/*tracker*/
iplist = ''
topnum = 0
flood = 5
parse arg time
if time = '' then time = 20
vecho("Monitoring ICMP's for "time" seconds..")
dtime = time * 50
address command 'run >NIL: amitcp:bin/sanamon aslip.device 0 > t:tracker'
delay(dtime)
address command 'status > t:tracker.status'
open(t,'t:tracker.status',r)

do until task = 'amitcp:bin/sanamon'
t1 = readln(t)
parse var t1 process' 'tasknum': 'blah': 'task
end

address command 'break 'tasknum

close(t)

address command 'delete t:tracker.status'

open(t,'t:tracker',r)

t1 = readln(t)

t1 = readln(t)

do until eof(t)

	t1 = readln(t)

	parse var t1 'in 'inbyte' bytes, type='type', err='err', werr='werr', HOST, 'fip.1':'fip.2':'fip.3':'fip.4'->'rest
	if fip.1 ~= ''  then do
		do i = 1 to 4
			fip.i = x2d(fip.i)
		end
		ip = fip.1'|'fip.2'|'fip.3'|'fip.4
		x = find(iplist,ip)
		if x ~= 0 then do
			iptimes.x = iptimes.x + 1
			ipbytes.x = ipbytes.x + inbyte
			if x > topnum then topnum = x
		end
		else do
			iplist = iplist||ip' '
			a = find(iplist,ip)
			iptimes.a = 1
			ipbytes.a = inbyte
		end
	end
end
close(t)
vecho("Monitoring over")
address command 'delete t:tracker'
vecho("Checking to see if anyone was ICMP flooding..")
do i = 1 to topnum
	if iptimes.i >= flood then do
		address command 'amitcp:bin/askhost 'translate(word(iplist,i),'.','|')' >t:tracker'
		open(t,'t:tracker',r)
		do until eof(t)
			t1=readln(t)
			if t1 = 'gethostbyaddr: Unknown host' then do
				vecho(bold(ipbytes.i' bytes from 'translate(word(iplist,i),'.','|')))
				vecho(Checking for matches)
				'say /who 'translate(word(iplist,i),'.','|')
			end	
			if left(t1,5)='host:' then do
				parse var t1 'host:'host'addrtype'blah
				host = strip(host)
				vecho(bold(ipbytes.i' bytes from 'host))
				if upper(right(host,12)) ~= 'UNDERNET.ORG' then do
					do
						vecho("Checking for possible matches..")
						'say /who 'host
						'say /who 'translate(word(iplist,i),'.','|')
					end	
				end
			end	
		end
	close(t)
	end
end
vecho("Tracking over")
exit
vecho:;"ECHO P="d2c(27)"b«Tracker»" arg(1);return 0
bold:;bold=d2c(2);return bold||arg(1)||bold