3

On linux, I am writing a script in python to process the file /proc/net/xt_recent/PORTSCAN, which looks lke this:

src=123.45.67.89 ttl: 64 last_seen: 4298265432 oldest_pkt: 1 4298265432
src=132.45.67.89 ttl: 64 last_seen: 4298265432 oldest_pkt: 1 4298265432
src=231.45.67.89 ttl: 64 last_seen: 4298265432 oldest_pkt: 1 4298265432

The last column (ie, 4298265432) is AFAIU time in "jiffy" format.

How can I convert it to something human sensible in python? For example, I would like to know how many seconds have passed since.

David
  • 208,112
  • 36
  • 198
  • 279
Martin Vegter
  • 136
  • 9
  • 32
  • 56

1 Answers1

3

In order to convert jiffies, you are going to have to start by finding your kernels constant value for HZ. You could do this by using os.sysconf:

import os

sc_clk_tck = os.sysconf_names['SC_CLK_TCK']
HZ = os.sysconf(sc_clk_tck)

From here you want to find the system boot time:

with open('/proc/stat') as f:
    for ln in f.readlines():
        if ln.startswith('btime'):
            btime = int(ln.split()[1])

Take this value and add it to your jiffy values you want converted divided by HZ:

(packet_jiffy / HZ) + btime

You could pass this value on to time.ctime and/or subtract it from time.time.

import os
import time

sc_clk_tck = os.sysconf_names['SC_CLK_TCK']
HZ = os.sysconf(sc_clk_tck)

with open('/proc/stat') as f:
    for ln in f.readlines():
        if ln.startswith('btime'):
            btime = ln.split()[1]


packet_time = (packet_jiffy / HZ) + btime
print time.ctime(packet_time)
print "Seconds ago %d" % (time.time() - packet_time)

This post has more information dealing with converting jiffies.

Community
  • 1
  • 1
tijko
  • 7,599
  • 11
  • 44
  • 64