IPFCOUNT(1) User Contributed Perl Documentation IPFCOUNT(1)NAMEipfcount - Summarise ipf logs
SYNOPSISipfcount [-binNopq] [-e expr] -k key[,key...] [-t top] [file...]
DESCRIPTIONipfcount summarises ipf(8) logs by counting and sorting the fields.
The following fields are recognised:
iface group rule action shost sport dhost dport proto flags type
dir
By default, all input lines are processed - this can be restricted with
the -b, -p, -i and -o options to count blocked, passed, incoming and
outgoing packets respectively.
The logs can be filtered further with the -e option - see "EXAMPLES".
At least one sort key must be given using the -k option. ipfcount will
list all the unique values in this field, from the most to the least
common. Repeat this option to create multiple lists, or use comma
separated keys to create nested lists.
To list only the first top values in each field, use the -t option.
If the -n option is given, port numbers and IP addresses are resolved
in the output. With the -N, option, all input lines are resolved before
filtering (which may take some time).
If no files are specified, ipfcount reads from standard input.
OPTIONS-b Count blocked packets
-i Count incoming packets
-n Lookup host and service names
-N Lookup names before filtering
-o Count outgoing packets
-p Count passed packets
-q Don't print headers
-e expr
Filter expression - see "EXAMPLES"
-k key[,key...]
Sort key(s)-t top
Show only the top top entries
EXAMPLES
Show the top 10 blocked ports for incoming traffic:
ipfcount-bi -k dport -t 10 /var/log/local0
Show the hosts attempting to connect to those ports:
ipfcount-bi -k dport,shost -t 10 /var/log/local0
Sort incoming connections by interface and protocol:
ipfcount-pi -k iface,proto /var/log/local0
For more sophisticated filtering, use the -e option - it takes a Perl
expression, using field names as variables.
(These examples assume that ipmon(8) was invoked without the -n
option.)
Show blocked ports above 1024:
ipfcount-bi -e 'dport > 1024' -k dport /var/log/local0
Show traffic leaving the local network:
ipfcount-po -e 'dhost !~ /^192\.168/' -k dhost /var/log/local0
The expression passed to -e can also modify field values. This
'feature' may occasionally be useful.
Show the class C network of blocked hosts:
ipfcount-bi -e 'shost =~ s/\d+$/0/' -k shost /var/log/local0
Note that Perl uses different comparison operators for numbers and
strings - see perlop(1).
SEE ALSOipf(8), ipmon(8), perlop(1)AUTHOR
Robert Archer <ipfcount@deathbeforedecaf.net>
perl v5.20.3 2015-10-07 IPFCOUNT(1)
