From: m.guessod on
On May 6, 2:08 am, Paul Herber <SubstituteMyFirstNameH...(a)pherber.com>
wrote:
> On Mon, 5 May 2008 16:04:53 -0700 (PDT), Gene <gene.ress...(a)gmail.com>
> wrote:
>
>
>
> >On May 5, 5:43 am, Paul Herber <SubstituteMyFirstNameH...(a)pherber.com>
> >wrote:
> >> On Sun, 4 May 2008 20:10:09 -0700 (PDT), Gene <gene.ress...(a)gmail.com>
> >> wrote:
>
> >> >On Apr 29, 8:09 am, Paul Herber
> >> ><SubstituteMyFirstNameH...(a)pherber.com> wrote:
> >> >> On Tue, 29 Apr 2008 03:55:09 -0700 (PDT), xyz
>
> >> >> <lavanyaredd...(a)gmail.com> wrote:
> >> >> >I have a string
> >> >> >16:23:18.659343 131.188.37.230.22 131.188.37.59.1398 tcp 168
>
> >> >> >for example lets say for the above string
> >> >> >16:23:18.659343 -- time
> >> >> >131.188.37.230 -- srcaddress
> >> >> >22 --srcport
> >> >> >131.188.37.59 --destaddress
> >> >> >1398 --destport
> >> >> >tcp --protocol
> >> >> >168 --size
> >> >> >i need to split this string such that i need to get all these
> >> >> >parameters....the filed widths are not fixed...some time i have 4/3
> >> >> >digits srcport
>
> >> >> Can you not split on the spaces? Whatever programming language you are
> >> >> using may even have a split function.
>
> >> >Indeed. You have to love perl for stuff like this:
>
> >> >use strict;
> >> >use Data::Dumper;
>
> >> >sub parse {
> >> > my $s = shift;
> >> > my $d = '\d+';
> >> > my ($time, $srcaddr, $srcport, $dstaddr, $dstport, $protocol, $size)
> >> >=
> >> > $s =~ /($d:$d:$d\.$d) \s+
> >> > ($d\.$d\.$d\.$d)\.($d) \s+
> >> > ($d\.$d\.$d\.$d)\.($d) \s+
> >> > (\S+) \s+
> >> > ($d)/x;
>
> >> > { time => $time,
> >> > srcaddr => $srcaddr, srcport => $srcport,
> >> > dstaddr => $dstaddr, dstport => $dstport,
> >> > protocol => $protocol, size => $size }
> >> >}
>
> >> >sub main {
> >> > my $str = '16:23:18.659343 131.188.37.230.22 131.188.37.59.1398 tcp
> >> >168';
> >> > my $result = parse($str);
> >> > print Dumper($result);
> >> >}
>
> >> >main;
>
> >> well, I was thinking more along the lines of
> >> <?php
> >> $input = '16:23:18.659343 131.188.37.230.22 131.188.37.59.1398 tcp
> >> 168';
> >> list ($time, $src, $dest, $protocol, $size) = split(" ", $input);
> >> ?>
>
> >> Splitting the port from the address is left as an exercise for the
> >> reader.
>
> >Thanks.
>
> >I've written maybe 100,000 lines of perl to do stuff like this. In
> >the long run you are better off with a custom regex that matches the
> >line. It's better for input error format detection and it self-
> >documents the input format.
>
> Fair enough, but your code will break with IPv6
>
> --
> Regards, Paul Herber, Sandrila Ltd.
> TTCN (test case notation) for Visio http://www.ttcn.sandrila.co.uk/

How about using BNF grammar to define the input string, this would go
a long way towards ipv6 support. There are code generators out there
that will , with the custom gramamar you made, generate a parser.
What language will you code in?
From: Paul Herber on
On Sun, 4 May 2008 20:10:09 -0700 (PDT), Gene <gene.ressler(a)gmail.com>
wrote:

>On Apr 29, 8:09�am, Paul Herber
><SubstituteMyFirstNameH...(a)pherber.com> wrote:
>> On Tue, 29 Apr 2008 03:55:09 -0700 (PDT), xyz
>>
>> <lavanyaredd...(a)gmail.com> wrote:
>> >I have a string
>> >16:23:18.659343 131.188.37.230.22 131.188.37.59.1398 tcp 168
>>
>> >for example lets say for the above string
>> >16:23:18.659343 -- time
>> >131.188.37.230 � -- srcaddress
>> >22 � � � � � � � � � � � �--srcport
>> >131.188.37.59 � �--destaddress
>> >1398 � � � � � � � � �--destport
>> >tcp � � � � � � � � � �--protocol
>> >168 � � � � � � � � �--size
>> >i need to split this string such that i need to get all these
>> >parameters....the filed widths are not fixed...some time i have 4/3
>> >digits srcport
>>
>> Can you not split on the spaces? Whatever programming language you are
>> using may even have a split function.
>
>Indeed. You have to love perl for stuff like this:
>
>use strict;
>use Data::Dumper;
>
>sub parse {
> my $s = shift;
> my $d = '\d+';
> my ($time, $srcaddr, $srcport, $dstaddr, $dstport, $protocol, $size)
>=
> $s =~ /($d:$d:$d\.$d) \s+
> ($d\.$d\.$d\.$d)\.($d) \s+
> ($d\.$d\.$d\.$d)\.($d) \s+
> (\S+) \s+
> ($d)/x;
>
> { time => $time,
> srcaddr => $srcaddr, srcport => $srcport,
> dstaddr => $dstaddr, dstport => $dstport,
> protocol => $protocol, size => $size }
>}
>
>sub main {
> my $str = '16:23:18.659343 131.188.37.230.22 131.188.37.59.1398 tcp
>168';
> my $result = parse($str);
> print Dumper($result);
>}
>
>main;

well, I was thinking more along the lines of
<?php
$input = '16:23:18.659343 131.188.37.230.22 131.188.37.59.1398 tcp
168';
list ($time, $src, $dest, $protocol, $size) = split(" ", $input);
?>

Splitting the port from the address is left as an exercise for the
reader.



--
Regards, Paul Herber, Sandrila Ltd.
http://www.sdl.sandrila.co.uk/ SDL/MSC/TTCN/URN/UML2 for Visio
From: Gene on
On Apr 29, 8:09 am, Paul Herber
<SubstituteMyFirstNameH...(a)pherber.com> wrote:
> On Tue, 29 Apr 2008 03:55:09 -0700 (PDT), xyz
>
> <lavanyaredd...(a)gmail.com> wrote:
> >I have a string
> >16:23:18.659343 131.188.37.230.22 131.188.37.59.1398 tcp 168
>
> >for example lets say for the above string
> >16:23:18.659343 -- time
> >131.188.37.230   -- srcaddress
> >22                        --srcport
> >131.188.37.59    --destaddress
> >1398                  --destport
> >tcp                    --protocol
> >168                  --size
> >i need to split this string such that i need to get all these
> >parameters....the filed widths are not fixed...some time i have 4/3
> >digits srcport
>
> Can you not split on the spaces? Whatever programming language you are
> using may even have a split function.

Indeed. You have to love perl for stuff like this:

use strict;
use Data::Dumper;

sub parse {
my $s = shift;
my $d = '\d+';
my ($time, $srcaddr, $srcport, $dstaddr, $dstport, $protocol, $size)
=
$s =~ /($d:$d:$d\.$d) \s+
($d\.$d\.$d\.$d)\.($d) \s+
($d\.$d\.$d\.$d)\.($d) \s+
(\S+) \s+
($d)/x;

{ time => $time,
srcaddr => $srcaddr, srcport => $srcport,
dstaddr => $dstaddr, dstport => $dstport,
protocol => $protocol, size => $size }
}

sub main {
my $str = '16:23:18.659343 131.188.37.230.22 131.188.37.59.1398 tcp
168';
my $result = parse($str);
print Dumper($result);
}

main;
From: Gene on
On May 5, 5:43 am, Paul Herber <SubstituteMyFirstNameH...(a)pherber.com>
wrote:
> On Sun, 4 May 2008 20:10:09 -0700 (PDT), Gene <gene.ress...(a)gmail.com>
> wrote:
>
>
>
>
>
> >On Apr 29, 8:09 am, Paul Herber
> ><SubstituteMyFirstNameH...(a)pherber.com> wrote:
> >> On Tue, 29 Apr 2008 03:55:09 -0700 (PDT), xyz
>
> >> <lavanyaredd...(a)gmail.com> wrote:
> >> >I have a string
> >> >16:23:18.659343 131.188.37.230.22 131.188.37.59.1398 tcp 168
>
> >> >for example lets say for the above string
> >> >16:23:18.659343 -- time
> >> >131.188.37.230   -- srcaddress
> >> >22                        --srcport
> >> >131.188.37.59    --destaddress
> >> >1398                  --destport
> >> >tcp                    --protocol
> >> >168                  --size
> >> >i need to split this string such that i need to get all these
> >> >parameters....the filed widths are not fixed...some time i have 4/3
> >> >digits srcport
>
> >> Can you not split on the spaces? Whatever programming language you are
> >> using may even have a split function.
>
> >Indeed.  You have to love perl for stuff like this:
>
> >use strict;
> >use Data::Dumper;
>
> >sub parse {
> >  my $s = shift;
> >  my $d = '\d+';
> >  my ($time, $srcaddr, $srcport, $dstaddr, $dstport, $protocol, $size)
> >=
> >    $s =~ /($d:$d:$d\.$d)         \s+
> >               ($d\.$d\.$d\.$d)\.($d) \s+
> >               ($d\.$d\.$d\.$d)\.($d) \s+
> >               (\S+)                  \s+
> >               ($d)/x;
>
> >  { time => $time,
> >    srcaddr => $srcaddr, srcport => $srcport,
> >    dstaddr => $dstaddr, dstport => $dstport,
> >    protocol => $protocol, size => $size }
> >}
>
> >sub main {
> >  my $str = '16:23:18.659343 131.188.37.230.22 131.188.37.59.1398 tcp
> >168';
> >  my $result = parse($str);
> >  print Dumper($result);
> >}
>
> >main;
>
> well, I was thinking more along the lines of
> <?php
> $input = '16:23:18.659343 131.188.37.230.22 131.188.37.59.1398 tcp
> 168';
> list ($time, $src, $dest, $protocol, $size) = split(" ", $input);
> ?>
>
> Splitting the port from the address is left as an exercise for the
> reader.

Thanks.

I've written maybe 100,000 lines of perl to do stuff like this. In
the long run you are better off with a custom regex that matches the
line. It's better for input error format detection and it self-
documents the input format.

From: Paul Herber on
On Mon, 5 May 2008 16:04:53 -0700 (PDT), Gene <gene.ressler(a)gmail.com>
wrote:

>On May 5, 5:43�am, Paul Herber <SubstituteMyFirstNameH...(a)pherber.com>
>wrote:
>> On Sun, 4 May 2008 20:10:09 -0700 (PDT), Gene <gene.ress...(a)gmail.com>
>> wrote:
>>
>>
>>
>>
>>
>> >On Apr 29, 8:09�am, Paul Herber
>> ><SubstituteMyFirstNameH...(a)pherber.com> wrote:
>> >> On Tue, 29 Apr 2008 03:55:09 -0700 (PDT), xyz
>>
>> >> <lavanyaredd...(a)gmail.com> wrote:
>> >> >I have a string
>> >> >16:23:18.659343 131.188.37.230.22 131.188.37.59.1398 tcp 168
>>
>> >> >for example lets say for the above string
>> >> >16:23:18.659343 -- time
>> >> >131.188.37.230 � -- srcaddress
>> >> >22 � � � � � � � � � � � �--srcport
>> >> >131.188.37.59 � �--destaddress
>> >> >1398 � � � � � � � � �--destport
>> >> >tcp � � � � � � � � � �--protocol
>> >> >168 � � � � � � � � �--size
>> >> >i need to split this string such that i need to get all these
>> >> >parameters....the filed widths are not fixed...some time i have 4/3
>> >> >digits srcport
>>
>> >> Can you not split on the spaces? Whatever programming language you are
>> >> using may even have a split function.
>>
>> >Indeed. �You have to love perl for stuff like this:
>>
>> >use strict;
>> >use Data::Dumper;
>>
>> >sub parse {
>> > �my $s = shift;
>> > �my $d = '\d+';
>> > �my ($time, $srcaddr, $srcport, $dstaddr, $dstport, $protocol, $size)
>> >=
>> > � �$s =~ /($d:$d:$d\.$d) � � � � \s+
>> > � � � � � � � ($d\.$d\.$d\.$d)\.($d) \s+
>> > � � � � � � � ($d\.$d\.$d\.$d)\.($d) \s+
>> > � � � � � � � (\S+) � � � � � � � � �\s+
>> > � � � � � � � ($d)/x;
>>
>> > �{ time => $time,
>> > � �srcaddr => $srcaddr, srcport => $srcport,
>> > � �dstaddr => $dstaddr, dstport => $dstport,
>> > � �protocol => $protocol, size => $size }
>> >}
>>
>> >sub main {
>> > �my $str = '16:23:18.659343 131.188.37.230.22 131.188.37.59.1398 tcp
>> >168';
>> > �my $result = parse($str);
>> > �print Dumper($result);
>> >}
>>
>> >main;
>>
>> well, I was thinking more along the lines of
>> <?php
>> $input = '16:23:18.659343 131.188.37.230.22 131.188.37.59.1398 tcp
>> 168';
>> list ($time, $src, $dest, $protocol, $size) = split(" ", $input);
>> ?>
>>
>> Splitting the port from the address is left as an exercise for the
>> reader.
>
>Thanks.
>
>I've written maybe 100,000 lines of perl to do stuff like this. In
>the long run you are better off with a custom regex that matches the
>line. It's better for input error format detection and it self-
>documents the input format.

Fair enough, but your code will break with IPv6


--
Regards, Paul Herber, Sandrila Ltd.
TTCN (test case notation) for Visio http://www.ttcn.sandrila.co.uk/