When open iptables's log file,we can got some messages like this: time in pro src spt dest dpt Jun 02 07:59:30 ACCEPT eth0 tcp 192.168.6.26 4269 64.215.164.33 80 Jun 02 07:59:31 ACCEPT eth0 tcp 192.168.6.26 4269 64.215.164.33 80 Jun 02 07:59:31 ACCEPT eth0 tcp 192.168.6.26 4269 64.215.164.33 80 Jun 02 07:59:31 ACCEPT eth0 tcp 192.168.6.26 4269 64.215.164.33 80 Jun 02 07:59:31 ACCEPT eth0 tcp 192.168.6.26 4278 64.215.164.33 80 Jun 02 07:59:32 ACCEPT eth0 tcp 192.168.6.26 4278 64.215.164.33 80 Jun 02 07:59:32 ACCEPT eth0 tcp 192.168.6.26 4278 64.215.164.33 80 but in fact, this connection information perhaps belonge to one connection,I want to know how to combine this information to one connection message and got the duration time of the connection,just like this: start time duration src spt dest dtp Jun 02 07:59:30 128 192.168.6.26 4269 64.215.164.33 80 Thanx U all!