:rule (:src ( : dmz_block1 ):dst ( : (Any :color (Blue) ) ):services ( : smtp : http : ftp ):action (: (accept:type (accept):color ("Dark green"):macro (RECORD_CONN):icon-name (icon-accept):text-rid (61463):windows-color (green)))):track ( : Short ):install (: (Gateways:type (gateways):color ("Navy Blue"):icon-name (icon-gateways))):time ( : (Any :color (Blue) ) )use strict;my ($openclose,$str);$openclose = qr/\([^()]*(?:(??{$openclose})[^()]*)*\)/;
while (<DATA>){/^([^#]+)(?{ $str = $^N })/;while ($str =~ /($openclose)/g) {print $1, "\n";}}__END__(a)# (a)((a)# (a)(((a)(b))(d)) # (((a)(b))(d))

#!/usr/bin/perl#use Inline C;use NetPacket::Ethernet qw(:strip);use NetPacket::IP;use NetPacket::UDP;use Net::DNS::Packet;use strict;my ($fd,$rin,$rout,@data,$pac);my ($ip,$udp,$pac,$dns);
if(($fd = prepare()) < 0){print "Can't setup BPF\n";exit (1);}$rin = '';vec($rin,$fd,1) = 1;print "Ready!\n";while(1){select($rout = $rin, undef, undef, undef);@data = getdata($fd);
for $pac (@data){$ip = NetPacket::IP->decode(eth_strip($pac));$udp = NetPacket::UDP->decode($ip->{data});$pac = $udp->{data};$dns = Net::DNS::Packet->new(\$pac);printf "%s:%s -> %s:%s\n%s\n-----------------------\n",$ip->{src_ip},$udp->{src_port},$ip->{dest_ip},$udp->{dest_port},$dns->print}}__END____C__#include <sys/types.h>#include <sys/time.h>#include <sys/socket.h>#include <sys/ioctl.h>#include <net/bpf.h>#include <net/if.h>#include <net/ethertypes.h>#include <stdio.h>#include <fcntl.h>#include <string.h>#include <stdlib.h>#include <errno.h>#define bhp ((struct bpf_hdr *)bp)static intbpf_open(void);int prepare(){int fd,immediate;struct ifreq ifr;static struct bpf_insn insns[] = {BPF_STMT(BPF_LD +BPF_H +BPF_ABS, 12),BPF_JUMP(BPF_JMP +BPF_JEQ +BPF_K, ETHERTYPE_IP, 0, 8),BPF_STMT(BPF_LD +BPF_H +BPF_ABS, 20),BPF_JUMP(BPF_JMP +BPF_JSET+BPF_K, 0x1FFF, 6, 0),BPF_STMT(BPF_LD +BPF_B +BPF_ABS, 23),BPF_JUMP(BPF_JMP +BPF_JEQ +BPF_K, 0x11, 0, 4),BPF_STMT(BPF_LDX +BPF_B +BPF_MSH, 14),BPF_STMT(BPF_LD +BPF_H +BPF_IND, 14),BPF_JUMP(BPF_JMP +BPF_JEQ +BPF_K, 0x0035, 0, 1),BPF_STMT(BPF_RET +BPF_K,BPF_STMT(BPF_RET +BPF_K,};static struct bpf_program filter = {sizeof insns / sizeof(insns[0]),insns};(u_int)-1),0),}fd = bpf_open();void getdata(int fd)immediate = 1;{if(ioctl(fd,BIOCIMMEDIATE,&immediate) < 0){fprintf(stderr,"BIOCIMMEDIATE: %s\n",strerror(errno)); int i,cc;u_char *buf, *bp, *ep;return (-1);
int bufsize;}Inline_Stack_Vars;(void)strncpy(ifr.ifr_name,"pcn0",4);
ifr.ifr_name[4] = '\0';if (ioctl(fd, BIOCGBLEN, (caddr_t) & bufsize) < 0){if (ioctl(fd, BIOCSETIF, (caddr_t) & ifr) < 0){fprintf(stderr,"BIOCGBLEN: %s\n",strerror(errno));fprintf(stderr,"BIOCSETIF: %s\n",strerror(errno));}return (-2);}if((buf = (u_char *) malloc ((unsigned) bufsize)) == 0){if (ioctl(fd, BIOCPROMISC) < 0){fprintf(stderr,"malloc: %s",strerror(errno));fprintf(stderr,"BIOCPROMISC: %s\n",strerror(errno));}return (-3);}cc = read(fd,(char *) buf,bufsize);if (ioctl(fd, BIOCSETF, (caddr_t) & filter) < 0){bp = buf;fprintf(stderr,"BIOCSETF: %s\n",strerror(errno));ep = bp + cc;return (-4);}return fd;Inline_Stack_Reset;while (bp < ep){int caplen,hdrlen;caplen = bhp->bh_caplen;hdrlen = bhp->bh_hdrlen;Inline_Stack_Push(sv_2mortal(newSVpvn(bp+hdrlen,caplen)));bp += BPF_WORDALIGN(hdrlen + caplen);}}Inline_Stack_Done;./dns.pl
Ready!
;; HEADER SECTION;; id = 44135;; qr = 1 opcode = QUERY aa = 1 tc = 0 rd = 1;; ra = 1 ad = 0 cd = 0 rcode = NOERROR;; qdcount = 1 ancount = 2 nscount = 3 arcount = 2;; QUESTION SECTION (1 record);; www.perl.com.
IN A;; ANSWER SECTION (2 records)www.perl.com. 3600 IN A208.201.239.56www.perl.com. 3600 IN A208.201.239.8;; AUTHORITY SECTION (3 records)perl.com.
86400 IN NS ns2.xor.com.
perl.com.
86400 IN NS ns.songline.com.
perl.com.
86400 IN NS ns1.sonic.net.
;; ADDITIONAL SECTION (2 records)ns.songline.com.
86400 IN A208.201.239.31ns1.sonic.net. 86400 IN A208.201.224.11172.16.100.11:53 -> 172.16.102.52:654901-----------------------