When open iptables's log file,we can got some messages like this:
time in pro src spt dest dpt
Jun 02 07:59:30 ACCEPT eth0 tcp 192.168.6.26 4269 64.215.164.33 80
Jun 02 07:59:31 ACCEPT eth0 tcp 192.168.6.26 4269 64.215.164.33 80
Jun 02 07:59:31 ACCEPT eth0 tcp 192.168.6.26 4269 64.215.164.33 80
Jun 02 07:59:31 ACCEPT eth0 tcp 192.168.6.26 4269 64.215.164.33 80
Jun 02 07:59:31 ACCEPT eth0 tcp 192.168.6.26 4278 64.215.164.33 80
Jun 02 07:59:32 ACCEPT eth0 tcp 192.168.6.26 4278 64.215.164.33 80
Jun 02 07:59:32 ACCEPT eth0 tcp 192.168.6.26 4278 64.215.164.33 80
but in fact, this connection information perhaps belonge to one connection,I want to know how to combine
this information to one connection message and got the duration time of the connection,just like this:
start time duration src spt dest dtp
Jun 02 07:59:30 128 192.168.6.26 4269 64.215.164.33 80
Thanx U all!
