This is a little application started out as a quick hack to save myself a lot of hassle when it came time to sift through the large log files, created by ICMP Logger during a ping attack, pulling IP numbers and other data out and to organize it in a neat and legible sort of way before sending it off to my local ISP. It has now become a useful MacOS application.
It is not fancy and has no bells or whistles in any way. But it's FAST. It can sift through a 900Kb file in seconds.
It is to be used in conjunction with ICMP Logger v1.0. It was unknown, at the time of this writing, if there was a newer version that creates a differently formatted log file, which basically means that this is to be used ONLY on log files created by the aforementioned program.
ICMP Logger, when used, creates a text file with the following format which can grow to megabyte proportions. If you are familiar with this kind of situation then you can understand the difficulty in reading through the file to find needed info.
Sample Log File:
••• Log File Opened at 23:22:16 @ Wednesday, May 6, 1998
Current IP: 209.53.18.229
1: 09:50:50: 1052: 194.244.85.165
2: 09:50:54: 1052: 194.244.85.165
3: 09:50:58: 1052: 194.244.85.165
4: 09:51:02: 1052: 194.244.85.165
5: 09:51:07: 1052: 194.244.85.165
6: 09:51:10: 1052: 194.244.85.165
7: 09:51:14: 1052: 194.244.85.165
8: 09:51:18: 1052: 194.244.85.165
9: 09:51:22: 1052: 194.244.85.165
10: 09:51:26: 1052: 194.244.85.165
11: 09:51:30: 1052: 194.244.85.165
12: 09:51:34: 1052: 194.244.85.165
••• Log File Opened at 22:08:27 @ Sunday, May 24, 1998
Current IP: 209.53.18.229
1: 09:50:50: 1052: 194.244.85.165
2: 09:50:54: 1052: 194.244.85.165
3: 09:50:58: 1052: 194.244.85.165
4: 09:51:02: 1052: 194.244.85.165
••• Log File Opened at 23:09:19 @ Monday, May 25, 1998
Current IP: 209.53.18.64
1: 23:10:50: 48: 209.53.18.254
2: 23:10:50: 48: 209.53.18.254
3: 00:05:03: 1052: 194.244.85.165
4: 00:05:07: 1052: 194.244.85.165
Here is a sample of what PingReporter gives you after processing a log file:
Originating # of |----- Time -----| |-- Ping Size -| (Incoming)
IP Address Pings Start Stop Min Max Avg Total Bytes
PingReporter also organizes the data according to the date as given by the datestamps within the log file. These datestamps are important as they are used to calibrate the output dates. A "rolling over" of the midnight hour (as shown above for the May 25 sample) will also be detected and the output date is incremented. Using the above sample, 2 pings would be recorded for May 25, while the rest (until a new day is detected) will be recorded for May 26.
For best and accurate results, it's a good idea to quit & re-run ICMP Logger at least once every 2 days. Otherwise the date calibration may be incorrect if during a 24 hour period you did not recieve any pings.
After the creation of the ".rep" file, it's best to open it with simple text, select all, and change your font to a non-proportional one such as Monaco (as above), if you already aren't using one. It's quite possible that the report file generated is larger than 32Kb in which case something other than SimpleText will be required.
A quick break down of what PingReporter does:
• Extracts IP numbers from the log files.
• Counts the number of pings received from a particular IP.
• Shows you when that IP started and stopped sending the pings.
• Shows you the size of the pings and if they changed size.
• Calculates the total number of bytes received from those pings.
• Organizes all this data in a neat manner so that it can easily be passed on to others without much hassle
Grinch
southpole@pobox.com
I welcome any and all comments or complaints about this program so go ahead and send me some email if you use it.
Version History
1.1 first public release. (May 25 1998)
Was a console based app which used the DropUnix lib for drag & drop capabilities.