On Wed, Jun 04, 2003 at 10:51:51AM +0800, gbj spoke thusly:
> time in pro src spt dest dpt
>Jun 02 07:59:31 ACCEPT eth0 tcp 192.168.6.26 4278 64.215.164.33 80
>Jun 02 07:59:32 ACCEPT eth0 tcp 192.168.6.26 4278 64.215.164.33 80
>Jun 02 07:59:32 ACCEPT eth0 tcp 192.168.6.26 4278 64.215.164.33 80
>
>but in fact, this connection information perhaps belonge to one
>connection,I want to know how to combine this information to one
>connection message and got the duration time of the connection,just like
Really, HTTP/1.0 connection ?
>this: start time duration src spt dest dtp
>
> Jun 02 07:59:30 128 192.168.6.26 4269 64.215.164.33
> 80
You'll need to write a script to perform the calculations and joining for
you.
Personally, from the above output, I think that would be quite easy, but
not entirely correct because I reckon you'll have to ignore the source
ports, or at least have some match going on, to determine that if your
start and end source ports are close enough, then they are part of the same
connection, if everything else (src, dst IP && dst port) are the same. [*]
[*] -- This of course also depends on the fact that you don't have any
kernel patches (grsecurity comes to mind) which performs automatic
randomization of the source port (ala OpenBSD).
(snip various bits)
