Conversion of epoch time

[FFUser]

Hi - I was trying to crate a script to show the last time iptables had seen a given IP address (contained in the ipt_recent kernel hook -- my user-defined table name is 'iplist'). The ipt_recent table yields the following information (IPv4 addresses masked for paranoid reasons):

src=www.xxx.yyy.zzz ttl: 114 last_seen: 9355600126 oldest_pkt: 1 9355600126
src=www.xxx.yyy.zzz ttl: 109 last_seen: 10020040763 oldest_pkt: 1 10020040763
src=www.xxx.yyy.zzz ttl: 111 last_seen: 8106864077 oldest_pkt: 3 8103790647, 8106530788, 8106864077
src=www.xxx.yyy.zzz ttl: 109 last_seen: 9937861664 oldest_pkt: 1 9937861664
src=www.xxx.yyy.zzz ttl: 115 last_seen: 8244867102 oldest_pkt: 1 8244867102

The attempted command used was:

cat /proc/net/ipt_recent/iplist | awk '{print ($1 ,system("date -d @" $5));}'

Such command yields the following (I'm willing to live with the trailing zero):

Wed Jun 20 05:48:46 EDT 2266
src=www.xxx.yyy.zzz 0
Sun Jul 10 12:39:23 EDT 2287
src=www.xxx.yyy.zzz 0
Fri Nov 24 05:41:17 EST 2226
src=www.xxx.yyy.zzz 0
Mon Dec  1 08:07:44 EST 2284
src=www.xxx.yyy.zzz 0
Sat Apr  9 12:51:42 EDT 2231
src=www.xxx.yyy.zzz 0

I presume the ipt_recent table uses the standard UNIX epoch timestamp. Am I using the date command syntax incorrectly, is this a 32-bit vs 64-bit break, or it is something else? Please note that I am using FC10, and I have double-checked my system clock settings (both BIOS and OS). The system has only been running during 2009 (no reboot yet).

Thanks!

[FFUser]

Ok - so after a bit of digging, the ipt_recent table date-timestamps in jiffies instead of epoch time (makes sense as it is a kernel hook). Based on a rough `sleep` test, my system generally conforms to the 1kHz basis, so the following seems to work generally well to my previous problem (even if it is not an elegant solution):

cat /proc/net/ipt_recent/iplist | awk '{print ($1 ,system("date -d @$(($(date +'%s')-($(cat /proc/timer_list | grep -m1 -E '^jiffies' | cut -d\" \" -f2)-" $5 ")/1000))"));}'

Let me know if there is a more parsimonious way to extract the current jiffies value from kernelspace (the above just grabs the first processor as the application does not need to be excessively resolute).

Hope this helps anyone else, and thanks for any suggestions on improvement.

P.S. - I am personally using this to align milestone packet receipts to firewall intrusion logs for white- and black-listed IPs.

[latheefp]

This is a simple script I have done for printing above value in better format. I think you will enjoy.

FILE=/proc/net/xt_recent/SSH #This is file name of recent module output. It may vary on your system (like iplist)

printit()
{
Len=`echo $1|wc -c`
Date=$DATE
Dot="."
Loop=`echo 50-$Len|bc`
loop=0
while [ $loop -le $Loop ]
do
loop=`echo $loop+1|bc`
Dot=`echo $Dot.`
done
echo "$1$Dot$DATE"
}
cat $FILE|while read LINE
do
IP=`echo $LINE|awk '{print $1}'|awk -F= {'print $2'}`
DATE=`echo $LINE|awk '{print (system("date -d @$(($(date +'%s')-($(cat /proc/timer_list|grep -m1 -E '^jiffies'|cut -d\" \" -f2)-" $5 ")/1000))"));}'|head -1 `
printit $IP $DATE
done

It can print the result like below.

[root@latheef scripts]# ./recent.sh
95.179.19.95.......................................Fri Dec  3 23:15:49 AST 2010
41.34.166.177......................................Sat Dec  4 02:01:45 AST 2010
78.174.61.253......................................Sat Dec  4 00:32:45 AST 2010
201.230.48.230.....................................Fri Dec  3 23:57:13 AST 2010
116.71.2.248.......................................Sat Dec  4 18:23:23 AST 2010
78.162.30.62.......................................Sat Dec  4 18:38:58 AST 2010
196.219.92.139.....................................Sat Dec  4 13:48:07 AST 2010
78.166.77.16.......................................Sat Dec  4 19:09:44 AST 2010
151.15.244.237.....................................Sat Dec  4 00:14:36 AST 2010
200.121.180.204....................................Sat Dec  4 00:37:03 AST 2010
201.240.251.89.....................................Sat Dec  4 12:37:42 AST 2010
85.107.26.54.......................................Sat Dec  4 01:25:42 AST 2010
190.236.201.116....................................Fri Dec  3 23:33:26 AST 2010
190.236.195.46.....................................Fri Dec  3 23:52:58 AST 2010
83.66.44.228.......................................Sat Dec  4 00:40:47 AST 2010
85.100.254.196.....................................Sat Dec  4 00:49:43 AST 2010
85.103.226.219.....................................Sat Dec  4 18:35:39 AST 2010
190.235.50.9.......................................Sat Dec  4 01:05:10 AST 2010
85.97.70.75........................................Sat Dec  4 01:17:50 AST 2010
200.106.33.25......................................Sat Dec  4 14:24:17 AST 2010
190.40.171.115.....................................Sat Dec  4 01:40:56 AST 2010
95.72.156.23.......................................Sat Dec  4 18:21:06 AST 2010
190.42.214.182.....................................Sat Dec  4 18:12:41 AST 2010
88.251.188.80......................................Sat Dec  4 01:47:41 AST 2010
190.235.75.41......................................Sat Dec  4 00:36:30 AST 2010
190.254.253.83.....................................Sat Dec  4 00:18:01 AST 2010
200.111.3.229......................................Sat Dec  4 13:57:56 AST 2010
217.113.134.209....................................Sat Dec  4 00:17:45 AST 2010
201.244.226.127....................................Fri Dec  3 23:36:20 AST 2010
190.234.170.104....................................Sat Dec  4 00:18:56 AST 2010
85.98.230.207......................................Sat Dec  4 00:32:44 AST 2010
190.232.245.1......................................Sat Dec  4 01:07:48 AST 2010