Note:Read the output of the "netstat-p tcp" command, extract the data in the foreign address section, and count the multiple connections of the same IP address.
Advantages:Compared with the output of the netstat command, you can more intuitively find abnormal external connection IP addresses.
#! /Usr/bin/perl-wuse strict; ######################################## ############################### file: foreign. PL # function: view the IP information of all external connections to the local machine # Description: extract the data of foreign address by reading the output of the "netstat-p tcp" command, # Count multiple connections of the same IP address. # Advantages: Compared with the output of the netstat command, you can more intuitively find abnormal external connection IP addresses. # Version: v0.1 # Time: # Author: semi-idle # Test Platform: # sco_sv scosysv 3.2 5.0.6 i386 ################################## ##################################### open (netstat, "netstat-p tcp |") or die "can't open wordcount: $! "; My % foreign_hash; while (<netstat>) {# match characters in the format of a class-type IP address (for example, 11.11.11.) If (/(? : \ D + \.) +/) {my $ match =$ &; # Remove the. (point) characters that match strings before the end of the string $ match = ~ S /. $ //; $ foreign_hash {$ match} ++ ;}} close netstat; foreach my $ key (Keys % foreign_hash) {print "$ key \ t => \ t $ foreign_hash {$ key} \ n ";}
After execution: