Question

The below is a part of a script i’m trying to write. The script opens my iptables log, each line in the log contains the details in the example below.

#example of a single line
#Mar  9 14:57:51 machine kernel: [23780.638839] IPTABLES Denied UDP: IN=p21p1 OUT= MAC=ff:ff:ff:ff:ff:ff:00:00:00:00:00:00:00:00 SRC=10.100.1.4 DST=10.100.1.63 LEN=78 TOS=0x00 PREC=0x00 TTL=128 ID=10898 PROTO=UDP$

# Read file in a line at a time
for line in iptables_log.readlines():
    #find time based on 4 letters, 2 spaces, up to 2 numbers, 1 space, then standard 10:10:10 time format
    time = re.findall('(^\w{1,4}\s\s\d{1,2}\s\d\d:\d\d:\d\d)', line)
    #mac lookup
    mac = re.findall('MAC=(?:\w\w:\w\w:\w\w:\w\w\:\w\w:\w\w:\w\w:\w\w:\w\w:\w\w:\w\w:\w\w:\w\w:\w\w)', line)
    #source port
    src = re.findall('SRC=(?:[\d]{1,3})\.(?:[\d]{1,3})\.(?:[\d]{1,3})\.(?:[\d]{1,3})', line)
    #destination port
    dst = re.findall('DST=(?:[\d]{1,3})\.(?:[\d]{1,3})\.(?:[\d]{1,3})\.(?:[\d]{1,3})', line)
    #protocol
    proto = re.findall('PROTO=(?:\w{3,4})', line)
    #sourceport
    sourceport = re.findall('SPT=(?:\w{1,5})', line)
    #destport
    destport = re.findall('DPT=(?:\w{1,5})', line)
    print time, mac, src, dst, proto, sourceport, destport
    print '======================================================'

I’m trying to get the script to print only the items i want, but when its output by the script it looks like this, which would seem to be a list. I want it to print without the [] ”. Looking online it seems like every variable (time, mac, src, etc) are a list themselves. I’m not sure how to combine them. I have seen reference to join but am not sure how to use it this example. Can someone assist please?

['Mar  9 14:57:51'] ['MAC=ff:ff:ff:ff:ff:ff:00:00:00:00:00:00:00:00'] ['SRC=10.100.1.4'] ['DST=10.100.1.63'] ['PROTO=UDP'] ['SPT=137'] ['DPT=137']

Answer 1

Why not just unpack your lists ?

>>> time = [0]
>>> [time] = time
>>> time
0