Re: Disabling QAZ (was Re: Port 139 scans)

[Bennett Todd <bet () rahul net>]

2000-09-29-18:51:16 Ben Browning:
> On a side note, if anyone knows a good logfile parsing perl script
> that pulls out all the IP addresses in a log, I'd love a copy.

How about

        perl -lne 'print $1 for /(\d+\.\d+\.\d+\.\d+)/g'

Take the output of that and feed it through dnsfilter (from djbdns,
<URL:http://djbdns.org/>) and you can get the reverse lookups easy.
Fast, too, especially if you're running dnscache for your recursive
resolver.

-Bennett

Attachment: _bin
Description: