Ok, so it looks like your nudge nudged me enough. The loop now looks like this:

for my $line(
            map  { $_->[2] }
            sort {
                     $a->[0] cmp $b->[0]
                             ||
                     $a->[1] <=> $b->[1]
            }
            map  {
                    my @vals = split /\s/, $_;
                    my( $sourceserv, $sourceport ) = (split /:/, $vals
+[0])[0,1];
                    my( $destserv, $destport )  = (split /:/, $vals[2]
+)[0,1];
                    my( $low, $high ) =
                      sort { $a cmp $b }
                      ( "$sourceserv:$sourceport", "$destserv:$destpor
+t" );
                    my( $key ) = $low . '-' . $high;
                    [ $key, $sourceport , $_ ]
            }
            <DATA> ){
  print $line;
}
[download]

And the output as desired:

10.10.10.5:1000 -> 10.10.10.10:8000
10.10.10.5:1000 -> 10.10.10.10:8000
10.10.10.10:8000 -> 10.10.10.5:1000
10.10.10.10:8000 -> 10.10.10.5:1000
10.10.10.10:8000 -> 10.10.10.5:1000
10.10.10.5:1001 -> 10.10.10.10:8000
10.10.10.5:1001 -> 10.10.10.10:8000
10.10.10.10:8000 -> 10.10.10.5:1001
10.10.10.6:1000 -> 10.10.10.10:8000
10.10.10.6:1000 -> 10.10.10.10:8000
10.10.10.10:8000 -> 10.10.10.6:1000
10.10.10.6:1001 -> 10.10.10.10:8000
10.10.10.6:1001 -> 10.10.10.10:8000
10.10.10.10:8000 -> 10.10.10.6:1001
10.10.10.7:1000 -> 10.10.10.10:8000
[download]

Is this efficient? I don't know. Will it run "fast enough"? Also don't know. But I suppose I could let it chug along while I'm here on a Saturday, and if it's still running after I leave, so be it :) (Please don't ask how large the capture file is ;)

Thanks much!

$,=42;for(34,0,-3,9,-11,11,-17,7,-5){$*.=pack'c'=>$,+=$_}for(reverse s
+plit//=>$*
){$%++?$ %%2?push@C,$_,$":push@c,$_,$":(push@C,$_,$")&&push@c,$"}$C[$#
+C]=$/;($#C
>$#c)?($ c=\@C)&&($ C=\@c):($ c=\@c)&&($C=\@C);$%=$|;for(@$c){print$_^
+$$C[$%++]}
[download]

I'd recommend cleaning the map up a bit:

map {
  my ($src, $dst) = (split)[0,2];
  my ($src_port) = $src =~ /:(\d+)/;
  ($src, $dst) = ($dst, $src) if $dst lt $src;
  [ "$src-$dst", $src_port, $_ ]
}
[download]

It just looks tidier to me. By the way, what about when you get an address like 10.10.10.14 as the source? That'll sort before 10.10.10.5, so perhaps you should convert the IPs into 4-byte sequences.

---

Jeff japhy Pinyan, P.L., P.M., P.O.D, X.S.: Perl, regex, and perl hacker
How can we ever be the sold short or the cheated, we who for every service have long ago been overpaid? ~~ Meister Eckhart

By the way, what about when you get an address like 10.10.10.14 as the source? That'll sort before 10.10.10.5, so perhaps you should convert the IPs into 4-byte sequences.

When packed, the strings will be shorter and we could use the default { $a cmp $b } compare function. That makes the packed version much faster, and it would require less memory. Note the ingenious use of 0 or 1 to in lieu of $src.

print map  { substr($_, 13) }
      sort
      map  { my ($src, $dst) = (split)[0, 2];
             $src = pack('C4n', split(/[.:]/, $src));
             $dst = pack('C4n', split(/[.:]/, $dst));
             $src lt $dst ? "$src${dst}0$_"
                          : "$dst${src}1$_"           }
      <DATA>;
[download]

Actually, adding $_ is redundant, since we can reconstruct it. The following would cut the memory usage in half:

print map  { my @f = unpack('C4nC4na', $_);
             my $src = "$f[0].$f[1].$f[2].$f[3]:$f[4]";
             my $dst = "$f[5].$f[6].$f[7].$f[8]:$f[9]";
             ($src, $dst) = ($dst, $src) if $f[10];
             "$src -> $dst\n"                          }
      sort
      map  { my ($src, $dst) = (split)[0, 2];
             $src = pack('C4n', split(/[.:]/, $src));
             $dst = pack('C4n', split(/[.:]/, $dst));
             $src lt $dst ? "$src${dst}0"
                          : "$dst${src}1"             }
      <DATA>;
[download]

Both of the above have been tested. They only work if the addresses are IPv4 addresses in dotted form.

By the way, if you have memory problems, you could use an external sort tool as follows:

{
   open(local *TEMP, '>', $sort_input);

   while (<DATA>) {
      my ($src, $dst) = (split)[0, 2];
      $src = pack('C4n', split(/[.:]/, $src));
      $dst = pack('C4n', split(/[.:]/, $dst));
      my $data = $src lt $dst ? "$src${dst}0" : "$dst${src}1";
      print TEMP (unpack('H*', $data), "\n");
   }
}

...[ call external sort tool ]...

{
   open(local *TEMP, '<', $sort_output);

   while (<TEMP>) {
      chomp;
      my @f = unpack('C4nC4na', pack('H*', $_));
      my $src = "$f[0].$f[1].$f[2].$f[3]:$f[4]";
      my $dst = "$f[5].$f[6].$f[7].$f[8]:$f[9]";
      ($src, $dst) = ($dst, $src) if $f[10];
      print("$src -> $dst\n");
   }
}
[download]

The convertion to hex is to avoid having newlines in your data.

Since print operates on a list you could dispense with the

for my $line (
    map { ... }
    sort {
    ...
    }
    map {
    ...
    }
    <DATA>) {
    print $line;
}
[download]

and just do

print
    map { ... }
    sort {
    ...
    }
    map {
    ...
    }
    <DATA>;
[download]

without the need to assign each line before printing it. It looks a little easier to my eye.

Cheers,

JohnGG