分析bind日志的脚本

利用做了个简单的智能DNS!需要看下解析的准确率如何，初期分析！废话不多说！开始
日志格式如下

#25-Nov-2009 10:30:36.913 queries: client 117.34.127.52#58678: view XBCT: query: dns.woniucdn.com IN A - xxx
#25-Nov-2009 10:30:40.707 queries: client 222.246.129.106#21289: view HZCT: query: test.queryer.cn.woniucdn.com IN A xxxx
#25-Nov-2009 10:30:48.837 queries: client 218.85.157.67#53729: view HNCT: query: test.queryer.cn.woniucdn.com IN A -xxxx
#25-Nov-2009 10:30:56.540 queries: client 124.161.97.242#32552: view XNWTCNC: query: test.queryer.cn.woniucdn.com IN A xxxx
#25-Nov-2009 10:30:57.348 queries: client 124.161.97.242#54961: view XNWTCNC: query: test.queryer.cn.woniucdn.com IN A -xxxx
#25-Nov-2009 10:30:59.325 queries: client 61.140.11.160#42701: view HNCT: query: test.queryer.cn.woniucdn.com IN A - xxx
#25-Nov-2009 10:31:00.443 queries: client 124.74.213.70#48452: view HDCT: query: test.queryer.cn.woniucdn.com IN A - xxx
#25-Nov-2009 10:31:00.907 queries: client 202.103.224.134#53887: view HNCT: query: test.queryer.cn.woniucdn.com IN A xxx

脚本如下：ipsearch<改自awast的那个perl脚本，请自行下载纯真数据库QQWry.Dat>

#!/usr/bin/perl -w

  my ($ipbegin,$ipend,$ipData1,$ipData2,$DataSeek,$ipFlag);
  
  my $ip=shift;
  my @ip=split(/\./,$ip);
  my $ipNum = $ip[0]*16777216+$ip[1]*65536+$ip[2]*256+$ip[3];

  my $ipfile="./QQWry.Dat";
  open(FILE,"$ipfile");
  binmode(FILE);
  sysread(FILE,$ipbegin,4);
  sysread(FILE,$ipend,4);
   $ipbegin=unpack("L",$ipbegin);
   $ipend=unpack("L",$ipend);
  my $ipAllNum = ($ipend-$ipbegin)/7+1;

  my $BeginNum=0;
  my $EndNum=$ipAllNum;

  Bgn:
  my $Middle= int(($EndNum+$BeginNum)/2);

  seek(FILE,$ipbegin+7*$Middle,0);
  read(FILE,$ipData1,4);
  my $ip1num=unpack("L",$ipData1);
  if ($ip1num > $ipNum) {
    $EndNum=$Middle;
    goto Bgn;
  }

  read(FILE,$DataSeek,3);
  $DataSeek=unpack("L",$DataSeek."\0");
  seek(FILE,$DataSeek,0);
  read(FILE,$ipData2,4);
  my $ip2num=unpack("L",$ipData2);
  if ($ip2num < $ipNum) {
    goto nd if ($Middle==$BeginNum);
    $BeginNum=$Middle;
    goto Bgn;
  }

  $/="\0";
  read(FILE,$ipFlag,1);
  if ($ipFlag eq "\1") {
    my $ipSeek;
    read(FILE,$ipSeek,3);
    $ipSeek = unpack("L",$ipSeek."\0");
    seek(FILE,$ipSeek,0);
    read(FILE,$ipFlag,1);
  }
  if ($ipFlag eq "\2") {
    my $AddrSeek;
    read(FILE,$AddrSeek,3);
    read(FILE,$ipFlag,1);
    if($ipFlag eq "\2") {
      my $AddrSeek2;
      read(FILE,$AddrSeek2,3);
      $AddrSeek2 = unpack("L",$AddrSeek2."\0");
      seek(FILE,$AddrSeek2,0);
    }
    else {
      seek(FILE,-1,1);
    }
    $ipAddr2=;
    $AddrSeek = unpack("L",$AddrSeek."\0");
    seek(FILE,$AddrSeek,0);
    $ipAddr1=;
  }
  else {
    seek(FILE,-1,1);
    $ipAddr1=;
    read(FILE,$ipFlag,1);
    if($ipFlag eq "\2") {
      my $AddrSeek2;
      read(FILE,$AddrSeek2,3);
      $AddrSeek2 = unpack("L",$AddrSeek2."\0");
      seek(FILE,$AddrSeek2,0);
    }
    else {
      seek(FILE,-1,1);
    }
    $ipAddr2=;
  }

  nd:
  chomp($ipAddr1,$ipAddr2);
  $/="\n";
  close(FILE);
  
  $ipAddr2="" if($ipAddr2=~/http/i);
  my $ipaddr="$ipAddr1 $ipAddr2";
  $ipaddr =~ s/CZ88\.NET//isg;
  $ipaddr="未知地区" if ($ipaddr=~/未知|http/i || $ipaddr eq "");
  print "$ipaddr";

awk脚本

awk -F'[:# ]' '{print $8,$12}' query.log|sort|uniq|awk  'BEGIN{print "IP 地址\t\t所属地区\t\t\t\t\t\t\tVIEW\n"};{ip[x++]=$1};{zone[y++]=$2};END{for(i=0;i

输出格式

110.19.16.10    内蒙古 联通                                                     HBCNC
110.19.16.14    内蒙古 联通                                                     HBCNC
110.19.16.18    内蒙古 联通                                                     HBCNC
110.19.16.22    内蒙古 联通                                                     HBCNC
110.19.16.26    内蒙古 联通                                                     HBCNC
110.19.16.2     内蒙古 联通                                                     HBCNC
110.19.16.30    内蒙古 联通                                                     HBCNC
110.19.16.34    内蒙古 联通                                                     HBCNC
110.19.16.38    内蒙古 联通                                                     HBCNC
110.19.16.46    内蒙古 联通                                                     HBCNC
110.19.16.50    内蒙古 联通                                                     HBCNC
110.19.16.54    内蒙古 联通                                                     HBCNC
110.19.16.58    内蒙古 联通                                                     HBCNC
110.19.16.62    内蒙古 联通                                                     HBCNC
110.19.16.6     内蒙古 联通                                                     HBCNC
112.65.184.229  上海市 联通                                                     HDCNC
112.65.184.230  上海市 联通                                                     HDCNC
112.65.184.232  上海市 联通                                                     HDCNC
113.106.201.123 广东省惠州市 电信                                                       HNCT
113.140.10.102  陕西省西安市 电信                                                       XBCT
113.88.135.176  广东省深圳市 电信                                                       HNCT