As an idea for a "conversation", presuming you mean "packets that go either way between host:port X and host:port Y", you could develop a signature for the conversation by sorting the host:port so that the lower host:port is always to the left, and then the signature is the concatenation of the two. For example, packets from 10.1:8000 to 10.2:5000 as well as packets from 10.2:5000 to 10.1:8000 would both be labeled as "10.1:8000-10.2:5000" in the signature of the conversation, by sorting the two hosts so that the lower host/port is to the left.

Ok, so it looks like your nudge nudged me enough. The loop now looks like this:

for my $line(
            map  { $_->[2] }
            sort {
                     $a->[0] cmp $b->[0]
                             ||
                     $a->[1] <=> $b->[1]
            }
            map  {
                    my @vals = split /\s/, $_;
                    my( $sourceserv, $sourceport ) = (split /:/, $vals
+[0])[0,1];
                    my( $destserv, $destport )  = (split /:/, $vals[2]
+)[0,1];
                    my( $low, $high ) =
                      sort { $a cmp $b }
                      ( "$sourceserv:$sourceport", "$destserv:$destpor
+t" );
                    my( $key ) = $low . '-' . $high;
                    [ $key, $sourceport , $_ ]
            }
            <DATA> ){
  print $line;
}
[download]

And the output as desired:

10.10.10.5:1000 -> 10.10.10.10:8000
10.10.10.5:1000 -> 10.10.10.10:8000
10.10.10.10:8000 -> 10.10.10.5:1000
10.10.10.10:8000 -> 10.10.10.5:1000
10.10.10.10:8000 -> 10.10.10.5:1000
10.10.10.5:1001 -> 10.10.10.10:8000
10.10.10.5:1001 -> 10.10.10.10:8000
10.10.10.10:8000 -> 10.10.10.5:1001
10.10.10.6:1000 -> 10.10.10.10:8000
10.10.10.6:1000 -> 10.10.10.10:8000
10.10.10.10:8000 -> 10.10.10.6:1000
10.10.10.6:1001 -> 10.10.10.10:8000
10.10.10.6:1001 -> 10.10.10.10:8000
10.10.10.10:8000 -> 10.10.10.6:1001
10.10.10.7:1000 -> 10.10.10.10:8000
[download]

Is this efficient? I don't know. Will it run "fast enough"? Also don't know. But I suppose I could let it chug along while I'm here on a Saturday, and if it's still running after I leave, so be it :) (Please don't ask how large the capture file is ;)

Thanks much!



--chargrill

---

$,=42;for(34,0,-3,9,-11,11,-17,7,-5){$*.=pack'c'=>$,+=$_}for(reverse s
+plit//=>$*
){$%++?$ %%2?push@C,$_,$":push@c,$_,$":(push@C,$_,$")&&push@c,$"}$C[$#
+C]=$/;($#C
>$#c)?($ c=\@C)&&($ C=\@c):($ c=\@c)&&($C=\@C);$%=$|;for(@$c){print$_^
+$$C[$%++]}
[download]

I'd recommend cleaning the map up a bit:

map {
  my ($src, $dst) = (split)[0,2];
  my ($src_port) = $src =~ /:(\d+)/;
  ($src, $dst) = ($dst, $src) if $dst lt $src;
  [ "$src-$dst", $src_port, $_ ]
}
[download]

It just looks tidier to me. By the way, what about when you get an address like 10.10.10.14 as the source? That'll sort before 10.10.10.5, so perhaps you should convert the IPs into 4-byte sequences.

---

Jeff japhy Pinyan, P.L., P.M., P.O.D, X.S.: Perl, regex, and perl hacker
How can we ever be the sold short or the cheated, we who for every service have long ago been overpaid? ~~ Meister Eckhart

Since print operates on a list you could dispense with the

for my $line (
    map { ... }
    sort {
    ...
    }
    map {
    ...
    }
    <DATA>) {
    print $line;
}
[download]

and just do

print
    map { ... }
    sort {
    ...
    }
    map {
    ...
    }
    <DATA>;
[download]

without the need to assign each line before printing it. It looks a little easier to my eye.

Cheers,

JohnGG

To separate the packets by connection, you can use a hash of arrays (untested):

my %conn;
while(<DATA>) {
  my ($src_ip, $src_port, $dest_ip, $dest_port, @more) =
    /^([\d\.]+):(\d+) -> ([\d\.]+):(\d+) ...$/;
  my $conn = $conn{join('-', $src_ip, $src_port, $dest_port, $dest_ip)
+} ||= [];
  # $. can be used as a sequence number:
  push @{$conn}, [$., @more]
}

# and then analyze the sequence of packets for every connection:
for my $key (keys %conn) {
  my $conn = $conn{$key};
  my $conn_back = $conn{join('-', reverse split /-/, $key)} || [];
  ...
[download]