Sphere of Inconvenience

That was kind of interesting to me, so here's how I'm tackling it:

tcpdump -n | awk '{print $3,$4,$5}' | grep -v "Request who has" | grep -v "::" > nic.txt

grep "> 172.16.0.187" nic.txt | awk -F "." '{print $1"."$2"."$3"."$4}' | sort | uniq -c > fromhosts.txt

That gives me a list of hosts that sent me data, reverse it for a list of host I sent data to:
grep "172.16.0.187 >" nic.txt | awk -F "." '{print $1"."$2"."$3"."$4}' | sort | uniq -c > tohosts.txt

for host in `cat ./tohosts.txt | awk ' {print $2}'`; do for hops in `traceroute -q 1 -w 1 $host | awk -F "(" '{print $2}' | awk -F ")" '{print $1}'`; do echo $hops >> routers.txt; done; done

The line for getting the tohost.txt file doesn't work because of port numbers, really you'd have to awk them out of the original capture to make that file work, which is probably fine. Anyway, fromhosts and tohosts give you lists of all the IPs you hit and how many times you interact with them, at the end you can do a "cat routers.txt | sort | uniq" to give you only uniq IPs of routers, because the first bunch are always going to be the same obviously.

How much cleaner was your perl? I think I'll get a better capture of every interaction since I'm dumping the list from a constant tcpdump over a day instead of taking snapshots with a cron job that I assume grabs netstat data of what's connected right now?

I tested for 30 seconds and refreshed tabs containing Fark, Last.fm, Flickr, Twitter and FB. I got 53 unique hosts sending me data, and 218 unique routers. From reloading FIVE. TABS. Yikes.

I used -w 1 and -q 1 on the traceroute to reduce the wait time for that line to run. Basically by default traceroute waits 5 seconds for each hop to respond, and repeats the request 3 times. This only makes one request, and only waits 1 second. That way the max time you'll wait per traceroute is 64 seconds if zero hops respond but you never finish the trace either. You'll lose a couple routers here and there, but it saves SO much time. I don't think doing traceroutes on a days worth of data gathered this way is really a smart thing to do on a work computer :-)

I fully intend to run this for a full day on a few different systems to see what results I get, then maybe make a map of them, just to do it, that would be fun, right?