tcpdump filter script for iPad typing delay investigation

hosts.txt

52.6.92.48	cognito-identity.us-east-1.amazonaws.com

52.94.216.48	aax-eu.amazon-adsystem.com
52.94.216.6	mads-eu.amazon.com
52.94.220.16	aax-eu.amazon-adsystem.com
52.94.218.7	aax-eu.amazon-adsystem.com
54.239.24.180	mobileanalytics.us-east-1.amazonaws.com
54.239.35.205	mads-eu.amazon.com

52.222.227.170	Images-na.ssl-images-amazon.com

52.94.218.244	msh.amazon.co.uk
52.94.220.255	msh.amazon.co.uk
52.94.216.31	msh.amazon.co.uk
54.239.36.249	unagi-eu.amazon.com
54.239.32.228	unagi-eu.amazon.com
54.239.36.249	unagi-eu.amazon.com
54.239.32.101	msh-tablet.amazon.co.uk
54.239.34.131	msh-tablet.amazon.co.uk
54.239.36.122	msh-tablet.amazon.co.uk
54.239.33.86	fls-eu.amazon.com
54.239.37.186	fls-eu.amazon.com
54.239.38.247	fls-eu.amazon.co.uk
54.192.0.156	www.amazon.co.uk

95.101.84.226	www.amazon.co.uk (Akamai)
95.101.84.228	www.amazon.com (Akamai)
104.67.24.102	www.amazon.co.uk (Akamai)
104.67.24.120	www.amazon.com (Akamai)
176.32.109.230	fls-eu.amazon.com

52.94.217.61	completion.amazon.co.uk
52.94.220.15	completion.amazon.co.uk

54.239.35.198	completion.amazon.co.uk

216.58.208.138	*.googleapis.com

72.246.227.237	configuration.apple.com (Akamai)

17.130.137.21	*.ls.apple.com (OU=Map Operations)
17.130.137.77	*.ls.apple.com (OU=Map Operations)
17.130.137.79	*.ls.apple.com (OU=Map Operations)
17.134.127.79	*.ls.apple.com (OU=Map Operations)
17.140.24.20	seed.siri.apple.com
17.248.144.147	*.icloud-content.com (management:idms.group.506364)
17.248.144.153	*.icloud.com (ISG Delivery Ops)
17.248.144.245	*.icloud.com (ISG Delivery Ops)
17.248.149.232	*.icloud.com (ISG Delivery Ops)
17.248.149.89	*.icloud.com (ISG Delivery Ops)
17.252.60.14	Apple, com.apple.idms.appleid.prd.
17.253.35.205	images.apple.com
17.248.144.155	*.icloud.com (ISG Delivery Ops)
17.248.144.182	*.icloud.com (ISG Delivery Ops)
17.248.144.210	*.icloud.com (ISG Delivery Ops)


17.248.144.75	*.icloud.com
72.246.229.115	cl1.apple.com

tcpdump_filter_ips.pl

# Apologies for my Perl. I haven't written a decent amount of Perl in over a decade.

our $home = '192.168.7.51';
our %hosts;
our %already;

BEGIN {
    open FH, "hosts.txt" or die $!;
    my @file = grep /\S/, <FH>;
    map { chomp; my ($k, $v) = split /\s+/, $_, 2; $hosts{$k} = $v; } @file;
}

if( /^(\d\d:\d\d:\d\d.\d).+?((?:\d{1,3}\.?){4})\.\d+ > ((?:\d{1,3}\.?){4})\.\d+/ ) {
    map {
        my $time = $1;
        my $dir = ($_ eq $2) ? '<' : '>';

        if ($_ ne $home) {
            my $name = $hosts{$_};

            unless ( $already{$_} or $name ) {
                print "curl -v -I https://$_/ |& grep subject:\n";
                $already{$_} = 1;
            }

            print "$time $dir $_\t$name\n";
        }
    } ($2, $3);
}