perl 스크립트 : IP 주소를 얻기 위해 metacharater를 사용합니다.

Question

결과에서 IP 주소를 얻기 위해 몇 가지 옵션을 사용해 왔습니다 ...하지만 작동하지 않는 것 같습니다 ... 왜?

누구든지 제안 할 수 있습니까? 그 결과를 룰 파일의 IP 주소와 비교하고 찾아서 사용자에게 경고를 보내고 싶습니다. 나는 어떻게해야합니까?

#!/usr/local/bin/perl 

use File::Tail; 

chdir("/var/log/snort"); 

foreach my $fol(glob "*.*.*.*") 
{ 

     print "Opening $fol\n"; 
     chdir("/var/log/snort/$fol"); 
     foreach my $subfile(glob "*:*") 
     { 
       print "opening $subfile\n"; 
       push(@files,File::Tail->new(name=>"$subfile",debug=>$debug)); 
     } 
     while (1) 
     { 
       ($nfound,$timeleft,@pending)= File::Tail::select(undef,undef,undef,$timeout,@files); 
       unless ($nfound) 
       { 
         print "Nothing to print \n"; 
       } 
       else 
        foreach(@pending) 
         { 
           if(/((\d{1,3}.\d{1,3}.\d{1,3}.\d{1,3}):\d{1,5} -> (\d{1,3}.\d{1,3}.\d{1,3}.\d{1,3}):\d{1,5})/) 
                #OR 
           if (/([.\d]+):\d -> ([.\d]+):\d/) 
           { 
           #print $_ -> read; 
           print $_ -> {"input"}. " (".localtime(time).") ".$2 -> read; 
           } 
         } 
       } 
     } 

} 

나는이 디스플레이에서 WAN 포트의 IP 주소를 얻으려면 ...

Mar 30 01:49:57 2011) 03/30-01:49:50.607858 119.40.116.196:80 -> 192.168.242.133:34628 
TCP:34628-80 (Wed Mar 30 01:49:57 2011) TCP TTL:128 TOS:0x0 ID:34869 IpLen:20 DgmLen:40 
TCP:34629-80 (Wed Mar 30 01:49:57 2011) 03/30-01:49:51.309716 119.40.116.196:80 -> 192.168.242.133:34629 
UDP:41415-53 (Wed Mar 30 01:49:57 2011) 03/30-01:49:47.220999 192.168.242.2:53 -> 192.168.242.133:41415 
UDP:44705-53 (Wed Mar 30 01:49:57 2011) 03/30-01:49:47.427011 192.168.242.2:53 -> 192.168.242.133:44705 
UDP:50539-53 (Wed Mar 30 01:49:57 2011) 03/30-01:49:47.213455 192.168.242.2:53 -> 192.168.242.133:50539 
TCP:34628-80 (Wed Mar 30 01:49:57 2011) ***AP**F Seq: 0x2F3E700A Ack: 0x2359814F Win: 0xFAF0 TcpLen: 20 
TCP:34629-80 (Wed Mar 30 01:49:57 2011) TCP TTL:128 TOS:0x0 ID:34871 IpLen:20 DgmLen:40 
UDP:41415-53 (Wed Mar 30 01:49:57 2011) UDP TTL:128 TOS:0x0 ID:34859 IpLen:20 DgmLen:65 
UDP:44705-53 (Wed Mar 30 01:49:57 2011) UDP TTL:128 TOS:0x0 ID:34861 IpLen:20 DgmLen:153 
UDP:50539-53 (Wed Mar 30 01:49:57 2011) UDP TTL:128 TOS:0x0 ID:34857 IpLen:20 DgmLen:179 

Answer 1

변경하면 foreach 루프로 :

foreach(@pending) { 
    my line = $_->read; 
    if ($line =~ /\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}:\d{1,5} -> (\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}):(\d{1,5})/) { 
     print $_->{"input"}. " (".localtime(time).") IP:$1 PORT:$2\n"; 
    } 
}