求急分析

geminis

Wed Jun 17 14:23:06 2009; ******** IP traffic monitor started ********
Wed Jun 17 14:23:06 2009; ICMP; eth1; 56 bytes; from 61.130.125.69 to 192.168.1.246; time excd
Wed Jun 17 14:23:06 2009; TCP; eth1; 1307 bytes; from 124.115.5.237:443 to 192.168.1.14:2347; first packet
Wed Jun 17 14:23:06 2009; TCP; eth1; 92 bytes; from 192.168.1.1:65422 to 192.168.1.30:2971; first packet
Wed Jun 17 14:23:06 2009; TCP; eth1; 46 bytes; from 192.168.1.30:2971 to 192.168.1.1:65422; first packet
Wed Jun 17 14:23:06 2009; TCP; eth1; 46 bytes; from 192.168.1.232:1040 to 61.172.207.163:80; first packet
Wed Jun 17 14:23:06 2009; UDP; eth1; 46 bytes; from 192.168.1.143:3870 to 202.153.195.43:2436
Wed Jun 17 14:23:06 2009; UDP; eth1; 44 bytes; from 202.153.195.43:2436 to 192.168.1.143:3870
Wed Jun 17 14:23:06 2009; TCP; eth1; 46 bytes; from 192.168.1.239:2304 to 210.5.159.138:6666; first packet
Wed Jun 17 14:23:06 2009; UDP; eth1; 47 bytes; from 218.108.29.22:4518 to 192.168.1.119:4822
Wed Jun 17 14:23:06 2009; TCP; eth1; 46 bytes; from 192.168.1.14:2347 to 124.115.5.237:443; first packet
Wed Jun 17 14:23:06 2009; TCP; eth1; 186 bytes; from 122.224.215.38:8601 to 192.168.1.248:1329; first packet
Wed Jun 17 14:23:06 2009; TCP; eth1; 40 bytes; from 220.181.100.18:80 to 192.168.1.246:13965; first packet
Wed Jun 17 14:23:06 2009; TCP; eth1; 40 bytes; from 220.181.100.19:80 to 192.168.1.246:13961; first packet
Wed Jun 17 14:23:06 2009; TCP; eth1; 40 bytes; from 220.181.100.17:80 to 192.168.1.246:13969; first packet
Wed Jun 17 14:23:06 2009; TCP; eth1; 106 bytes; from 210.5.159.138:6666 to 192.168.1.239:2304; first packet
Wed Jun 17 14:23:06 2009; UDP; eth1; 36 bytes; from 122.225.36.41:2004 to 192.168.1.160:20995
Wed Jun 17 14:23:06 2009; ICMP; eth1; 60 bytes; from 192.168.1.30 to 61.164.42.17; echo req
Wed Jun 17 14:23:06 2009; ICMP; eth1; 60 bytes; from 61.164.42.17 to 192.168.1.30; echo rply
Wed Jun 17 14:23:06 2009; UDP; eth1; 57 bytes; from 113.132.213.156:41211 to 192.168.1.243:15000
Wed Jun 17 14:23:06 2009; UDP; eth1; 959 bytes; from 192.168.1.243:15000 to 113.132.213.156:41211
Wed Jun 17 14:23:06 2009; UDP; eth1; 173 bytes; from 192.168.1.243:15000 to 113.132.213.156:41211
Wed Jun 17 14:23:06 2009; UDP; eth1; 57 bytes; from 113.132.213.156:41211 to 192.168.1.243:15000
Wed Jun 17 14:23:06 2009; UDP; eth1; 575 bytes; from 192.168.1.243:15000 to 113.132.213.156:41211
。。。。

以上是一段iptraf记录下来的日志，现在想要实现的要求：
1. 按UDP，TCP，ICMP分类
2. 各分类中，统计出去的前3个数据量最大的，进入的前3个流量最大的。

表现形式：
TCP: IN
1  x.x.x.x  ? bytes
2  x.x.x.x  ? bytes
3  x.x.x.x  ? bytes

TCP: OUT
1  y.y.y.y  ? bytes
2  y.y.y.y  ? bytes
3  y.y.y.y  ? bytes

UDP: IN
....


我现在也是有办法做，但是我是先把ICMP,UDP,TCP分别匹配出来存入不同的文件中，然后再统计流量，想请教各位大大有没有更精炼，更省性能的脚本，让小弟领悟一下

kwokcn

1. 
   
2. awk '/\*/{next} {if($11!~/^192/) f="IN"; else if($13!~/^192/) f="OUT"; else next; gsub("(:[^ ]*)?(;)?",""); t=$6":"f" "$11; a[t]+=$8} END{for(i in a) print i,a[i]}' URLOGFILE | sort -k3nr | awk '{a[$1]++; if(a[$1]<4) b[$1]=b[$1]"\n"a[$1]" "$2" "$3" bytes"} END{for(i in b) print i""b[i]"\n"}'
   

复制代码

ly5066113

IN 和 OUT 怎么区分的？

geminis

IP to 外网IP --> OUT

外网IP to IP  --> IN

kwokcn

写的啰嗦，抢楼先……

1. 
   
2. sort -k8nr URLOGFILE | awk '!/\*/{gsub(":.*","",$11); gsub("(:.*)?(;)?","",$13); if($11~/^192/) f="OUT"; else f="IN"; gsub(";","",$6); t=$6":"f; if(s[t]<3) a[t]=a[t]"\n"s[t]+1" "(f=="IN"?$11:$13)" "$8" bytes"; s[t]++} END{for(i in a) printf("%s%s\n\n",i,a[i])}'
   

复制代码

[ 本帖最后由 kwokcn 于 2009-6-17 16:25 编辑 ]

geminis

可能是我没有说清楚，不过，大侠的水平已经让我震了一下。

要求是要把同一源IP的进出和出去的流量 相加 起来统计，所以，sort -k8nr 这个排序不行

kwokcn

哦，这样哈～

除了这个还忽略了一个问题：内网IP -> 内网IP，这种是不是不做计算？

geminis

是的，同意，内网到内网可以不计算

kwokcn

得遍历完才能给出结果，再加个数组计算也行，不过我觉得更麻烦，还不如sort一下第一步的结果。你先看看效率吧。

1. 
   
2. awk '/\*/{next} {if($11!~/^192/) {f="IN";n=11} else if($13!~/^192/) {f="OUT";n=13} else next; gsub("(:[^ ]*)?(;)?",""); t=$6":"f" "$n; a[t]+=$8} END{for(i in a) print i,a[i]}' URLOGFILE | sort -k3nr | awk '{a[$1]++; if(a[$1]<4) b[$1]=b[$1]"\n"a[$1]" "$2" "$3} END{for(i in b) print i""b[i]"\n"}'
   

复制代码

geminis

所以的OUT统计要以内网地址为统计依据，如

TCP：OUT
1  192.168.1.30    ？ bytes