[Dshield] blacklist parsing help

Micheal Patterson micheal at cancercare.net
Thu May 23 22:09:12 GMT 2002


Brad, I hate to admit it but I have very little perl skills. What I do to
compensate for that, is have a cron job fetch the file (freebsd) and parse
it though this:

cat block.txt |grep -v "#" |grep -v Start |grep -v RESERVED|cut -f -2 >
block1.txt

It gives:

150.43.70.0     150.43.70.255
210.75.212.0    210.75.212.255
66.47.10.0      66.47.10.255
211.58.139.0    211.58.139.255
211.62.54.0     211.62.54.255
141.109.222.0   141.109.222.255
80.126.2.0      80.126.2.255

It's not perl, but it works for me. It may not be an option for you if
you're not on a *nix platform.

--

Micheal Patterson
Network Administration
Cancer Care Network
405-733-2230

----- Original Message -----
From: "bradw" <tildar at sta-care.com>
To: <list at dshield.org>
Sent: Thursday, May 23, 2002 12:53 PM
Subject: [Dshield] blacklist parsing help


> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
>
> all i want is a file with 1 ip/mask per line.
> trying to modify get_block.pl to do this
>
> why is this not working?
>
> # The block list that we downloaded from
> # http://feeds.dshield.org/block.txt
> open (F,"$tmpdir/$filenum");
>
> open (O,"/etc/blacklist");
>
> my ($start, $end, $block, $attacks, $name, $country, $email);
> while (<F>) {
>     next if /^#/;
>     ($start, $end, $block, $attacks, $name, $country, $email)=split("\t");
>     if ( ( $start =~ /^[\d\.]+$/ ) && ( $block =~ /^\d+/ ) ) {
>         print O "$start/$block \n";
>     }
> }
>
> - --
> Brad Wyman           |\      _,,,---,,_
> bradw at sta-care.com  /,`.-'`'    -.  ;-;;,_
> Network Admin      |,4-  ) )-,_. ,\ (  `'-'
> Sta-Care, Inc.    '---''(_/--'  `-'_)
>
> PGP Fingerprint: 8B1E E12F 3982 0D54 E01C  DFD3 898B 6CA3 ED6F 3E56
>
> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v1.0.6 (GNU/Linux)
> Comment: For info see http://www.gnupg.org
>
> iD8DBQE87SyZiYtso+1vPlYRApJ1AJ46IalL4ShhbjRj5kVuIYCuIfbXKgCffULC
> V42nLIkU0pw8WndwAAIuDds=
> =DWVN
> -----END PGP SIGNATURE-----
>
> _______________________________________________
> Dshield mailing list
> Dshield at dshield.org
> To change your subscription options (or unsubscribe), see:
http://www.dshield.org/mailman/listinfo/list
>




More information about the list mailing list