Shell Programming and Scripting

Understood.

One thing I may be able to do is sort the packets first by order of packet size, making sure they are still in order of time received after that.


Thanks for confirming.


Mario

I'm trying to understand better what your script does so I can manipulate it to do an additional check on the first field (I want to ensure the lines been compared have the first field within 5 integers of each other).

I'd like to work it out myself, but just need a bit of help with understanding the syntax below...


So, in the part:

awk '
$1 ~ /^[0-9]/ {
if (!last) { last=$12; ip=$4 }


I understand you set the variables last and ip to $12 and $4 respectively, but I'm not sure what the (!last) check does..

Is it "if last exists"?


I get the 'else' to be:

{
if (last==$12) ipc[ip]++
last=0
}

"if last is the same as the 12th field, increment the the ip counter"


Please excuse this 'silly' question, but I'm really trying to get my head around this and not finding it easy.

Regards,

I'm setting the variable 'last' to the value in the 12th field, but only if I've not set this variable before or if the variable contains the value 0. That's what 'if (!last)' means, if the 'last' variable is blank or 0. In AWK, if you reference a variable that's never been set before, it's the same as if it were blank or 0.

Well ipc[] is an associative array. The key is the 'ip' variable set earlier. Yes, we're maintaining counters for each unique IP address we come across where the 12th field is the same on two consecutive lines, and this is where that counter is incremented.

Ok, great.

Thank you for taking the time to answer.


Regards,