Google Groups no longer supports new Usenet posts or subscriptions. Historical content remains viewable.
Dismiss

Script improvement

2 views
Skip to first unread message

Ciccio

unread,
Nov 3, 2009, 11:33:20 AM11/3/09
to
Hi List,

Given the output below,

$ netstat -an | grep TIME_WAIT
10.159.244.250.80 10.159.244.250.49198 49152 0 49152 0
TIME_WAIT
10.159.244.250.49199 10.159.244.250.1984 51148 0 49152 0
TIME_WAIT
10.159.244.250.49200 10.159.244.250.1984 49944 0 49152 0
TIME_WAIT
10.159.244.250.49167 10.159.244.250.1984 50485 0 49152 0
TIME_WAIT
10.159.244.250.49168 10.159.244.250.1984 50363 0 49152 0
TIME_WAIT
10.159.244.250.49169 10.159.244.250.1984 49247 0 49152 0
TIME_WAIT
10.159.244.250.49170 10.159.244.250.1984 49247 0 49152 0
TIME_WAIT
10.159.244.250.49171 10.159.244.250.1984 49249 0 49152 0
TIME_WAIT
10.159.244.250.49172 10.159.244.250.1984 49247 0 49152 0
TIME_WAIT
10.159.244.250.49173 10.159.244.250.1984 49245 0 49152 0
TIME_WAIT
10.159.244.250.49174 10.159.244.250.1984 49251 0 49152 0
TIME_WAIT
10.159.244.250.49175 10.159.244.250.1984 49663 0 49152 0
TIME_WAIT
10.159.244.250.49176 10.159.244.250.1984 51201 0 49152 0
TIME_WAIT
10.159.244.250.49177 10.159.244.250.1984 49495 0 49152 0
TIME_WAIT
10.159.244.250.49181 10.159.244.250.22 49152 0 49152 0
TIME_WAIT
10.159.244.250.49185 10.159.244.50.22 49640 0 49640 0
TIME_WAIT
10.159.244.250.49186 10.159.244.46.22 49640 0 49640 0
TIME_WAIT
10.159.244.250.49187 10.159.244.135.22 49640 0 49640 0
TIME_WAIT
10.159.244.250.49188 10.159.244.250.1984 52081 0 49152 0
TIME_WAIT
10.159.244.250.49194 10.159.244.250.1984 49541 0 49152 0
TIME_WAIT
10.159.244.250.49195 10.159.244.250.1984 49553 0 49152 0
TIME_WAIT

I need to obtain these 4 variables ($LOCALIP $LOCALPORT $REMOTEIP
$REMOTEPORT) to pass to tcpdrop.

Here is what I came up with - and it works, but is there a better/
faster/neater way of doing it?

Cheers

Ciccio


#!/bin/bash

/usr/bin/netstat -an | grep TIME_WAIT > time.wait.file

while read line
do
LOCAL=`echo $line | awk '{print $1}'`
LOCALIP=`echo $LOCAL | cut -d "." -f 1-4`
LOCALPORT=`echo $LOCAL | cut -d "." -f 5`
REMOTE=`echo $line | awk '{print $2}'`
REMOTEIP=`echo $REMOTE | cut -d "." -f 1-4`
REMOTEPORT=`echo $REMOTE | cut -d "." -f 5`
/usr/local/bin/tcpdrop $LOCALIP $LOCALPORT $REMOTEIP $REMOTEPORT
done < time.wait.file

pk

unread,
Nov 3, 2009, 11:56:00 AM11/3/09
to
Ciccio wrote:

> Hi List,
>
> Given the output below,
>
> $ netstat -an | grep TIME_WAIT
> 10.159.244.250.80 10.159.244.250.49198 49152 0 49152 0
> TIME_WAIT

Try

eval $(netstat -an | awk -F '\.| +' -v OFS=. '/TIME_WAIT/{
print "LOCALIP="$1,$2,$3,$4
print "LOCALPORT="$5
print "REMOTEIP="$6,$7,$8,$9
print "REMOTEPORT="$10
}')


Ciccio

unread,
Nov 3, 2009, 12:06:13 PM11/3/09
to

Hi pk,

Thanks for that - I gave that a shot and it came back with the
following:

$ eval $(netstat -an | awk -F '\.| +' -v OFS=. '/TIME_WAIT/{


> print "LOCALIP="$1,$2,$3,$4
> print "LOCALPORT="$5
> print "REMOTEIP="$6,$7,$8,$9
> print "REMOTEPORT="$10
> }')

awk: syntax error near line 1
awk: bailing out near line 1
$

(should it matter, I'm on a Solaris 10 x64 server).

Ciccio

pk

unread,
Nov 3, 2009, 12:07:50 PM11/3/09
to
Ciccio wrote:

> Thanks for that - I gave that a shot and it came back with the
> following:
>
> $ eval $(netstat -an | awk -F '\.| +' -v OFS=. '/TIME_WAIT/{
>> print "LOCALIP="$1,$2,$3,$4
>> print "LOCALPORT="$5
>> print "REMOTEIP="$6,$7,$8,$9
>> print "REMOTEPORT="$10
>> }')
> awk: syntax error near line 1
> awk: bailing out near line 1
> $
>
> (should it matter, I'm on a Solaris 10 x64 server).

Yes that was also indicated by the typical "bailing out" message you got
from awk. Try using /usr/xpg4/bin/awk, which should be a better
implementation.


Ciccio

unread,
Nov 3, 2009, 12:17:08 PM11/3/09
to


Ok,

$ eval $(netstat -an | /usr/xpg4/bin/awk -F '\.| +' -v OFS=. '/


TIME_WAIT/{
print "LOCALIP="$1,$2,$3,$4
print "LOCALPORT="$5
print "REMOTEIP="$6,$7,$8,$9
print "REMOTEPORT="$10
}')

no errors now, but no output either...

Ciccio

pk

unread,
Nov 3, 2009, 12:28:00 PM11/3/09
to
Ciccio wrote:

> Ok,
>
> $ eval $(netstat -an | /usr/xpg4/bin/awk -F '\.| +' -v OFS=. '/
> TIME_WAIT/{
> print "LOCALIP="$1,$2,$3,$4
> print "LOCALPORT="$5
> print "REMOTEIP="$6,$7,$8,$9
> print "REMOTEPORT="$10
> }')
>
> no errors now, but no output either...

That is expected. Check the values of the variables, rather.

Seebs

unread,
Nov 3, 2009, 12:28:59 PM11/3/09
to
On 2009-11-03, Ciccio <lse...@gmail.com> wrote:
> 10.159.244.250.80 10.159.244.250.49198 49152 0 49152 0

> I need to obtain these 4 variables ($LOCALIP $LOCALPORT $REMOTEIP


> $REMOTEPORT) to pass to tcpdrop.

Okay.

How about:

> Here is what I came up with - and it works, but is there a better/
> faster/neater way of doing it?

D='[0-9]*'
IP="$D\.$D\.$D\.$D"
EXPR="\\($IP\\)\.\\($D\\) *\\($IP\\)\.\\($D\\)"

netstat -an | sed -ne "s/.* $EXPR.*TIME_WAIT/tcpdrop \1 \3 \2 \4/p"

You can add a | sh to the end to execute the results, but run it like
this first to be sure it's giving you what you want.

You could type the expression in literally, too, but I liked this better.

-s
--
Copyright 2009, all wrongs reversed. Peter Seebach / usenet...@seebs.net
http://www.seebs.net/log/ <-- lawsuits, religion, and funny pictures
http://en.wikipedia.org/wiki/Fair_Game_(Scientology) <-- get educated!

Kaz Kylheku

unread,
Nov 3, 2009, 4:22:33 PM11/3/09
to
On 2009-11-03, Ciccio <lse...@gmail.com> wrote:
> Hi List,
>
> Given the output below,
>
> $ netstat -an | grep TIME_WAIT
> 10.159.244.250.80 10.159.244.250.49198 49152 0 49152 0
> TIME_WAIT

Who in their right separates port numbers from the IP address with a dot???

Which OS has this retarded netstat program?

Alan Curry

unread,
Nov 3, 2009, 6:45:20 PM11/3/09
to
In article <200911031...@gmail.com>,

Kaz Kylheku <kkyl...@gmail.com> wrote:
>On 2009-11-03, Ciccio <lse...@gmail.com> wrote:
>> Hi List,
>>
>> Given the output below,
>>
>> $ netstat -an | grep TIME_WAIT
>> 10.159.244.250.80 10.159.244.250.49198 49152 0 49152 0
>> TIME_WAIT
>
>Who in their right separates port numbers from the IP address with a dot???

tcpdump prints them that way, yet still manages to be widely used.

--
Alan Curry

Dave

unread,
Nov 3, 2009, 9:45:15 PM11/3/09
to
Ciccio wrote:

> #!/bin/bash

I would have thought
#!/bin/sh

would have been an improvement, and write it in a portable way, without the
GNUisms.

dave

Ben Finney

unread,
Nov 3, 2009, 10:36:53 PM11/3/09
to
Ciccio <lse...@gmail.com> writes:

> #!/bin/bash
>
> /usr/bin/netstat -an | grep TIME_WAIT > time.wait.file
>
> while read line
> do
> LOCAL=`echo $line | awk '{print $1}'`
> LOCALIP=`echo $LOCAL | cut -d "." -f 1-4`
> LOCALPORT=`echo $LOCAL | cut -d "." -f 5`
> REMOTE=`echo $line | awk '{print $2}'`
> REMOTEIP=`echo $REMOTE | cut -d "." -f 1-4`
> REMOTEPORT=`echo $REMOTE | cut -d "." -f 5`
> /usr/local/bin/tcpdrop $LOCALIP $LOCALPORT $REMOTEIP $REMOTEPORT
> done < time.wait.file

Dave <f...@coo.com> writes:

> I would have thought
> #!/bin/sh
>
> would have been an improvement, and write it in a portable way,
> without the GNUisms.


On the other hand, if you *do* want to have the program depend on Bash,
then take advantage of that by using the nestable shell interpolation
form:

LOCAL=$(echo $line | awk '{print $1}')
LOCALIP=$(echo $LOCAL | cut -d "." -f 1-4)
LOCALPORT=$(echo $LOCAL | cut -d "." -f 5)
REMOTE=$(echo $line | awk '{print $2}')
REMOTEIP=$(echo $REMOTE | cut -d "." -f 1-4)
REMOTEPORT=$(echo $REMOTE | cut -d "." -f 5)

--
\ “We are stuck with technology when what we really want is just |
`\ stuff that works.” —Douglas Adams |
_o__) |
Ben Finney

Arcege

unread,
Nov 3, 2009, 11:47:04 PM11/3/09
to

netstat -atn | awk '/TIME_WAIT/{split($4,L,/:/);split($5,R,/:/);print
"tcpdrop",L[1],L[2],R[1],R[2]}' | sh -s

Kaz Kylheku

unread,
Nov 4, 2009, 12:54:48 AM11/4/09
to
On 2009-11-04, Ben Finney <bignose+h...@benfinney.id.au> wrote:
> On the other hand, if you *do* want to have the program depend on Bash,
> then take advantage of that by using the nestable shell interpolation
> form:
>
> LOCAL=$(echo $line | awk '{print $1}')
> LOCALIP=$(echo $LOCAL | cut -d "." -f 1-4)
> LOCALPORT=$(echo $LOCAL | cut -d "." -f 5)
> REMOTE=$(echo $line | awk '{print $2}')
> REMOTEIP=$(echo $REMOTE | cut -d "." -f 1-4)
> REMOTEPORT=$(echo $REMOTE | cut -d "." -f 5)

I don't see any obvious bash dependency. The nestable command substitution
syntax $(...) is POSIX.

Ben Finney

unread,
Nov 4, 2009, 5:06:46 AM11/4/09
to
Kaz Kylheku <kkyl...@gmail.com> writes:

> I don't see any obvious bash dependency. The nestable command
> substitution syntax $(...) is POSIX.

Yes, but it's not Bourne shell, which often seems to be what “no
Bashisms” complainers want us to target if we choose ‘#! /bin/sh’ for
the shebang line.

Apparently, there are some people using OSes which provide a ‘/bin/sh’
that is POSIX-violating in basic ways. I haven't encountered such a
shell for over ten years, and I can't understand those who put up with
it; but it seems they may still exist.

--
\ “We tend to scoff at the beliefs of the ancients. But we can't |
`\ scoff at them personally, to their faces, and this is what |
_o__) annoys me.” —Jack Handey |
Ben Finney

bb

unread,
Nov 4, 2009, 7:17:38 AM11/4/09
to

On Solaris you should use nawk instead of awk.

/bb

Seebs

unread,
Nov 4, 2009, 8:59:11 AM11/4/09
to
On 2009-11-04, Kaz Kylheku <kkyl...@gmail.com> wrote:
> I don't see any obvious bash dependency. The nestable command substitution
> syntax $(...) is POSIX.

Yes, although not as portable as one might wish. (Although I hear rumors
the next SunOS finally abandons the pre-POSIX /bin/sh.)

Maxwell Lol

unread,
Nov 4, 2009, 11:53:40 AM11/4/09
to

>> #!/bin/bash
>>
>> /usr/bin/netstat -an | grep TIME_WAIT > time.wait.file
>>
>> while read line
>> do
>> LOCAL=`echo $line | awk '{print $1}'`
>> LOCALIP=`echo $LOCAL | cut -d "." -f 1-4`
>> LOCALPORT=`echo $LOCAL | cut -d "." -f 5`
>> REMOTE=`echo $line | awk '{print $2}'`
>> REMOTEIP=`echo $REMOTE | cut -d "." -f 1-4`
>> REMOTEPORT=`echo $REMOTE | cut -d "." -f 5`
>> /usr/local/bin/tcpdrop $LOCALIP $LOCALPORT $REMOTEIP $REMOTEPORT
>> done < time.wait.file

You do realize that you are executing 12 different programs per line.

My single-user machine has 300 lines to process.
That's 3000+ processes.

A serious server will have many more. Why not just have one
involcation of awk, instead of thousands? Or use a pure BASH version?


Geoff Clare

unread,
Nov 5, 2009, 8:19:23 AM11/5/09
to
bb wrote:

>> awk: syntax error near line 1
>> awk: bailing out near line 1

> On Solaris you should use nawk instead of awk.

No. You should just set your PATH appropriately so that the
POSIX conforming versions of utilities are found before the
historical versions. Then there is no need to use different
commands on different systems.

PATH=$(getconf PATH):other:stuff

--
Geoff Clare <net...@gclare.org.uk>


Michael Paoli

unread,
Nov 8, 2009, 1:55:19 PM11/8/09
to Ciccio
On Nov 3, 8:33 am, Ciccio <lse...@gmail.com> wrote:
> Given the output below,
>
> $ netstat -an | grep TIME_WAIT
> 10.159.244.250.80 10.159.244.250.49198 49152 0 49152 0 TIME_WAIT
...

> 10.159.244.250.49195 10.159.244.250.1984 49553 0 49152 0 TIME_WAIT
>
> I need to obtain these 4 variables ($LOCALIP $LOCALPORT $REMOTEIP
> $REMOTEPORT) to pass to tcpdrop.
>
> Here is what I came up with - and it works, but is there a better/
> faster/neater way of doing it?
>
> #!/bin/bash
>
> /usr/bin/netstat -an | grep TIME_WAIT > time.wait.file
>
> while read line
> do
> LOCAL=`echo $line | awk '{print $1}'`
> LOCALIP=`echo $LOCAL | cut -d "." -f 1-4`
> LOCALPORT=`echo $LOCAL | cut -d "." -f 5`
> REMOTE=`echo $line | awk '{print $2}'`
> REMOTEIP=`echo $REMOTE | cut -d "." -f 1-4`
> REMOTEPORT=`echo $REMOTE | cut -d "." -f 5`
> /usr/local/bin/tcpdrop $LOCALIP $LOCALPORT $REMOTEIP $REMOTEPORT
> done < time.wait.file

#!/bin/sh
/usr/bin/netstat -an |
fgrep TIME_WAIT |
# space, tab, ., and newline for IFS
while IFS=' .
' read -r l1 l2 l3 l4 LOCALPORT r1 r2 r3 r4 REMOTEPORT x
do
LOCALIP=$l1.$l2.$l3.$l4
REMOTEIP=$r1.$r2.$r3.$r4


/usr/local/bin/tcpdrop $LOCALIP $LOCALPORT $REMOTEIP $REMOTEPORT
done

Or if one doesn't really need those LOCALIP and REMOTEIP variables
set:
#!/bin/sh
/usr/bin/netstat -an |
fgrep TIME_WAIT |
# space, tab, ., and newline for IFS
while IFS=' .
' read -r l1 l2 l3 l4 LOCALPORT r1 r2 r3 r4 REMOTEPORT x
do
/usr/local/bin/tcpdrop $l1.$l2.$l3.$l4 $LOCALPORT $r1.$r2.$r3.$r4
$REMOTEPORT
done

Why use a bunch of stuff that's external to the shell if it's not
needed?
Do use caution when altering IFS.
In this case we modified IFS only and specifically for our read
command,
which should be relatively safe given what we want to do in this
particular case.

0 new messages