Fellow Monestary Dwellers, I just returned to work from a SANS/GIAC course on Intrusion Detection. In prep for the exam, I am looking to work on a new script for analysing firewall log files (unfortunately, GIAC dropped the practical, so I'm having to ad hoc prepare for the test) :-(. So, here's what I want to do: 
my $regex = "\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}";
my @win_ports = (135, 137, 139, 445, 1025, 1433, 1434);
my @trojan_ports = (113, 15118, 4899);
my $file = "C:\\fw.log";
open LOG, "$file" || die "Can't open fwlog: $!"\n;
while (<LOG>) {
foreach $port(@win_ports) {
   if (/$regex\/$port/g) {
      print 
}

[download]
OK - that's roughly it. I'll have to work on the regex to carefully get just what I want. I'll also write in output files to mate with the arrays at the beginning. Now, questions:

1) What would be the fastest way to chunk through a file, looking for say, 10-20 ports? I could be dealing with files over 100MB, so I want to make sure it's optimized as much as possible.

2) I would like to print them to the file grouped by port, and from there, I can do some more analysis. Suggestions for capturing, for instance, all the matches for port 445 and then writing them to the $win_ports.txt file, then concatenating the matches for 135, etc?

Thanks, monger

Monger +++++++++++++++++++++++++ Munging Perl on the side

In reply to Firewall Log Analysis - port matrices by monger

Title:
Use:  <p> text here (a paragraph) </p>
and:  <code> code here </code>
to format your post, it's "PerlMonks-approved HTML":


  • Posts are HTML formatted. Put <p> </p> tags around your paragraphs. Put <code> </code> tags around your code and data!
  • Titles consisting of a single word are discouraged, and in most cases are disallowed outright.
  • Read Where should I post X? if you're not absolutely sure you're posting in the right place.
  • Please read these before you post! —
  • Posts may use any of the Perl Monks Approved HTML tags:
    a, abbr, b, big, blockquote, br, caption, center, col, colgroup, dd, del, details, div, dl, dt, em, font, h1, h2, h3, h4, h5, h6, hr, i, ins, li, ol, p, pre, readmore, small, span, spoiler, strike, strong, sub, summary, sup, table, tbody, td, tfoot, th, thead, tr, tt, u, ul, wbr
  • You may need to use entities for some characters, as follows. (Exception: Within code tags, you can put the characters literally.)
            For:     Use:
    & &amp;
    < &lt;
    > &gt;
    [ &#91;
    ] &#93;
  • Link using PerlMonks shortcuts! What shortcuts can I use for linking?
  • See Writeup Formatting Tips and other pages linked from there for more info.