title: DDOS perl script
body: <p>Im trying to write a script that uses <code>tcpdump</code> under <code>openbsd</code> than monitor firewall logs.
  My goal is to genereate an alert if a source ip address is equal to evry line [ line duplicate  ]  from the tcpdump output, example : </p>
  
  <pre><code>rule 30/0(match): block in on pppoe0: SRCIP:(88.198.46.51) -&gt; DESTIP:(109.226.27.19): ICMP echo request, id 1070, seq 1, length 64
  rule 30/0(match): block in on pppoe0: SRCIP:(88.198.46.51) -&gt; DESTIP:(109.226.27.19): ICMP echo request, id 1070, seq 2, length 64
  rule 30/0(match): block in on pppoe0: SRCIP:(88.198.46.51) -&gt; DESTIP:(109.226.27.19): ICMP echo request, id 1070, seq 3, length 64
  rule 30/0(match): block in on pppoe0: SRCIP:(88.198.46.51) -&gt; DESTIP:(109.226.27.19): ICMP echo request, id 1070, seq 4, length 64
  rule 30/0(match): block in on pppoe0: SRCIP:(88.198.46.51) -&gt; DESTIP:(109.226.27.19): ICMP echo request, id 1070, seq 5, length 64
  rule 30/0(match): block in on pppoe0: SRCIP:(88.198.46.51) -&gt; DESTIP:(109.226.27.19): ICMP echo request, id 1070, seq 6, length 64
  rule 30/0(match): block in on pppoe0: SRCIP:(88.198.46.51) -&gt; DESTIP:(109.226.27.19): ICMP echo request, id 1070, seq 7, length 64
  rule 30/0(match): block in on pppoe0: SRCIP:(88.198.46.51) -&gt; DESTIP:(109.226.27.19): ICMP echo request, id 1070, seq 8, length 64
  </code></pre>
  
  <p>ip 88.198.46.51 is attempted dos attack.
  my code so far:</p>
  
  <pre><code>open(SNIFF, "/usr/sbin/tcpdump -s 1024 -enlti pflog0 |");
   while(&lt;SNIFF&gt;){
         $|++;
         $_ =~ /(\d+.\d+.\d+.\d+)(.)(\d{2,5}) (&gt;) (\d+\.\d+\.\d+\.\d+)(.)(\d{2,5})/;
         my ($sip, $port) = ($1, $7);
         my $bad_ip = $sip;
          if($bad_ip eq $p_ip){
              $count++;
              if($count &gt;= 8 &amp;&amp; $print){
                print "Attack Detected: $sip\n";
                            system("echo $sip");
                            #system("/sbin/pfctl -f /etc/pf.conf");
                            $print = 0;
              }
  </code></pre>