#!/usr/bin/perl
use warnings;
use strict;

use Net::Pcap;
use NetPacket::Ethernet;
use NetPacket::IP;

use Net::hostent;
use Sys::Hostname;
use Socket qw ( inet_ntoa );

use threads;
use threads::shared;
use Data::Dumper;

die "Usage: $0 <if>\n" unless @ARGV;

my %iplist;
&grab_ips();

my($dev) = ($ARGV[0]);
die "Cannot open tcpdump: $!\n" unless open TCPDUMP, "tcpdump -e -t -n -i $dev |";

my %counts : shared;
my $thr = threads->create("save_counts");

while(my $l=<TCPDUMP>) {
  if($l=~/ip (\d+): ([\w\.]+) > ([\w\.]+)/){
    my($len,$src,$dst)=($1,$2,$3);
    $src =~ s/\.\w+$//;
    $dst =~ s/\.\w+$//;
    #print("$l$len $src $dst\n");
#    my $tgt = (defined($iplist{$dst}))?$dst:$src;
    my $tgt;
#    print keys(%iplist)."\n";
    if (exists($iplist{$src})) {
      $tgt = $src;
      $counts{$tgt} = 0 unless defined $counts{$tgt};
      $counts{$tgt} += $len;
    }
    if (exists($iplist{$dst})) {
      $tgt = $dst;
      $counts{$tgt} = 0 unless defined $counts{$tgt};
      $counts{$tgt} += $len;
    }

  }
}

sub save_counts {
  while(1) {
    print Dumper \%counts;
    # ^
    #this should be a flatfile count write

    foreach my $k (keys %counts){
      # hopefully this will keep the key churn down.
      if($counts{$k}==0){
        delete($counts{$k});
      } else {
        $counts{$k} = 0;
      }
    }
    sleep 5;
  }
}

sub grab_ips{
  if (open IPS, "</etc/rc.d/ips") {
    my $line;
    while( $line = <IPS> ) {
      chomp $line;
      $line =~s/ +//g;        # clean off whitespace.
      if( $line =~ /^#/ || $line eq "" || $line =~ /[^0-9.]/ ){ next; }
      $iplist{$line}++;
      }
    close IPS;
  }
  my $hostname = hostname;
  my $hostent = gethost($hostname);
  my $addr    = inet_ntoa($hostent->addr); undef $hostent;
  $iplist{$addr}++;
}