awk: hping: print difference between icmp originate/receive

Question

I have the following output from hping on OpenBSD:

# hping --icmp-ts www.openbsd.org
HPING www.openbsd.org (re0 129.128.5.194): icmp mode set, 28 headers + 0         


        

Answer 1

Using perl, you can do something like this:

#!/usr/bin/perl -n
#
if (/Originate=(\d+) Receive=(\d+) Transmit=(\d+)/) {
    ($o, $r, $t) = ($1, $2, $3);
} elsif (/tsrtt=(\d+)/) {
    print $r - $o, " ", $o + $1 - $t, "\n";
}

If you call this icmpstats.pl, you can use as hping | perl icmpstats.pl.