Perl Parsing Script

kofcrazy · #11 (**permalink**) 04-24-05, 05:57 PM

Charlie,

The site above is broke, I can't connect to it. I've tried to look for other tutorials on the regex functions and syntax. I think I understand most of it, but I'm still confused in some parts.

In this line of coding:
my ($ip, $ts) = $header =~/\[(.*)\]\).*>; (.*)$/;

this is assuming we already found the header that starts with Received: from, and then in the same line, we first look for [ and then include everything until we get to a ]). Then I'm not sure what .*>; does. .* is to include everything after \) and $ marks the end of the line. So are we including everything after ]) ?

The reason I ask this is because I have two emails that looks so similar that I can't find the difference between them to tell why the code finds the ip for one email and not the other. Below are the two emails. The first one I can find the ip, but not the second one.

From 76865738@netsafe.com Mon Jul 06 16:20:50 1998
Return-Path: <76865738@netsafe.com>
Delivered-To: bguenter@hal.qcc.sk.ca
Received: (qmail 14630 invoked by alias); 6 Jul 1998 16:20:50 -0000
Received: (qmail 14623 invoked from network); 6 Jul 1998 16:20:49 -0000
Received: from linus.vsource.com (qmailr@198.169.201.2)
by hal.qcc.sk.ca with SMTP; 6 Jul 1998 16:20:49 -0000
Received: (qmail 18603 invoked by uid 559); 6 Jul 1998 16:06:24 -0000
Delivered-To: bguenter@gemprint.com
Received: (qmail 18597 invoked from network); 6 Jul 1998 16:06:23 -0000
Received: from unknown (HELO cube.getus.com) (205.182.50.5)
by www.gemprint.com with SMTP; 6 Jul 1998 16:06:23 -0000
Received: from usr8-4-dialup22.mix1.Irving.MCI.NET (usr8-4-dialup22.mix1.Irving.MCI.NET [166.55.87.214]) by cube.getus.com (NTMail 3.03.0014/12.aaad) with ESMTP id ra426833 for <bguenter@gemprint.com>; Mon, 6 Jul 1998 10:50:45 -0500
Date: Mon, 06 Jul 98 10:17:19 EST
From: 76865738@netsafe.com
To: triptaker@aol.com
Subject: Are you ready for this?
Reply-To: tigolebitties@earthlink.net
Message-Id: <15503937500777@getus.com>

From g@mci.com Wed Dec 09 07:45:19 1998
Return-Path: <g@mci.com>
Delivered-To: bguenter@hal.qcc.sk.ca
Received: (qmail 5054 invoked from network); 9 Dec 1998 07:45:19 -0000
Received: from linus.vsource.com (198.169.201.2)
by hal.qcc.sk.ca with SMTP; 9 Dec 1998 07:45:19 -0000
Received: (qmail 28841 invoked by uid 559); 9 Dec 1998 07:45:18 -0000
Delivered-To: bguenter@gemprint.com
Received: (qmail 28835 invoked from network); 9 Dec 1998 07:45:18 -0000
Received: from ees.eesc.com (208.212.122.2)
by www.gemprint.com with SMTP; 9 Dec 1998 07:45:18 -0000
Received: from mci.com (1Cust155.tnt1.dca1.da.uu.net [153.34.167.155]) by ees.eesc.com (8.7.5/8.7.3) with SMTP id DAA18762); Wed, 9 Dec 1998 03:53:45 -0500)
From: g@mci.com
Message-Id: <199812090853.DAA18762@ees.eesc.com>
Date: 12/9/98 12:38:15 PM Pacific Daylight Time
Reply-To: e@mci.com
To: zzzz@mci.com
Subject: ~MONEY MAKERS READ

I tried to mess around with the code with lil luck. I can't tell the difference between the emails. It looks like it should work. I think this is the last problem I have.

Sida

Chas · #12 (**permalink**) 04-29-05, 04:11 PM

Here's a better link to those regex tutorials:

http://perldoc.perl.org/perl.html
http://perldoc.perl.org/perlre.html
http://perldoc.perl.org/perlreref.html
http://perldoc.perl.org/perlretut.html
http://perldoc.perl.org/perlrequick.html

It's going to be difficult at best to construct a single regex that will work for all cases. You might have to come up with a few different regexes and test multiple times till you get a match or run out of regexes. One thing you might want to try first is to loosen up the regex a bit. I'm not sure how reliable it will be in this case:

Code:

my ($ip) = $header =~/(\d{2,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}/;
my ($ts) =  $header =~/; (.*)$/ if $ip;

You're just going to have to fiddle around with it.

And yes, at this point, we have a line that starts with "Received:"

~Charlie