#!/usr/bin/perl

sub numerisch { $a <=> $b};
sub nslookup {
open (NSL ,"nslookup @_[0] |");
my @nslook=<NSL>;
close (NSL);

($null, my $name)=split ":",$nslook[3];
chop ($name);
return $name;
}

sub dumpport {
my $port = @_[0];
print "Date     Time       IP\n";
print "----------------------\n";
for ($w=0;$w<$num;$w++) {
 if ($entry[$w][12]==$port) {
                             print "$entry[$w][0] $entry[$w][1] $entry[$w][2] $entry[$w][11]", nslookup($entry[$w][11]), "\n";
 }
}
return 1;
};


$policy='DENY';
if ($#ARGV<0) { print " usage: $0 <port>\n";
                print "\t$0 -S\n";
		print "\t$0 -c\n";
                 print " <port> is the port to be searched\n";
                print "-S shows the scanlogd entries in /var/log/messages\n";a
		    print "-c shows a summary over critical ports\n";
 
                 exit (0);
};

@cports=(0,23,25,21,53,110,111,11,15,22,119,515,1080,2049,12345,12346,31337,512,513,514); #contains a list of critical ports

open (FIL ,"cat /var/log/messages | grep $policy |") or die "can't open /var/log/messages";
@messages=<FIL>;
close (FIL);
for ($w=0;$w<=$#messages;$w++) {
@splitted = split " " , $messages[$w];
($splitted[11],$null)= split ":", $splitted[11];
($null,$splitted[12])=split ":", $splitted[12];
$num++;
push @entry,[@splitted];
              }
print "$num Packets logged\n";
print "first: $entry[0][0] $entry[0][1] $entry[0][2]\n";
print "last: $entry[$num-1][0] $entry[$num-1][1] $entry[$num-1][2]\n";
if (($ARGV[0] ne "-S")and($ARGV[0] ne "-c")) {
dumpport($ARGV[0]);
}
elsif ($ARGV[0] eq "-c"){ foreach (sort numerisch @cports) { print "port $_:\n";
                                              dumpport($_);
                                            }
}
else {
exec ("cat /var/log/messages | grep scanlogd: | more");
}

