#!/usr/bin/perl
use strict;
use warnings;

use constant USER => 0;
use constant TIME => 1;

my ($user, $start, $stop) = Get_User( time => '02:42:10', ip => '192.1
+68.201.57' );
print "$user had 192.168.201.57 from Start: ", $start, " until Stop: "
+, $stop, "\n";

sub Get_User {
    die "Incorrect number of parameters" if @_ % 2;
    my %find = @_;
    die "time & ip are required parameters" if ! exists $find{time} ||
+ ! exists $find{ip};
    my $pos = tell DATA;
    my ($user, $start, $stop);
    my %session;
    while ( <DATA> ) {
        my ($time, $uid, $action, $sid, $ip) = (split /,/)[1, 2, 5, 6,
+ 14];
        next if $ip ne $find{ip};
        $session{ $sid }{$action} = [ $uid, $time ];
    }
    seek DATA, $pos, 0;
    # assume we have both
    for ( values %session ) {
        next if ! exists $_->{Start} || ! exists $_->{Stop};
        if ( $_->{Start}[TIME] le $find{time} && $_->{Stop}[TIME] ge $
+find{time} ) {
            return $_->{Start}[USER], $_->{Start}[TIME], $_->{Stop}[TI
+ME];
        }
    }
    # assume we only have a stop
    for ( values %session ) {
        next if exists $_->{Start};
        if ( $_->{Stop}[TIME] ge $find{time} ) {
            return $_->{Start}[USER], '--:--:--', $_->{Stop}[TIME];
        }
    }
    # assume we only have a start
    for ( values %session ) {
        next if exists $_->{Stop};
        if ( $_->{Start}[TIME] le $find{time} ) {
            return $_->{Start}[USER], $_->{Start}[TIME], '--:--:--';
        }
    }
    return qw(NONE --:--:-- --:--:--);
}
__DATA__
10/26/2004,00:02:41,jdoe,VPN_General,10.0.218.253,Stop,3D70FA44,3559,F
+ramed,PPP,390032,3722000,4120,5306,192.168.201.57,20824,192.168.17.25
+2
10/26/2004,00:03:42,bsmith,VPN_General,10.0.76.203,Start,3D70FA86,,Fra
+med,PPP,,,,,192.168.201.57,20925,192.168.17.252
10/26/2004,00:23:03,bsmith,VPN_General,10.0.76.203,Stop,3D70FA86,1161,
+Framed,PPP,1136608,8358544,8534,10609,192.168.201.57,20925,192.168.17
+.252
10/26/2004,00:23:16,syoung,VPN_General,10.0.132.222,Start,3D70FA99,,Fr
+amed,PPP,,,,,192.168.201.57,20944,192.168.17.252
10/26/2004,02:34:44,syoung,VPN_General,10.0.132.222,Stop,3D70FA99,7886
+,Framed,PPP,432752,497712,2888,2665,192.168.201.57,20944,192.168.17.2
+52
[download]