Stories
Slash Boxes
Comments
NOTE: use Perl; is on undef hiatus. You can read content, but you can't post it. More info will be forthcoming forthcomingly.

All the Perl that's Practical to Extract and Report

The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
 Full
 Abbreviated
 Hidden
More | Login | Reply
Loading... please wait.
  • other than /32

    I know you said you have hundreds of thousands, but the sample spamreport.txt only has a little over 20K. Even still, doing just a cursory glance you would be a lot better off not blocking individual IPs.

    #!/usr/bin/perl
    use strict;
    use warnings;

    my $spam = $ARGV[0] || 'spamreport.txt';
    open (SPAM, '<', $spam) or die "Unable to open $spam for reading : $!";

    print
    map { $_->[4] }
    sort { $a->[0] <=> $b->[0] || $a->[1] <=> $b->[1]
                               ||
           $a->[2] <=> $b->[2] || $a->[1] <=> $b->[2] }
    map  { [ m|(\d+)\.(\d+)\.(\d+)\.(\d+)/|, $_ ] } <SPAM>;

    I think if you used better masks, perhaps by checking http://www.arin.net/ [arin.net] to see who owns the block and how big it is, you would be able to reduce the total number of rules quite dramatically.