You did not state the format of the log file, so I created my own :) Here is code to do roughly what you want:
my @trojan_ports = (113, 15118, 4899); my %trojan; @trojan{@trojan_ports} = 1; my @win_ports = (135, 137, 139, 445, 1025, 1433, 1434); my %win; @win{@win_ports} = 1; my %port_ip; while (<DATA>) { chomp; my ($ip, $port) = split m"/"; push @{ $port_ip{$port} }, $ip; } foreach my $port (sort {$a <=> $b} keys %port_ip) { if (exists $win{$port}) { print "Windows port $port\n"; } elsif (exists $trojan{$port}) { print "Trojan port $port\n"; } else { print "Unknown port $port\n"; } print " $_\n" foreach @{ $port_ip{$port} }; } __DATA__ 1.2.3.4/135 1.2.3.5/135 1.2.3.6/135 1.2.3.4/137 1.2.3.7/137 1.2.3.9/113 1.2.3.10/111
-Mark
In reply to Re: Firewall Log Analysis - port matrices
by kvale
in thread Firewall Log Analysis - port matrices
by monger
| For: | Use: | ||
| & | & | ||
| < | < | ||
| > | > | ||
| [ | [ | ||
| ] | ] |