Skip to content

Instantly share code, notes, and snippets.

@mgcon
Created August 17, 2015 02:16
Show Gist options
  • Save mgcon/badf1c681c1dc29208ed to your computer and use it in GitHub Desktop.
Save mgcon/badf1c681c1dc29208ed to your computer and use it in GitHub Desktop.
parse an ipTables log file
file = sys.stdin.readlines()
for line in file:
line = line.rstrip()
# don't laugh, the following line works fine for what I need.
# it uses a little regex to put what I need into a list called 'parts'
parts = re.findall("(.*)(moses.*)(IN=.*)(OUT=.*)(MAC=.*)(SRC=.*)(DST=.*)(LEN=.*)(TOS=.*)(PREC=.*)(TTL=.*)(PROTO=.*)(SPT=.*)(DPT=.*)(WINDOW=.*)", line)
for p in parts:
src = re.match("(SRC=)(.*)", p[5])
dst = re.match("(DST=)(.*)", p[6])
spt = re.match("(SPT=)(.*)", p[12])
dpt = re.match("(DPT=)(.*)", p[13])
print "ON %s --> SRC=%s SPT=%s DST=%s DPT=%s" % (p[0], src.group(2), spt.group(2), dst.group(2), dpt.group(2))
curr.execute('INSERT INTO iptables (date_logged, src, spt, dst, dpt) VALUES ("%s","%s","%s","%s","%s")' % (p[0], src.group(2), spt.group(2), dst.group(2), dpt.group(2)))
conn.commit()
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment