know this is pretty far off, but here is my attempt at sorting out this mess. I would appreciate any assistance that my fellow monks could provide:

#!/usr/bin/perl -w
 
use strict;
 
my $infile = './portscan2.txt';
my ($ip, @fields, @cname, @ports, @banners);
my @field_names = qw(cname port banner);
my %data;
 
# Change the input record separator
local $/ = "* +";
 
 
open INFILE, "$infile" or die "Can't open $infile: $!\n";
while (<INFILE>){
 next unless /\b(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})\b/;
 $ip = $1;
 push (@cname, $1) if /\b$ip\b\s{2,}(\w[^\s]*|\[Unknown\])\s{2}/;
 push (@ports, $1) if /((\d{1,5}?)\s{2}(\w[^\n]*))\s{2}/;
 push (@banners, $1) if /\Q|___\E\s+([^"]*)\.{1,3}\s+\n/;
 
 my $fields = [@cname, @ports, @banners];
 
 @{$data{$ip}}{@field_names} = [$fields];
}
 
foreach my $ip (keys %data) {
  print "IP = $ip, Computer Name = $data{$ip}{cname}->[0][0]\n";
}
 
close INFILE;
[download]

This prints:

IP = 192.168.99.136, Computer Name = salamander.acme.com
IP = 192.168.99.199, Computer Name = salamander.acme.com
IP = 192.168.99.131, Computer Name = salamander.acme.com
IP = 192.168.99.133, Computer Name = salamander.acme.com
[download]

Thanks,
Dru
Another satisfied monk.

---

---

Posts are HTML formatted. Put <p> </p> tags around your paragraphs. Put <code> </code> tags around your code and data!

Titles consisting of a single word are discouraged, and in most cases are disallowed outright.

Read Where should I post X? if you're not absolutely sure you're posting in the right place.

Please read these before you post! —

• How do I compose an effective node title?
• How do I post a question effectively?
• Markup in the Monastery

Posts may use any of the Perl Monks Approved HTML tags:

a, abbr, b, big, blockquote, br, caption, center, col, colgroup, dd, del, details, div, dl, dt, em, font, h1, h2, h3, h4, h5, h6, hr, i, ins, li, ol, p, pre, readmore, small, span, spoiler, strike, strong, sub, summary, sup, table, tbody, td, tfoot, th, thead, tr, tt, u, ul, wbr

You may need to use entities for some characters, as follows. (Exception: Within code tags, you can put the characters literally.)

	For:		Use:
	&		&
	<		&lt;
	>		&gt;
	[		&#91;
	]		&#93;

Link using PerlMonks shortcuts! What shortcuts can I use for linking?

See Writeup Formatting Tips and other pages linked from there for more info.