Bash Script zu Auswertung von SSH-Tarpit Log Dateien

tt

#!/bin/bash 

clear 

file='/home/tarpit/tarpit.log'

tc=$(grep -w -c connected $file)
td=$(grep -w -c disconnected $file)
cc=$(($tc-$td))
ui=$(cat $file | cut -d "'" -f 2 | sort | uniq | wc -l)

echo "Total connected: $tc"
echo "Total disconnected: $td"
echo ""
echo "Currently connected: $cc"
echo ""
echo "Unique IPs: $ui"
echo ""
echo "15 Top IPs:"
cat $file | grep -w connected | cut -d "'" -f 2 | sort | uniq -c | sort -nr | head -n 15

sum_con=$(cat tarpit.log | grep -w TarpitServer | grep -v ready | cut -d " " -f 1,2,10,11,12 | tr -d \' | tr -d "(" | tr -d "," | tr -d ")"| sort -k 3,3 -k 4,4 | awk -v wort="disconnected" '{ if (NR > 1 && $0 ~ wort) { print prev " " $0} prev = $0 }' - | cut -d " " -f 1,2 | date +%s -f - | awk '{s+=$1} END {printf "%.0f\n", s}')

sum_dis=$(cat tarpit.log | grep -w TarpitServer | grep -v ready | cut -d " " -f 1,2,10,11,12 | tr -d \' | tr -d "(" | tr -d "," | tr -d ")"| sort -k 3,3 -k 4,4 | awk -v wort="disconnected" '{ if (NR > 1 && $0 ~ wort) { print prev " " $0} prev = $0 }' - | cut -d " " -f 6,7 | date +%s -f - | awk '{s+=$1} END {printf "%.0f\n", s}')

diff_time=$(($sum_dis-$sum_con))

echo ""
echo ""
echo "Total time stolen: $(($diff_time /3600)):$((($diff_time %3600) /60)):$((diff_time %60))"