comment on

I might have an XY Problem, so I'll explain the X part first.

X: I have a packet capture log and I'm trying to go through it to find anomalous traffic patterns. I've already figured out how to parse the log file, and store it in a data structure (maybe not important here, but I think it would be called an AoHoA) that seems to make sense to me for my purposes. I'm specifically interested in seeing the start of a TCP conversation from server foo to server bar, along with the reply back from server bar to server foo.

Y: I would like to sort the output and group related conversations together. I've created a Schwartzian transform in a for loop to go through my data structure, but I seem to have a problem implementing the sort algorithm.

This example code is not quite like my actual code, but produces results the same way. Given the following code:

#!/usr/bin/perl

use strict;
use warnings;

for my $line( 
            map  { $_->[2] }
            sort {
                   $a->[0] <=> $b->[0]
                           ||
                   $a->[1] <=> $b->[1]
            }
            map  {
                    my @vals = split /\s/, $_;
                    my $sourceport = ( split /:/, $vals[0] )[1];
                    my $destport   = ( split /:/, $vals[2] )[1];
                    [ $sourceport, $destport  , $_ ]
            }
            <DATA> ){
  print $line;
}

__DATA__
10.10.10.5:1000 -> 10.10.10.10:8000
10.10.10.5:1000 -> 10.10.10.10:8000
10.10.10.6:1000 -> 10.10.10.10:8000
10.10.10.10:8000 -> 10.10.10.5:1000
10.10.10.10:8000 -> 10.10.10.5:1000
10.10.10.6:1000 -> 10.10.10.10:8000
10.10.10.7:1000 -> 10.10.10.10:8000
10.10.10.10:8000 -> 10.10.10.5:1000
10.10.10.10:8000 -> 10.10.10.6:1000
10.10.10.6:1001 -> 10.10.10.10:8000
10.10.10.5:1001 -> 10.10.10.10:8000
10.10.10.5:1001 -> 10.10.10.10:8000
10.10.10.6:1001 -> 10.10.10.10:8000
10.10.10.10:8000 -> 10.10.10.5:1001
10.10.10.10:8000 -> 10.10.10.6:1001
[download]

I get the following output:

Update: To make it more plain, this is sorting by having all traffic from server foo (sorted by source port) first, then all replies back from server bar (sorted by destination port).

10.10.10.5:1000 -> 10.10.10.10:8000
10.10.10.5:1000 -> 10.10.10.10:8000
10.10.10.6:1000 -> 10.10.10.10:8000
10.10.10.6:1000 -> 10.10.10.10:8000
10.10.10.7:1000 -> 10.10.10.10:8000
10.10.10.6:1001 -> 10.10.10.10:8000
10.10.10.5:1001 -> 10.10.10.10:8000
10.10.10.5:1001 -> 10.10.10.10:8000
10.10.10.6:1001 -> 10.10.10.10:8000
10.10.10.10:8000 -> 10.10.10.5:1000
10.10.10.10:8000 -> 10.10.10.5:1000
10.10.10.10:8000 -> 10.10.10.5:1000
10.10.10.10:8000 -> 10.10.10.6:1000
10.10.10.10:8000 -> 10.10.10.5:1001
10.10.10.10:8000 -> 10.10.10.6:1001
[download]

I would like the output instead to be sorted like this:

Update: To make it more plain, this is sorting by having traffic from server foo (sorted by source port) immediately followed by the reply from server bar before displaying the next 'conversation' from server foo (based on the next source port).

# space added for emphasis, don't need it in the output

10.10.10.5:1000 -> 10.10.10.10:8000
10.10.10.5:1000 -> 10.10.10.10:8000
10.10.10.10:8000 -> 10.10.10.5:1000
10.10.10.10:8000 -> 10.10.10.5:1000
10.10.10.10:8000 -> 10.10.10.5:1000

10.10.10.6:1000 -> 10.10.10.10:8000
10.10.10.6:1000 -> 10.10.10.10:8000
10.10.10.10:8000 -> 10.10.10.6:1000

10.10.10.7:1000 -> 10.10.10.10:8000
10.10.10.6:1001 -> 10.10.10.10:8000
10.10.10.5:1001 -> 10.10.10.10:8000
10.10.10.5:1001 -> 10.10.10.10:8000
10.10.10.10:8000 -> 10.10.10.5:1001

10.10.10.6:1001 -> 10.10.10.10:8000
10.10.10.10:8000 -> 10.10.10.6:1001
[download]

I've tried various incarnations of the intermediary sort, using different || and && operators, trying to $a->[0] <=> $b->[1], but all to no avail. I'm sure that there's something relatively simple that I'm just not grokking, or leaving out. So if anyone could gently nudge me in the right direction, I would greatly appreciate it.

--chargrill

$,=42;for(34,0,-3,9,-11,11,-17,7,-5){$*.=pack'c'=>$,+=$_}for(reverse s
+plit//=>$*
){$%++?$ %%2?push@C,$_,$":push@c,$_,$":(push@C,$_,$")&&push@c,$"}$C[$#
+C]=$/;($#C
>$#c)?($ c=\@C)&&($ C=\@c):($ c=\@c)&&($C=\@C);$%=$|;for(@$c){print$_^
+$$C[$%++]}
[download]

In reply to Sorting out troubles with advanced-ish sort by chargrill

Posts are HTML formatted. Put <p> </p> tags around your paragraphs. Put <code> </code> tags around your code and data!

Titles consisting of a single word are discouraged, and in most cases are disallowed outright.

Read Where should I post X? if you're not absolutely sure you're posting in the right place.

Please read these before you post! —

Posts may use any of the Perl Monks Approved HTML tags:

a, abbr, b, big, blockquote, br, caption, center, col, colgroup, dd, del, details, div, dl, dt, em, font, h1, h2, h3, h4, h5, h6, hr, i, ins, li, ol, p, pre, readmore, small, span, spoiler, strike, strong, sub, summary, sup, table, tbody, td, tfoot, th, thead, tr, tt, u, ul, wbr

You may need to use entities for some characters, as follows. (Exception: Within code tags, you can put the characters literally.)

	For:		Use:
	&		`&`
	<		`<`
	>		`>`
	[		`[`
	]		`]`

Link using PerlMonks shortcuts! What shortcuts can I use for linking?

See Writeup Formatting Tips and other pages linked from there for more info.