[Iptablelog-users] Apology about last mail

[sgdailey <sgd...@ro...>]

I jumped the gun on my last mail and instead of explaining what I did wrong
I will simply restart with the working version. Sorry I don't know Perl and
I should have tested first. So to use memoize correctly to cut down on the
lag time caused from numerous name lookups during heavy scans I did the
following.

Download the Perl module memoize from:
http://perl.plover.com/Memoize/Memoize-1.01.tar.gz

install according to README file

then modify the feed_db.pl script as follows:

Add the following lines after line 28;

use Memoize;
memoize 'mygethostbyaddr';
sub mygethostbyaddr { gethostbyaddr( $_[0], $_[1] ) };

so that line 28 through 31 looks like so:

use Socket;
use Memoize;
memoize 'mygethostbyaddr';
sub mygethostbyaddr { gethostbyaddr( $_[0], $_[1] ) };

next find the section where name lookups occur from Michael Browns posting;

 my($iaddr) = inet_aton($entry{'SRC'});
  my($host_name) = gethostbyaddr($iaddr, AF_INET);
  if (defined($host_name)) { $entry{"SRC_NAME"}=$host_name; } else {
$entry{"SRC_NAME"}="unknown"; }


and change it to read;

 my($iaddr) = inet_aton($entry{'SRC'});
  my($host_name) = mygethostbyaddr($iaddr, AF_INET);
  if (defined($host_name)) { $entry{"SRC_NAME"}=$host_name; } else {
$entry{"SRC_NAME"}="unknown"; }

the only change is to add "my" in front of gethostbyaddr, this will now call
the function you pasted in the first step.

you can also do this for the Destination address lookup section which looks
like;

my($iaddr) = inet_aton($entry{'DST'});
my($host_name) = gethostbyaddr($iaddr, AF_INET);
if (defined($host_name)) { $entry{"DST_NAME"}=$host_name; } else {
$entry{"DST_NAME"}="unknown"; }

should now look like

my($iaddr) = inet_aton($entry{'DST'});
my($host_name) = mygethostbyaddr($iaddr, AF_INET);
if (defined($host_name)) { $entry{"DST_NAME"}=$host_name; } else {
$entry{"DST_NAME"}="unknown"; }

again only adds "my" in front of the gethostbyaddr

I leave that section commented out as per Michael Browns Posting because I
don't need name resolution on Destinations which I already know.

Sorry about the earlier email

sgdailey