0

one line of iptable log is:

Jan  1 21:41:19 x kernel: [838760.885218] IPTables-Dropped: IN=eth0 OUT= MAC=x:x:x:x:x:x:x:x:x:x:x:x:x:x:x:x:00:x:00:00:x:00:x:x:x:x SRC=x.x.x.x DST=x.x.x.x LEN=70 TOS=0x00 PREC=0x00 TTL=64 ID=0 DF PROTO=UDP SPT=37739 DPT=53 LEN=50 

and to watch it live , i used :

tailf /var/log/kern.log

but as you can see, it contains a lot of information in it. so i tried to view only source and destination field of that line.

I changed my command to some thing like this :

tailf /var/log/kern.log | sed -n -e 's/^.*DST: //p'

but still nothing, Is there any way i can change it to show me only source and destination IP addresses? or should i go to more complicated solution than a command.

1

[...] tried to view only source and destination field of that line.

I would use grep. Something like this:

echo "Jan  1 21:41:19 x kernel: [838760.885218] IPTables-Dropped: IN=eth0 OUT= MAC=x:x:x:x:x:x:x:x:x:x:x:x:x:x:x:x:00:x:00:00:x:00:x:x:x:x SRC=192.168.1.10 DST=192.168.1.20 LEN=70 TOS=0x00 PREC=0x00 TTL=64 ID=0 DF PROTO=UDP SPT=37739 DPT=53 LEN=50" | egrep -o 'SRC=[0-9.]* DST=[0-9.]*'
SRC=192.168.1.10 DST=192.168.1.20

In your case it would become:

tailf /var/log/kern.log | egrep -o 'SRC=[0-9.]* DST=[0-9.]*'
0

Find out the maximum column exsists from below command

awk '{print NF}' /var/log/kern.log/sort -rn | head -1 and assigned that value in for loop maximum value

From given input maximum column exsists is 22 so we assigned the value in 22 in for loop

for ((i=1;i<=22;i++)); do tail -f /var/log/kern.log |awk -v i="$i" '$i ~ "SRC" {print $i}';tail -f /var/log/kern.log | awk -v i="$i" '$i ~ "DST" {print $i}'  ; done

output
SRC=x.x.x.x
DST=x.x.x.x
0

What did you expect? The line doesn't contain DST:. Use

sed -n 's/.*\(SRC=.*DST=[^ ]\).*/\1/p'

to remove everything part the match inside the \(\)

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.