awk script to find repeated IP adress from trace file (.tr)

+ 8.00747 /NodeList/0/DeviceList/0/$ns3::PointToPointNetDevice/TxQueue/Enqueue ns3::PppHeader (Point-to-Point Protocol: IP (0x0021)) ns3::Ipv4Header (tos 0x0 DSCP Default ECN Not-ECT ttl 63 id 0 protocol 17 offset (bytes) 0 flags [none] length: 540 10.1.3.3 > 10.1.2.4) ns3::UdpHeader (length: 520 49153 > 9) Payload (size=512)
- 8.00747 /NodeList/0/DeviceList/0/$ns3::PointToPointNetDevice/TxQueue/Dequeue ns3::PppHeader (Point-to-Point Protocol: IP (0x0021)) ns3::Ipv4Header (tos 0x0 DSCP Default ECN Not-ECT ttl 63 id 0 protocol 17 offset (bytes) 0 flags [none] length: 540 10.1.4.5 > 10.1.2.4) ns3::UdpHeader (length: 520 49153 > 9) Payload (size=512)
r 8.01033 /NodeList/1/DeviceList/0/$ns3::PointToPointNetDevice/MacRx ns3::PppHeader (Point-to-Point Protocol: IP (0x0021)) ns3::Ipv4Header (tos 0x0 DSCP Default ECN Not-ECT ttl 63 id 0 protocol 17 offset (bytes) 0 flags [none] length: 540 10.1.3.3 > 10.1.2.4) ns3::UdpHeader (length: 520 49153 > 9) Payload (size=512)
+ 16.0008 /NodeList/0/DeviceList/0/$ns3::PointToPointNetDevice/TxQueue/Enqueue ns3::PppHeader (Point-to-Point Protocol: IP (0x0021)) ns3::Ipv4Header (tos 0x0 DSCP Default ECN Not-ECT ttl 63 id 1 protocol 17 offset (bytes) 0 flags [none] length: 540 10.1.3.5 > 10.1.2.4) ns3::UdpHeader (length: 520 49153 > 9) Payload (size=512)
- 16.0008 /NodeList/0/DeviceList/0/$ns3::PointToPointNetDevice/TxQueue/Dequeue ns3::PppHeader (Point-to-Point Protocol: IP (0x0021)) ns3::Ipv4Header (tos 0x0 DSCP Default ECN Not-ECT ttl 63 id 1 protocol 17 offset (bytes) 0 flags [none] length: 540 10.1.3.3 > 10.1.2.4) ns3::UdpHeader (length: 520 49153 > 9) Payload (size=512)
r 16.0037 /NodeList/1/DeviceList/0/$ns3::PointToPointNetDevice/MacRx ns3::PppHeader (Point-to-Point Protocol: IP (0x0021)) ns3::Ipv4Header (tos 0x0 DSCP Default ECN Not-ECT ttl 63 id 1 protocol 17 offset (bytes) 0 flags [none] length: 540 10.1.3.3 > 10.1.2.4) ns3::UdpHeader (length: 520 49153 > 9) Payload (size=512)
+ 24.0008 /NodeList/0/DeviceList/0/$ns3::PointToPointNetDevice/TxQueue/Enqueue ns3::PppHeader (Point-to-Point Protocol: IP (0x0021)) ns3::Ipv4Header (tos 0x0 DSCP Default ECN Not-ECT ttl 63 id 2 protocol 17 offset (bytes) 0 flags [none] length: 540 10.1.3.3 > 10.1.2.4) ns3::UdpHeader (length: 520 49153 > 9) Payload (size=512)
- 24.0008 /NodeList/0/DeviceList/0/$ns3::PointToPointNetDevice/TxQueue/Dequeue ns3::PppHeader (Point-to-Point Protocol: IP (0x0021)) ns3::Ipv4Header (tos 0x0 DSCP Default ECN Not-ECT ttl 63 id 2 protocol 17 offset (bytes) 0 flags [none] length: 540 10.1.3.6 > 10.1.2.4) ns3::UdpHeader (length: 520 49153 > 9) Payload (size=512)
r 24.0037 /NodeList/1/DeviceList/0/$ns3::PointToPointNetDevice/MacRx ns3::PppHeader (Point-to-Point Protocol: IP (0x0021)) ns3::Ipv4Header (tos 0x0 DSCP Default ECN Not-ECT ttl 63 id 2 protocol 17 offset (bytes) 0 flags [none] length: 540 10.1.3.3 > 10.1.2.4) ns3::UdpHeader (length: 520 49153 > 9) Payload (size=512)
+ 32.0008 /NodeList/0/DeviceList/0/$ns3::PointToPointNetDevice/TxQueue/Enqueue ns3::PppHeader (Point-to-Point Protocol: IP (0x0021)) ns3::Ipv4Header (tos 0x0 DSCP Default ECN Not-ECT ttl 63 id 3 protocol 17 offset (bytes) 0 flags [none] length: 540 10.1.3.3 > 10.1.2.4) ns3::UdpHeader (length: 520 49153 > 9) Payload (size=512)
- 32.0008 /NodeList/0/DeviceList/0/$ns3::PointToPointNetDevice/TxQueue/Dequeue ns3::PppHeader (Point-to-Point Protocol: IP (0x0021)) ns3::Ipv4Header (tos 0x0 DSCP Default ECN Not-ECT ttl 63 id 3 protocol 17 offset (bytes) 0 flags [none] length: 540 10.1.3.7 > 10.1.2.4) ns3::UdpHeader (length: 520 49153 > 9) Payload (size=512)
r 32.0037 /NodeList/1/DeviceList/0/$ns3::PointToPointNetDevice/MacRx ns3::PppHeader (Point-to-Point Protocol: IP (0x0021)) ns3::Ipv4Header (tos 0x0 DSCP Default ECN Not-ECT ttl 63 id 3 protocol 17 offset (bytes) 0 flags [none] length: 540 10.1.3.3 > 10.1.2.4) ns3::UdpHeader (length: 520 49153 > 9) Payload (size=512)
+ 40.0008 /NodeList/0/DeviceList/0/$ns3::PointToPointNetDevice/TxQueue/Enqueue ns3::PppHeader (Point-to-Point Protocol: IP (0x0021)) ns3::Ipv4Header (tos 0x0 DSCP Default ECN Not-ECT ttl 63 id 4 protocol 17 offset (bytes) 0 flags [none] length: 540 10.1.3.3 > 10.1.2.4) ns3::UdpHeader (length: 520 49153 > 9) Payload (size=512)
- 40.0008 /NodeList/0/DeviceList/0/$ns3::PointToPointNetDevice/TxQueue/Dequeue ns3::PppHeader (Point-to-Point Protocol: IP (0x0021)) ns3::Ipv4Header (tos 0x0 DSCP Default ECN Not-ECT ttl 63 id 4 protocol 17 offset (bytes) 0 flags [none] length: 540 10.1.3.3 > 10.1.2.4) ns3::UdpHeader (length: 520 49153 > 9) Payload (size=512)
r 40.0037 /NodeList/1/DeviceList/0/$ns3::PointToPointNetDevice/MacRx ns3::PppHeader (Point-to-Point Protocol: IP (0x0021)) ns3::Ipv4Header (tos 0x0 DSCP Default ECN Not-ECT ttl 63 id 4 protocol 17 offset (bytes) 0 flags [none] length: 540 10.1.3.3 > 10.1.2.4) ns3::UdpHeader (length: 520 49153 > 9) Payload (size=512)
+ 48.0008 /NodeList/0/DeviceList/0/$ns3::PointToPointNetDevice/TxQueue/Enqueue ns3::PppHeader (Point-to-Point Protocol: IP (0x0021)) ns3::Ipv4Header (tos 0x0 DSCP Default ECN Not-ECT ttl 63 id 5 protocol 17 offset (bytes) 0 flags [none] length: 540 10.1.3.3 > 10.1.2.4) ns3::UdpHeader (length: 520 49153 > 9) Payload (size=512)
- 48.0008 /NodeList/0/DeviceList/0/$ns3::PointToPointNetDevice/TxQueue/Dequeue ns3::PppHeader (Point-to-Point Protocol: IP (0x0021)) ns3::Ipv4Header (tos 0x0 DSCP Default ECN Not-ECT ttl 63 id 5 protocol 17 offset (bytes) 0 flags [none] length: 540 10.1.3.3 > 10.1.2.4) ns3::UdpHeader (length: 520 49153 > 9) Payload (size=512)
r 48.0037 /NodeList/1/DeviceList/0/$ns3::PointToPointNetDevice/MacRx ns3::PppHeader (Point-to-Point Protocol: IP (0x0021)) ns3::Ipv4Header (tos 0x0 DSCP Default ECN Not-ECT ttl 63 id 5 protocol 17 offset (bytes) 0 flags [none] length: 540 10.1.3.3 > 10.1.2.4) ns3::UdpHeader (length: 520 49153 > 9) Payload (size=512)
+ 56.0008 /NodeList/0/DeviceList/0/$ns3::PointToPointNetDevice/TxQueue/Enqueue ns3::PppHeader (Point-to-Point Protocol: IP (0x0021)) ns3::Ipv4Header (tos 0x0 DSCP Default ECN Not-ECT ttl 63 id 6 protocol 17 offset (bytes) 0 flags [none] length: 540 10.1.3.3 > 10.1.2.4) ns3::UdpHeader (length: 520 49153 > 9) Payload (size=512)
- 56.0008 /NodeList/0/DeviceList/0/$ns3::PointToPointNetDevice/TxQueue/Dequeue ns3::PppHeader (Point-to-Point Protocol: IP (0x0021)) ns3::Ipv4Header (tos 0x0 DSCP Default ECN Not-ECT ttl 63 id 6 protocol 17 offset (bytes) 0 flags [none] length: 540 10.1.3.3 > 10.1.2.4) ns3::UdpHeader (length: 520 49153 > 9) Payload (size=512)
r 56.0037 /NodeList/1/DeviceList/0/$ns3::PointToPointNetDevice/MacRx ns3::PppHeader (Point-to-Point Protocol: IP (0x0021)) ns3::Ipv4Header (tos 0x0 DSCP Default ECN Not-ECT ttl 63 id 6 protocol 17 offset (bytes) 0 flags [none] length: 540 10.1.3.3 > 10.1.2.4) ns3::UdpHeader (length: 520 49153 > 9) Payload (size=512)
+ 64.002 /NodeList/0/DeviceList/0/$ns3::PointToPointNetDevice/TxQueue/Enqueue ns3::PppHeader (Point-to-Point Protocol: IP (0x0021)) ns3::Ipv4Header (tos 0x0 DSCP Default ECN Not-ECT ttl 63 id 7 protocol 17 offset (bytes) 0 flags [none] length: 540 10.1.3.3 > 10.1.2.4) ns3::UdpHeader (length: 520 49153 > 9) Payload (size=512)
- 64.002 /NodeList/0/DeviceList/0/$ns3::PointToPointNetDevice/TxQueue/Dequeue ns3::PppHeader (Point-to-Point Protocol: IP (0x0021)) ns3::Ipv4Header (tos 0x0 DSCP Default ECN Not-ECT ttl 63 id 7 protocol 17 offset (bytes) 0 flags [none] length: 540 10.1.3.3 > 10.1.2.4) ns3::UdpHeader (length: 520 49153 > 9) Payload (size=512)
r 64.0048 /NodeList/1/DeviceList/0/$ns3::PointToPointNetDevice/MacRx ns3::PppHeader (Point-to-Point Protocol: IP (0x0021)) ns3::Ipv4Header (tos 0x0 DSCP Default ECN Not-ECT ttl 63 id 7 protocol 17 offset (bytes) 0 flags [none] length: 540 10.1.3.3 > 10.1.2.4) ns3::UdpHeader (length: 520 49153 > 9) Payload (size=512)

Showing us a sample file and giving us a thread title asking for an awk script to find repeated IP address without describing what constitutes the IP address (or addresses) that are to be examined when looking for repeats makes it hard to help you reach your goal. And once a repeat has been found, what do you want to do with it?

What operating system and shell are you using?

What have you tried to solve this problem?

Why do you need to find repeated IP addresses?

With the sample input you have provided, exactly what output are you hoping to produce?

1 Like

1...Operating system is linux and more accurately it is ubuntu 14.0.4 in a virtual environment.

2..I have tried awk script for this. i m displaying code below for it.

BEGIN {
count = 0;
i=0;

start_time=8.0
}
	{
        	event = $1
		time = $2
		node_id = $19
		source_add = $29
		dest_add = $31


	if (dest_add == "10.1.2.4)" && time="56.0037") {
if(start_time>time){
start_time=time+10.0
}
 
      source = $29
}
print "\n\tSource IP address at time =", source,"\n\n";
	i++;
}
}
END {
print "\n\tSource IP address at time =", i, "\n\n";
}

3..I'm working on a trace file to get repeated IP source adresss.

4.. i need output as follow:
No. of repeated source IP and destination pair with time slots.

note: i m using Bourne Again shell (bash)

Showing us code that is not working helps..., but it would help a lot more if you showed us the output that you are trying to produce from the sample input you provided (as requested in my last post).

Please also explain why the time needs to be set to 56.0037 if the 29th field in your input is 10.1.2.4) .

Please also explain why your code sometimes prints the 29th field on a line with the label Source IP address at time = and at the end prints the number of lines found in the input file + 1 with the same label.

I don't see anything in your code that makes any attempt to look for duplicated values of any kind.

hey Don Cragun !!

I'm new to awk script and .tr files. The code posted in last post was my trial code. So i request for the appropriate suggestions..

As from .tr file you can see that <10.1.3.7,10.1.2.4> these are the most repeated pair at different time.
So i want it to be displayed like below format.

I want output like this:

-----------------------------------------------------------
Number of duplicate                      Time(in secs)
 <source,destination> 
-----------------------------------------------------------
<10.1.3.7,10.1.2.4>                           8.00747

Thanks,:slight_smile:

In fact, I CAN'T see that 10.1.3.7 is the most repeated pair, nor how and why it should be associated to 8.00747. The most repeated (to me) seems to be 10.1.3.3 > 10.1.2.4 , occurring 20 times between 8.00747 and 64.0048 . Mayhap you can build on this:

awk '
        {IX = $29 " > " $31
         sub (/\)/, _, IX)
         CNT[IX]++
         MIN[IX] = $2<MIN[IX] || !MIN[IX]?$2:MIN[IX]
         MAX[IX] = $2>MAX[IX]            ?$2:MAX[IX]
        }
END     {for (c in CNT) printf "%20s %3d %9.5f %9.5f\n", c, CNT[c], MIN[c], MAX[c]
        }
' file
 10.1.3.3 > 10.1.2.4  20   8.00747  64.00480
 10.1.3.7 > 10.1.2.4   1  32.00080  32.00080
 10.1.3.6 > 10.1.2.4   1  24.00080  24.00080
 10.1.3.5 > 10.1.2.4   1  16.00080  16.00080
 10.1.4.5 > 10.1.2.4   1   8.00747   8.00747

hello..

thanks for the code..

Can you please explain this file..

i got error

awk: 1: unexpected character '''

I used awk -f filename.awk filename.tr for running the code.

cheers!!

Enter the script in post#6 on the command line, replacing "file" with your file name.

thanks,

filename: pm-ex.awk

awf -f pm-ex.awk pm-ex.tr

awk '
        {
         IX = $29 " > " $31
         sub (/\)/, _, IX)
         CNT[IX]++
         MIN[IX] = $2<MIN[IX] || !MIN[IX]?$2:MIN[IX]
         MAX[IX] = $2>MAX[IX]            ?$2:MAX[IX]
        }
END     {for (c in CNT) printf "%20s %3d %9.5f %9.5f\n", c, CNT[c], MIN[c], MAX[c]
        }

Sigh....

Put the following (ONLY the following) into file pm-ex.awk :

        {
         IX = $29 " > " $31
         sub (/\)/, _, IX)
         CNT[IX]++
         MIN[IX] = $2<MIN[IX] || !MIN[IX]?$2:MIN[IX]
         MAX[IX] = $2>MAX[IX]            ?$2:MAX[IX]
        }
END     {for (c in CNT) printf "%20s %3d %9.5f %9.5f\n", c, CNT[c], MIN[c], MAX[c]
        }

Only then repeat your command.

Don gave you a COMMAND you could paste into the command line, only replacing "file" with the name of your input file. You changed what he gave you without understanding how awk works and what it expects where. You might want to consider playing around with these things and altering them only after you have got the slightest idea about which rules it follows.

I hope this helps.

bakunin

cheers..

thanx a lot programmers!!

Do you regard that code snippet as the final solution to your problem in post#1? If not, please post the final code for completeness and closure of the thread.