#!/usr/bin/perl -w
# This script collects data from your iptables log files and return the numbers
# of lines that it is dropped. You need to pass in argument, the regex rules that
# match your iptables lines. For exemple, this can be the word ŤDROP \s+ ť
#
# May 10 23:32:15 darkland kernel: DROP if_bad_in IN=eth1 OUT=
# MAC=00:00:b4:XX:XX:XX:00:e0:XX:XX:e7:3d:08:00 SRC=202.XXX.XX.XXX
# DST=XXX.XXX.XXX.92 LEN=48 TOS=0x00 PREC=0x00 TTL=103 ID=50911 DF PROTO=TCP
# SPT=3479 DPT=59 WINDOW=16384 RES=0x00 SYN URGP=0 
#
if ($ARGV[0] eq "") {
  $file="/var/log/kern.log";
} else {
  $file=$ARGV[0];
}
if ($ARGV[1] eq "") {
  $match='PROTO=\w+ ';
} else {
  $match=$ARGV[1];
}

my $lines=0;
open(INPUT, $file) || die "couldn't open $file\n";
while (<INPUT>)
{
    $lines++ if (m/\b$match\b/g);
}
close INPUT;
print $lines;

