how to got lasting time about one connection from iptable log?

how to got lasting time about one connection from iptable log?

[gbj]

When open iptables's log file,we can got some messages like this:
 time                      in   pro    src         spt      dest        dpt
Jun 02 07:59:30   ACCEPT  eth0  tcp  192.168.6.26  4269  64.215.164.33  80  
Jun 02 07:59:31   ACCEPT  eth0  tcp  192.168.6.26  4269  64.215.164.33  80  
Jun 02 07:59:31   ACCEPT  eth0  tcp  192.168.6.26  4269  64.215.164.33  80  
Jun 02 07:59:31   ACCEPT  eth0  tcp  192.168.6.26  4269  64.215.164.33  80  
Jun 02 07:59:31   ACCEPT  eth0  tcp  192.168.6.26  4278  64.215.164.33  80  
Jun 02 07:59:32   ACCEPT  eth0  tcp  192.168.6.26  4278  64.215.164.33  80  
Jun 02 07:59:32   ACCEPT  eth0  tcp  192.168.6.26  4278  64.215.164.33  80  

but in fact, this connection information perhaps belonge to one connection,I want to know how to combine 
this information to one connection message and got the duration time of the connection,just like this:
        start  time        duration       src         spt     dest       dtp

    Jun 02 07:59:30        128         192.168.6.26  4269  64.215.164.33  80 


Thanx U all!

Re: how to got lasting time about one connection from iptable log?

[Julian Gomez]

On Wed, Jun 04, 2003 at 10:51:51AM +0800, gbj spoke thusly:
> time                      in   pro    src         spt      dest        dpt
>Jun 02 07:59:31   ACCEPT  eth0  tcp  192.168.6.26  4278  64.215.164.33  80  
>Jun 02 07:59:32   ACCEPT  eth0  tcp  192.168.6.26  4278  64.215.164.33  80  
>Jun 02 07:59:32   ACCEPT  eth0  tcp  192.168.6.26  4278  64.215.164.33  80  
>
>but in fact, this connection information perhaps belonge to one
>connection,I want to know how to combine this information to one
>connection message and got the duration time of the connection,just like

Really, HTTP/1.0 connection ?

>this: start  time        duration       src         spt     dest       dtp
>
>    Jun 02 07:59:30        128         192.168.6.26  4269  64.215.164.33
>    80 

You'll need to write a script to perform the calculations and joining for
you. 

Personally, from the above output, I think that would be quite easy, but
not entirely correct because I reckon you'll have to ignore the source
ports, or at least have some match going on, to determine that if your
start and end source ports are close enough, then they are part of the same
connection, if everything else (src, dst IP && dst port) are the same. [*]

[*] -- This of course also depends on the fact that you don't have any
       kernel patches (grsecurity comes to mind) which performs automatic
       randomization of the source port (ala OpenBSD).

(snip various bits)