Octet Regex

amearse has asked for the wisdom of the Perl Monks concerning the following question:

Here is an example of a regex that will search a text file and return a list of all the dates and their corresponding IP's. Currently it won't run using Active Perl on Win2k. Here is the code:

#!/usr/bin/perl -w
use strict;

my $hacklist = "hack.txt";


open HACK, $hacklist or die "Can't Open $hacklist";

my ($octet, $date);

while (<HACK>){
    $octet ||= $_ if /($hacklist =~ m~((\d{1,3}\.){3}\d{1,3})~)/;
    $date ||=$_ if /Date:/;
}

close HACK;

print $date;
print $octet;
[download]

Here is the output:

Date:   Monday, April 23, 2001  02:45 PM
Use of uninitialized value in print at C:\hack\hack.pl line 19.
[download]

Forever indebted to your wisdom. -amearse

Comment on Octet Regex Select or Download Code

Replies are listed 'Best First'.
Re: Octet Regex by kschwab (Vicar) on Apr 27, 2001 at 23:52 UTC
Well, $octet is uninitialized because: `$octet \|\|= $_ if /($hacklist =~ m~((\d{1,3}\.){3}\d{1,3})~)/;` [download] never matches anything. It doesn't match anything since $hacklist is set to "hack.txt" early on in your script: `my $hacklist = "hack.txt";` [download] Perhaps you meant $_=~ rather than $hacklist =~ ?	[reply] [d/l] [select]
Re: Re: Octet Regex by amearse (Sexton) on Apr 28, 2001 at 00:02 UTC
When I used the $_ convention I came up with this: `/(21/4/2001 - 21:00:16) --- Intruder Detection Event - [Remote =~ m~((\d{1,3}\.){3}\d{1,3})~)/: unmatched [] in regexp at C:\hack\hac +k.pl line 12, <HACK> line 79.` [download] Thanks for your help kschwab.	[reply] [d/l]
Re: Octet Regex by Sprad (Hermit) on Apr 27, 2001 at 23:51 UTC
A snippet of the input file would be helpful, as well. --- A fair fight is a sign of poor planning.	[reply]
Re: Octet Regex by MeowChow (Vicar) on Apr 27, 2001 at 23:58 UTC
I can't help but wonder what you plan to be doing with the IP addresses in $hacklist... In any event, the line should probably read: `$octet \|\|= $_ if /(\d{1,3}\.){3}\d{1,3}/;` [download] update: sorry for jumping the gun -- I can see from your response to kschwab that you are parsing an IDS log, not endeavoring to create one ;) MeowChow s aamecha.s a..a\u$&owag.print	[reply] [d/l]