解析文本（日誌文件）

我是一個Perl新手:)我需要你的幫助我想解析我的log.txt，但我很困惑，我不確定這種編碼。解析文本（日誌文件）

我試過log.pcap，但它不像我需要的。所以我想解析文本不解析pcap與遞歸。有沒有人編輯我的編碼？ http://pastebin.com/mwZ1y2kM

這是我的log.txt：（輸入） http://pastebin.com/P0g0D6Pi

Frame 1 (640 bytes on wire, 640 bytes captured) 
    Arrival Time: Jan 31, 2012 19:41:17.121115000 
    [Time delta from previous captured frame: 0.000000000 seconds] 
    [Time delta from previous displayed frame: 0.000000000 seconds] 
    [Time since reference or first frame: 0.000000000 seconds] 
    Frame Number: 1 
    Frame Length: 640 bytes 
    Capture Length: 640 bytes 
    [Frame is marked: False] 
    [Protocols in frame: eth:ip:tcp:http] 
Ethernet II, Src: SunMicro_45:39:78 (01:24:4c:50:79:95), Dst: 
Cisco_03:3c:dc (03:49:12:65:3f:dc) 
    Destination: Cisco_03:3c:dc (03:49:12:65:3f:dc) 
     Address: Cisco_03:3c:dc (03:49:12:65:3f:dc) 
     .... ...0 .... .... .... .... = IG bit: Individual address 
(unicast) 
     .... ..0. .... .... .... .... = LG bit: Globally unique 
address (factory default) 
    Source: SunMicro_45:39:78 (01:24:4c:50:79:95) 
     Address: SunMicro_45:39:78 (01:24:4c:50:79:95) 
     .... ...0 .... .... .... .... = IG bit: Individual address 
(unicast) 
     .... ..0. .... .... .... .... = LG bit: Globally unique 
address (factory default) 
    Type: IP (0x0800) 
Internet Protocol, Src: 221.255.225.143 (221.255.225.143), Dst: 
10.12.264.43 (10.12.264.43) 
    Version: 4 
    Header length: 20 bytes 
    Differentiated Services Field: 0x01 (DSCP 0x00: Default; ECN: 
0x01) 
     0000 00.. = Differentiated Services Codepoint: Default (0x01) 
     .... ..0. = ECN-Capable Transport (ECT): 0 
     .... ...0 = ECN-CE: 0 
    Total Length: 626 
    Identification: 0x3b68 (15208) 
    Flags: 0x02 (Don't Fragment) 
     0.. = Reserved bit: Not Set 
     .1. = Don't fragment: Set 
     ..0 = More fragments: Not Set 
    Fragment offset: 0 
    Time to live: 118 
    Protocol: TCP (0x06) 
    Header checksum: 0xfc4b [correct] 
     [Good: True] 
     [Bad : False] 
    Source:221.255.225.143 (221.255.225.143) 
    Destination: 10.12.264.43 (10.12.264.43) 
Transmission Control Protocol, Src Port: 45267 (45267), Dst Port: http 
(80), Seq: 1, Ack: 1, Len: 566 
    Source port: 45267 (45267) 
    Destination port: http (80) 
    [Stream index: 0] 
    Sequence number: 1 (relative sequence number) 
    [Next sequence number: 587 (relative sequence number)] 
    Acknowledgement number: 1 (relative ack number) 
    Header length: 20 bytes 
    Flags: 0x18 (PSH, ACK) 
     0... .... = Congestion Window Reduced (CWR): Not set 
     .0.. .... = ECN-Echo: Not set 
     ..0. .... = Urgent: Not set 
     ...1 .... = Acknowledgement: Set 
     .... 1... = Push: Set 
     .... .0.. = Reset: Not set 
     .... ..0. = Syn: Not set 
     .... ...0 = Fin: Not set 
    Window size: 17520 
    Checksum: 0xc19e [validation disabled] 
     [Good Checksum: False] 
     [Bad Checksum: False] 
    [SEQ/ACK analysis] 
     [Number of bytes in flight: 586] 
Hypertext Transfer Protocol 
    [truncated] GET /index.php?page=rilis&artikel=999999.9%27+union+all 
+select+0x31303235343830303536%2C 
     [[truncated] Expert Info (Chat/Sequence): GET /index.php? 
page=rilis&artikel=999999.9%27+union+all+select 
+0x31303235343830303536%2C 
      [Message [truncated]: GET /index.php? 
page=rilis&artikel=999999.9%27+union+all+select 
+0x31303235343830303536%2C 
      [Severity level: Chat] 
      [Group: Sequence] 
     Request Method: GET 
     Request URI [truncated]: /index.php? 
page=rilis&artikel=999999.9%27+union+all+select 
+0x31303235343830303536%2C 
     Request Version: HTTP/1.1 
    Host: example.com\r\n 
    Accept: */*\r\n 
    User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; 
SV1; .NET CLR 2.0.50727) Havij\r\n 
    Connection: Close\r\n 
    \r\n

，是的，我想分析是這樣的：（輸出）

Time: Jan 31, 2012 19:41:17 
    IP Address Source: 221.255.225.143 
      Mac Address Source: 010912063cfc 
      Port Numbers Source: 44535 
    IP Address Destination: 10.12.264.43 
      Mac Address Destination: 00f04c080788 
      Port Numbers Destination: 3306 
    HTTP Host: example.com 
      Request Method: GET 
      Request URI: /index.php?page=rilis artikel=999999.9%27+union 
         +all+select+0x31303235343830303536%2C 
      Tool: Havij

謝謝你... 你能幫我嗎？我現在正在做什麼...

來源

2012-03-04 vinka

你想解析它......這是什麼意思？你期望輸出什麼？ – Benoit 2012-03-04 17:54:11

是的，我想解析我的log.txt => http://pastebin.com/mwZ1y2kM，我想像上面輸出...你能幫我嗎？ – vinka 2012-03-04 18:07:37

你的日誌行有點奇怪。某些字段（請求URI和工具）在冒號之前包含空格，這是意外的。我會檢查你的日誌行真的包含那些意想不到的空間。此外，端口號出現兩次而沒有源或目標限定符也有點令人驚訝。再次檢查你的真實日誌文件。以下代碼片段適用於問題中發佈的日誌行。由於字段名稱不唯一，因此假定它們始終以相同的順序打印。

my @fields = ('Time', 'IP Address Source', 'Mac Address Source', 'Port Numbers', 
    'IP Address Destination', 'Mac Address Destination', 'Port Numbers', 'HTTP Host', 
    'Request Method', 'Request URI ', 'Tool '); 

my $re = join(':\s+(.*?)\s+', @fields); 
$re .= ':\s+(.*)'; 

warn $re; 

$line = 'Time: Jan 31, 2012 19:41:17 IP Address Source: 221.255.225.143 Mac Address Source: 010912063cfc Port Numbers: 44535 IP Address Destination: 10.12.264.43 Mac Address Destination: 00f04c080788 Port Numbers: 3306 HTTP Host: example.com Request Method: GET Request URI : /index.php?page=rilis artikel=999999.9%27+union +all+select+0x31303235343830303536%2C Tool : Havij'; 

my @values = $line =~ /$re/; 

print "values = @values\n"

來源

2012-03-04 18:04:55 billw

billw感謝您的關注:)是啊，我想輸出我的解析就像你認爲，但我想解析recursif，因爲我的日誌文件很大，然後認爲它總是打印在相同的順序反覆.. 因爲我總是想着它，但從來沒有完成... 謝謝 – vinka 2012-03-04 18:38:49

您是否試過Net::Pcap或描述的方法here？

來源

2012-03-04 23:03:04 leyrer

我很抱歉，是啊，我試圖從該網站...但我忘了把它... 你能告訴我如何解析文本不是PCAP ?? 謝謝:) – vinka 2012-03-04 23:35:24

解析文本（日誌文件）

回答

相關問題