Month: February 2020

Compare error prompts of different awk flavours

Awk requires the opening brace of an action must be on the same line as the pattern it accompanies. I compared error prompts of different awk flavours, and my OS is NetBSD.

(1) awk shipped in NetBSD:

# awk 'BEGIN
> {print "Hello Awk!"}'
awk: syntax error at source line 2
 context is
        BEGIN >>>
 <<<
awk: bailing out at source line 2

(2) nawk:

# nawk 'BEGIN
{print "Hello Awk!"}'
nawk: syntax error at source line 2
 context is
        BEGIN >>>
 <<<
nawk: bailing out at source line 2

(3) mawk:

# mawk 'BEGIN
{print "Hello Awk!"}'
mawk: line 1: syntax error at or near end of line

(4) gawk:

# gawk 'BEGIN
{print "Hello Awk!"}'
gawk: cmd. line:2: BEGIN blocks must have an action part

IMHO, gawk gives more clear clues for this error.

Process large pcap file

To process large pcap file, usually it is better to split it into small chunks first, then process every chunk in parallel. I implement a simple shell script to do it:

#!/bin/sh

input_pcap=input.pcap
output_pcap=./pcap/frag.pcap
spilt_size=1000
output_index=1
loop_count=10
exit_flag=0

command() {
    echo "$1" "$2" > log"$2"
}

tcpdump -r ${input_pcap} -w ${output_pcap} -C ${spilt_size}

command ${output_pcap}

while :
do
    loop_index=0
    while test ${loop_index} -lt ${loop_count}
    do
        if test -e ${output_pcap}${output_index}
        then
            command ${output_pcap} ${output_index} &
            output_index=$((output_index + 1))
            loop_index=$((loop_index + 1))
        else
            exit_flag=1
            break
        fi
    done
    wait

    if test ${exit_flag} -eq 1
    then
        exit 0
    fi
done

First of all, split input pcap file into 1GB chunks. Then launch 10 processes to crunch data (in above example, just simple output). Definitely you can customize it.

BTW, the code can be downloaded here.