Unix Scripts & Counting TCP Connections


 
Thread Tools Search this Thread
Special Forums IP Networking Unix Scripts & Counting TCP Connections
# 1  
Old 01-10-2007
Unix Scripts & Counting TCP Connections

Here's a question I received on a test recently. I'm new to Linux/Unix so if this is easy, don't kill me. What scripting or tools could you use to count and sort the number of connections from each internal host? I'd appreciate any feedback and resources.

"The Cisco PIX firewall provides information in this form about network
connections going through it:
TCP out 64.233.161.99:80 in 192.168.18.52:46778 idle 0:00:00 Bytes 1657961
flags UIO
TCP out 209.104.39.15:80 in 192.168.18.34:52859 idle 0:06:34 Bytes 1026
flags UFRIO
TCP out 64.233.161.104:80 in 192.168.18.19:54409 idle 0:00:02 Bytes 498219
flags UIO
TCP out 209.104.39.15:80 in 192.168.18.22:52154 idle 0:00:01 Bytes 1000
flags UFRIO
TCP out 64.233.161.99:80 in 192.168.18.49:40441 idle 0:00:05 Bytes 60293
flags UIO
TCP out 64.233.161.147:80 in 192.168.18.49:41745 idle 0:00:05 Bytes 1557863
flags UIO

The first IP address is the host outside the firewall in the connection and
the second is the host inside the firewall. Let's say I wanted to easily
count the number of connections that each inside host has open and sort them from most to least. How can I do that using shell scripting, Perl scripts,
and/or basic Unix tools?"
# 2  
Old 01-11-2007
Perl will be better for this

As per my experience such logs are very bulky. Thus using ShellScript will be very slow and it will definately consume much higher CPU as well.

You can start with some good Perl Beginner book. It is very easy as syntax are in-between C and ShellScripting. Learning Perl for UNIX user have lot of advantage as well :-). I'd suggest you following books

Effective Perl Programming: Writing Better Programs With Perl
by Joseph N. Hall, Randal Schwartz

Learning Perl, Third Edition
by Randal L. Schwartz, Tom Phoenix

Go and buy from amazon 2nd hand hook sellers. Each will cost you less then 10$. Just 20$ expences against a prestigious Perl programmer ;-)
# 3  
Old 01-11-2007
MySQL

Hope you can do this in a shell script.



I think UIO is outside connections and UFRIO is for Internal connections according to your output. So grep for UFRIO and sort the output according to time. then achieve the required thing. If you have the exact file content let me know and give me the outputs you needed exactly. I will try a shell script.. Smilie
# 4  
Old 01-12-2007
If you have Python, here's an alternative:

Assuming Sample input is :

Code:
TCP out 64.233.161.99:80 in 192.168.18.52:46778 idle 0:00:00 Bytes 1657961 flags UIO
TCP out 209.104.39.15:80 in 192.168.18.34:52859 idle 0:06:34 Bytes 1026 flags UFRIO
TCP out 64.233.161.104:80 in 192.168.18.19:54409 idle 0:00:02 Bytes 498219 flags UIO
TCP out 209.104.39.15:80 in 192.168.18.22:52154 idle 0:00:01 Bytes 1000 flags UFRIO
TCP out 64.233.161.99:80 in 192.168.18.49:40441 idle 0:00:05 Bytes 60293 flags UIO
TCP out 64.233.161.147:80 in 192.168.18.49:41745 idle 0:00:05 Bytes 1557863 flags UIO


Code:
#!/usr/bin/python
outside = {} #store outside IP address
inside = {} #store inside IP address
for line in open("cisco.log"):
 	line = line.split()
 	out = line[2].split(":")[0] #get out IP address, stripping the port number
 	ins = line[4].split(":")[0] #get inside IP address, stripping the port number
 	if not outside.has_key(out): #if IP address hasn't been seen
 		outside[out] = 1 # initial count to 1
 	else:
 		outside[out] = outside[out] + 1 #add count

 	if not inside.has_key(ins):
 		inside[ins] = 1
 	else:
 		inside[ins] = inside[ins] + 1 #add count

print "Printing count of outside IPs ...." 
for i,k in outside.iteritems():
 	print "IP: %s , count: %d" % (i,k)

print "Printing count of inside IPs...." 	
for i,k in inside.iteritems():
 	print "IP: %s , count: %d" % (i,k)


output:
Code:
Printing count of outside IPs....
IP : 64.233.161.99 , count: 2
IP : 64.233.161.147 , count: 1
IP : 209.104.39.15 , count: 2
IP : 64.233.161.104 , count: 1
Printing count of inside IPs....
IP: 192.168.18.52 , count: 1
IP: 192.168.18.34 , count: 1
IP: 192.168.18.49 , count: 2
IP: 192.168.18.22 , count: 1
IP: 192.168.18.19 , count: 1

# 5  
Old 01-15-2007
hi I am nuts to C programming, I recieved this for my project...anyone...help?

this is wat i recieved...

write a simple TCP/IP server program in C language
The server program can listen at TCP 8080 and send out Hello World
to any TCP client connect to the port 8080 (at client side use the command telnet IP address 8080)

please help....thanks...
# 6  
Old 01-15-2007
microuniz - please review our rules - assignment questions are not permitted.

As the thread that you hijacked has run it's course anyway, I will now close it.

Thanks
ZB
Login or Register to Ask a Question

Previous Thread | Next Thread

10 More Discussions You Might Find Interesting

1. UNIX for Advanced & Expert Users

30 tcp connections Established for a while and after a few minutes are close

Good morning, I need your help please After Restarting Aps or connection, these are connections tcp 0 0 10.80.1.26.57597 10.81.248.79.53008 ESTABLISHED tcp 0 47 10.80.1.26.57607 10.81.248.79.53008 ESTABLISHED tcp 0 0 ... (4 Replies)
Discussion started by: alexcol
4 Replies

2. IP Networking

Need to know reason for connections closed in netstat -p tcp

Hello netstat -p give below 6634176 connections as closed.How do we trace that which all connections are being closed on the server? 1366888371 data packet headers correctly predicted 1195906 connection requests 5227320 connection accepts 5992919... (6 Replies)
Discussion started by: Vishal_dba
6 Replies

3. Shell Programming and Scripting

[Solved] Isolating & Counting IP from log file

Dear Community, today my website was under attack for several hours. 2 specific IPs make a tons of "get requests" to a specific page and apache server goes up and down. Now the problem is solved because I put in firewall blacklist these IPs, but I took a lot of time to analyze the apache log to... (6 Replies)
Discussion started by: Lord Spectre
6 Replies

4. Shell Programming and Scripting

Help with awk array syntax & counting script

..... (3 Replies)
Discussion started by: elbee11
3 Replies

5. IP Networking

How to test max number of tcp connections

Hello, I wanna test max tcp connection value. Please suggest how to do that. Thanks. (2 Replies)
Discussion started by: gstoychev
2 Replies

6. UNIX for Dummies Questions & Answers

syntax for counting & printing record count

Hi I have a complex script which outputs a text file for loading into a db. I now need to enhance this script do that I can issue an ‘lp' command to show the count of the number of records in this file. Can anybody give me the necessary syntax ? (2 Replies)
Discussion started by: malts18
2 Replies

7. Red Hat

How to kill all active tcp connections from an IP?

How to kill all active tcp connections from an IP? I am using CentOS (3 Replies)
Discussion started by: an00p
3 Replies

8. Shell Programming and Scripting

A bi directional script that will monitor the TCP/IP connections between two physical

Dear All , I'm looking for a unix script that will monitor the TCP/IP connections between two physical ip addresses and when it dectes an IP is down it generates an alarm and sends SMS to mobile numbers. Can any one help, I need this urgently. Waiting for positive replies.. ... (3 Replies)
Discussion started by: samura
3 Replies

9. Programming

C & TCP question: AF_INET vs AF_UNIX

Greetings! I am attempting to write a *basic* network client in C. I have manage to create a socket but I have doubts as far as using AF_INET vs AF_UNIX. At the present time, my client runs with AF_INET. Is AF_UNIX faster across hosts using the same OS flavor (Red Hat)? What is the difference... (1 Reply)
Discussion started by: Alan Christen
1 Replies

10. Solaris

Scripts - Processes, CPU, Max. Connections

Hi all, Can any one please tell me how to find these in Unix (Commands) 1. Too many processes connected to the server. 2. High Utilization of CPU. 3. Maximum Number of connections with the database. OS: Sun Solaris 5.8 DB : Oracle 10g Thanks and Regards, Prashanth (1 Reply)
Discussion started by: prashanth_gs
1 Replies
Login or Register to Ask a Question