Yeah, I just updated my post to reflect that :-)
Try this:
use warnings;
use strict;
use Net::IPAddr;
open(file_info,$file) or die "Can't open $file ";
my @records;
while (<file_info>) {
my ( $src_ip, $src_port ) = /IP\s+(\d+(?:\.\d+){3})\.(\d+)/;
my ( $dst_ip, $dst_port ) = />\s+(\d+(?:\.\d+){3})\.(\d+)/;
push @records, [$src_ip , $src_port , $dst_ip , $dst_port];
}
close(file_info);
my %seen;
my @result =
map { $_->[5] }
sort {
$a->[0] != $b->[0] ? $a->[0] <=> $b->[0]
: $a->[1] != $b->[1] ? $a->[1] <=> $b->[1]
: $a->[2] != $b->[2] ? $a->[2] <=> $b->[2]
: $a->[3] <=> $b->[3]
}
map { $seen{$_->[4]}++ ? () : $_ }
map { [ip2num($_->[0]), $_->[1], ip2num($_->[2]), $_->[3], join(',',
+@$_), $_ ] }
@records;
print join(' ',@$_)."\n" for @results;
[4] is the stringified record for efficient existence tests.
[5] is the original record format for better re-use.
-David
Updated: made this node more stand-alone.
|