LinuxQuestions.org
Visit Jeremy's Blog.
Go Back   LinuxQuestions.org > Forums > Non-*NIX Forums > Programming
User Name
Password
Programming This forum is for all programming questions.
The question does not have to be directly related to Linux and any language is fair game.

Notices

Reply
 
Search this Thread
Old 02-21-2008, 04:12 AM   #1
kriezo
LQ Newbie
 
Registered: Jan 2008
Posts: 14

Rep: Reputation: 0
[bash] how to put nslookup result next to ip in file


hi guys..
I just make a stat file from my maillog to get all ip and make them unique to find spam pattern and pipe out to a file ips.txt like this :
Code:
    718     718 xx.xx.xx.xx
    371     371 xxx.xxx.xx.xxx
    327     327 xxx.xx.xx.xxx
which 718,371,327 is the total connection made my x ips.Anyway now i want to do nslookup to each ip. I just found the script here :

Code:
while read IP ; do

        LOOKUP_RES=$(nslookup $IP | sed -n 's/.*arpa.*name = \(.*\)/\1/p')
        test -z "$LOOKUP_RES" && LOOKUP_RES="Failed"

        echo -e "$IP\t$LOOKUP_RES"

done < ips.txt
I try enhance the script make the nslookup result will be put next to the ip in new file or the ips.txt file (doesn't matter) but failed.

Somebody please help me here..
 
Old 02-21-2008, 04:32 AM   #2
jschiwal
Guru
 
Registered: Aug 2001
Location: Fargo, ND
Distribution: SuSE AMD64
Posts: 15,733

Rep: Reputation: 654Reputation: 654Reputation: 654Reputation: 654Reputation: 654Reputation: 654
You could use : while read num1 num2 IP; do
...
done <ip.txt

This will get rid of the numbers before the IP.

For the sed command, select a line that has /arpa/ in it:
sed -n '/arpa/s/.*arpa.*name = \(.*\)/\1/p'

You might want to add some error correction before the nslookup command. If IP were empty, nslookup would enter the interactive mode.

Put the echo arguments in double quotes.
 
Old 02-21-2008, 05:07 AM   #3
kriezo
LQ Newbie
 
Registered: Jan 2008
Posts: 14

Original Poster
Rep: Reputation: 0
thanks jschiwal,
but how can i write or print that result beside the ip?
Can u show me the way?
 
Old 02-21-2008, 05:38 AM   #4
jschiwal
Guru
 
Registered: Aug 2001
Location: Fargo, ND
Distribution: SuSE AMD64
Posts: 15,733

Rep: Reputation: 654Reputation: 654Reputation: 654Reputation: 654Reputation: 654Reputation: 654
This line: echo -e "$IP\t$LOOKUP_RES" prints both the IP address and the FQDN. Or do you want the number from your original list printed also?

echo -e "$num1\t$IP\t$LOOKUP_RES"

Last edited by jschiwal; 02-21-2008 at 10:39 PM.
 
Old 02-21-2008, 10:56 PM   #5
jschiwal
Guru
 
Registered: Aug 2001
Location: Fargo, ND
Distribution: SuSE AMD64
Posts: 15,733

Rep: Reputation: 654Reputation: 654Reputation: 654Reputation: 654Reputation: 654Reputation: 654
Maybe I misunderstood what you are asking. Here is a sample iplist.txt file. The modified program and the output. One thing I don't understand is why the number before the IP is listed twice on the input file or if they represent different values. I didn't reference num2 in the output, but I read it in simply to read in the IP address into the $IP variable. If you want a different output, use a better sample and post what the output should look like given that sample.

Code:
jschiwal@hpmedia:~> cat iplist.txt
100 100 75.126.6.188
101 101 64.233.167.104
102 102 75.126.6.188
Code:
jschiwal@hpmedia:~> cat getfq
while read num1 num2 IP; do
        LOOKUP_RES=$(nslookup $IP | sed -n '/arpa/s/.*arpa.*name = \(.*\)/\1/p')

        test -z "$LOOKUP_RES" && LOOKUP_RES="Failed"

        echo -e "$num1\t$IP\t$LOOKUP_RES"
done < iplist.txt
Code:
jschiwal@hpmedia:~> ./getfq
100     75.126.6.188    twit.tv.
101     64.233.167.104  py-in-f104.google.com.
102     75.126.6.188    twit.tv.
 
Old 02-25-2008, 12:48 AM   #6
kriezo
LQ Newbie
 
Registered: Jan 2008
Posts: 14

Original Poster
Rep: Reputation: 0
thank you again jschiwal
I used the code exactly that you've given before and it's work. The reason why the total have become twice coz first i pipeout all the ip into a file, then i sort it into another file using | uniq -c and then i sort the 2nd file using sort file | uniq -c | sort -nr to sort it deceasing the total unique ip number..

all seem find now excepts if i want to get the total unique ip until 50 and leave all total ip below that, can you help me out with the script? I've try out but don't work..
 
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off


Similar Threads
Thread Thread Starter Forum Replies Last Post
compare the hostnames in /etc/hosts with the result of nslookup on a ip from /etc/hos pete83 AIX 3 12-18-2007 03:34 AM
Bash script to put log files into single file and email DragonM15 Programming 13 11-08-2007 03:27 AM
bash script: how to assign an output (not the result) to a variable? Singing Banzo Programming 8 10-01-2006 06:29 PM
[bash] Put words from file to array mispunt Programming 4 11-04-2004 10:53 AM
BASH Command Result redhatnoob Programming 2 08-19-2004 06:25 PM


All times are GMT -5. The time now is 01:11 PM.

Main Menu
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
identi.ca: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration