in reply to Read output from tcpdump
#!/usr/bin/perl use strict; while (<>) { if ( /IP\s+(\d+\.\d+\.\d+\.\d+)(\.(\d+))?\s+>\s+(\d+\.\d+\.\d+\.\d ++)(\.(\d+))?\:\s+(\w+)/ ) { my ($srcip, $srcport, $dstip, $dstport, $proto) = ($1, $3, $4, $6, $7); # icmp: port := 0 (should be n/a) printf "%16s [%5d] --> %16s [%5d] (%s)\n", $srcip, $srcport, $dstip, $dstport, lc($proto); } } __END__ Piping your example through it yields (works with: tcpdump -nlq): 192.168.11.128 [ 3415] --> 66.249.93.9 [ 53] (udp) 66.102.9.104 [ 80] --> 192.168.11.100 [40323] (tcp) 192.168.11.100 [40323] --> 66.102.9.104 [ 80] (tcp) 192.168.11.6 [ 22] --> 192.168.11.128 [59921] (tcp) 192.168.11.128 [59921] --> 192.168.11.6 [ 22] (tcp) 72.21.192.209 [ 53] --> 192.168.11.128 [49172] (udp) 192.168.11.128 [ 0] --> 72.21.192.209 [ 0] (icmp)
|
|---|
| Replies are listed 'Best First'. | |
|---|---|
|
Re^2: Read output from tcpdump
by Anonymous Monk on Nov 16, 2009 at 13:04 UTC |