Re: question about searching datasets for ip addresses
IBM Mainframe Discussion List wrote on 06/25/2009 12:45:24 PM: //SEARCH EXEC PGM=ISRSUPC,PARM=(SRCHCMP,'ANYC') //NEWDD DD DSN=SOME.DATA.SET,DISP=SHR//OUTDD DD SYSOUT=*//SYSIN DD * SRCHFOR 'SOMETHING' /* -Rob -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@bama.ua.edu with the message: GET IBM-MAIN INFO Search the archives at http://bama.ua.edu/archives/ibm-main.html
Re: question about searching datasets for ip addresses
> -Original Message-
> From: IBM Mainframe Discussion List On Behalf Of Klein, Kenneth
>
> Try this:
>
>
>
//*-+1+2+3+4+5+6+7--
> //PROC001 PROC
> //SCAN EXEC PGM=ISRSUPC,PARM=('L SRCHCMP ANYC')
> //OUTDD DD SYSOUT=*
> //NEWDD DD DISP=SHR,DSN=&DSN
> //SYSIN DD DISP=SHR,DSN=KQKTEMP.$TSO.JCLLIB(SCANPARM)
> //ENDOFIT PEND
> //S0A EXEC PROC=PROC001,DSN='KQKTEMP.$TSO.JCLLIB'
> //* scanparm looks like this:
> //
> SRCHFOR 'KQKTEMP'
An option I've not seen mentioned yet is DFSORT (and possibly Syncsort),
using the "substring" ( SS ) function of the INCLUDE control card:
//STEP01 EXEC PGM=SORT
//SYSOUT DD SYSOUT=*
//SORTIN DD DISP=SHR,DSN=your.input.dataset
//SORTOUT DD DISP=(,CATLG),DSN=your.output.dataset,
//UNIT=SYSALLDA,SPACE=(TRK,(1,1))
//SYSINDD *
SORT FIELDS=COPY
INCLUDE COND=(1,80,SS,EQ,C'192.168.1.14',OR,
1,80,SS,EQ,C'192.168.001.014')
/*
This just does the basic "find" and copies the found records unchanged
to SORTOUT. Of course, you can get a whole lot fancier with the output
using the OUTFIL control card.
-jc-
--
For IBM-MAIN subscribe / signoff / archive access instructions,
send email to lists...@bama.ua.edu with the message: GET IBM-MAIN INFO
Search the archives at http://bama.ua.edu/archives/ibm-main.html
Re: question about searching datasets for ip addresses
On Thu, 2009-06-25 at 12:08 -0500, Schlueter, Edward wrote: > but, is there an easy way to find, for example, > 100.020.002.020 and > 100.20.2.20 (which is really the same IP address) > without finding extras, such as > 100.120.112.120 (which would show up with some wildcarding) Easy with regex - but then you need to be cognisant of the dots. Pick your poison - perl, awk, grep, sed, ... Shane... -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@bama.ua.edu with the message: GET IBM-MAIN INFO Search the archives at http://bama.ua.edu/archives/ibm-main.html
Re: question about searching datasets for ip addresses
Patrick O'Keefe wrote: On Thu, 25 Jun 2009 16:36:28 -0400, Bob Rutledge wrote: Patrick O'Keefe wrote: ... On z/OS (and I assume other IBM mainframe operating systems) a leading zero signifies a leading zero, not a switch to octal. We include leading zeroes in some IP addresses because it simplifies sorting. READY nslookup 10.20.100.4 EZB3170I Server: ... EZB3172I Address: ... EZB3170I Name:host... EZB3172I Address: 10.20.100.4 READY nslookup 10.020.100.4 EZB3170I Server: ... EZB3172I Address: ... EZB3010I *** ... can't find 10.020.100.4: Non-existent domain ... I forgot that NSLOOKUP uses its own resolver. It implements different rules than gethostbyaddr(). Try a ping or tracerte or any application that uses gethostbyaddr() on z/OS (at least 1.8) and you get the same results with or without leading zeroes. NSLOOKUP and DIG use their own name resolution schemes. Interestingly, the Unix command "host" (no TSO equivalent in 1.8) that I thought used gethostbyaddr() seems to have the octal junk support. (Why octal is still supported in anything is beyond me.) My simple-minded answer will be to continue to avoid leading zeroes until the network folks get consistent. Everywhere. Bob -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@bama.ua.edu with the message: GET IBM-MAIN INFO Search the archives at http://bama.ua.edu/archives/ibm-main.html
Re: question about searching datasets for ip addresses
On Thu, 25 Jun 2009 14:25:19 -0700, Edward Jaffe wrote: >... >> It will be "simpler" with IPv6. The numbers are in hex without need >> for any format indicator. >> > >I think IPv6 addresses will actually be more difficult to scan for. You >can optionally specify :: (two colons) anywhere in the address to >denote any number of zeros, leading zeros after a colon are >optional, and you are often allowed to specify an IPv4 formatted > address at the extreme right side of the address to describe an >IP address that happens to be in the IPv4 space. It's highly >unlikely that everyone will code any two IPv6 addresses exactly >alike! >... Well, note that I did put "simpler" in quotes. I probably should also have added a smiley. It's not going to get easier; just different - very, very different. Pat O'Keefe -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@bama.ua.edu with the message: GET IBM-MAIN INFO Search the archives at http://bama.ua.edu/archives/ibm-main.html
Re: question about searching datasets for ip addresses
>>On z/OS (and I assume other IBM mainframe operating systems) a >> leading zero signifies a leading zero, not a switch to octal. >> >> We include leading zeroes in some IP addresses because it >> simplifies sorting. > READY >nslookup 10.20.100.4 > EZB3170I Server: ... > EZB3172I Address: ... > > EZB3170I Name:host... > EZB3172I Address: 10.20.100.4 > > READY >nslookup 10.020.100.4 > EZB3170I Server: ... > EZB3172I Address: ... > > EZB3010I *** ... can't find 10.020.100.4: Non-existent domain > >At least as of z/OS 1.9. > >Bob Seems to be situational. Here, 10.208.12.21 resolves the same as 10.208.012.021... info from an old APAR: PQ74543: PING TREATS IP ADDRESSES WITH LEADING ZEROES AS OCTAL NUMBERS INSTEAD OF DECIMAL NUMBERS. APAR status Closed as fixed if next. Error description Ping treats IP addresses with leading zeroes as octal numbers. A ping of IP address 9.017.3.4 will result in a ping being sent to IP address 9.15.3.4. Ping is using the C library call inet_addr to convert the IP address into a in_addr structure. inet_addr interprets number with leading zeroes as octal. Ping should be using inet_pton, which does not do this conversion. . http://www-01.ibm.com/support/docview.wss?rs=852&context=SSSN3L&q1=ip+address+oc tal&uid=isg1PQ74543&loc=en_US&cs=utf-8&lang=en so, inet_addr vs. inet_pton? more digging to do :-) Ed Anheuser-Busch InBev Email Disclaimer www.ab-inbev.com -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@bama.ua.edu with the message: GET IBM-MAIN INFO Search the archives at http://bama.ua.edu/archives/ibm-main.html
Re: question about searching datasets for ip addresses
Patrick O'Keefe wrote: It will be "simpler" with IPv6. The numbers are in hex without need for any format indicator. I think IPv6 addresses will actually be more difficult to scan for. You can optionally specify :: (two colons) anywhere in the address to denote any number of zeros, leading zeros after a colon are optional, and you are often allowed to specify an IPv4 formatted address at the extreme right side of the address to describe an IP address that happens to be in the IPv4 space. It's highly unlikely that everyone will code any two IPv6 addresses exactly alike! This entire topic serves as an advertisement for the use of DNS. -- Edward E Jaffe Phoenix Software International, Inc 5200 W Century Blvd, Suite 800 Los Angeles, CA 90045 310-338-0400 x318 edja...@phoenixsoftware.com http://www.phoenixsoftware.com/ -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@bama.ua.edu with the message: GET IBM-MAIN INFO Search the archives at http://bama.ua.edu/archives/ibm-main.html
Re: question about searching datasets for ip addresses
On Thu, 25 Jun 2009 16:36:28 -0400, Bob Rutledge wrote: >Patrick O'Keefe wrote: >> ... >> On z/OS (and I assume other IBM mainframe operating systems) a >> leading zero signifies a leading zero, not a switch to octal. >> >> We include leading zeroes in some IP addresses because it >> simplifies sorting. > > READY >nslookup 10.20.100.4 > EZB3170I Server: ... > EZB3172I Address: ... > > EZB3170I Name:host... > EZB3172I Address: 10.20.100.4 > > READY >nslookup 10.020.100.4 > EZB3170I Server: ... > EZB3172I Address: ... > > EZB3010I *** ... can't find 10.020.100.4: Non-existent domain >... I forgot that NSLOOKUP uses its own resolver. It implements different rules than gethostbyaddr(). Try a ping or tracerte or any application that uses gethostbyaddr() on z/OS (at least 1.8) and you get the same results with or without leading zeroes. NSLOOKUP and DIG use their own name resolution schemes. Interestingly, the Unix command "host" (no TSO equivalent in 1.8) that I thought used gethostbyaddr() seems to have the octal junk support. (Why octal is still supported in anything is beyond me.) Pat O'Keefe Pat O'Keefe -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@bama.ua.edu with the message: GET IBM-MAIN INFO Search the archives at http://bama.ua.edu/archives/ibm-main.html
Re: question about searching datasets for ip addresses
Patrick O'Keefe wrote: On Thu, 25 Jun 2009 15:19:58 -0400, Bob Rutledge wrote: ... You could be in for a surprise later in life... c:\br>ping 100.020.002.020 Pinging 100.16.2.16 with 32 bytes of data: 0nn means octal nn. ... On z/OS (and I assume other IBM mainframe operating systems) a leading zero signifies a leading zero, not a switch to octal. We include leading zeroes in some IP addresses because it simplifies sorting. READY nslookup 10.20.100.4 EZB3170I Server: ... EZB3172I Address: ... EZB3170I Name:host... EZB3172I Address: 10.20.100.4 READY nslookup 10.020.100.4 EZB3170I Server: ... EZB3172I Address: ... EZB3010I *** ... can't find 10.020.100.4: Non-existent domain At least as of z/OS 1.9. Bob -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@bama.ua.edu with the message: GET IBM-MAIN INFO Search the archives at http://bama.ua.edu/archives/ibm-main.html
Re: question about searching datasets for ip addresses
On Thu, 25 Jun 2009 15:19:58 -0400, Bob Rutledge wrote: >... >You could be in for a surprise later in life... > > c:\br>ping 100.020.002.020 > > Pinging 100.16.2.16 with 32 bytes of data: > >0nn means octal nn. >... On z/OS (and I assume other IBM mainframe operating systems) a leading zero signifies a leading zero, not a switch to octal. We include leading zeroes in some IP addresses because it simplifies sorting. It will be "simpler" with IPv6. The numbers are in hex without need for any format indicator. Pat O'Keefe -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@bama.ua.edu with the message: GET IBM-MAIN INFO Search the archives at http://bama.ua.edu/archives/ibm-main.html
Re: question about searching datasets for ip addresses
Try this:
//*-+1+2+3+4+5+6+7--
//PROC001 PROC
//SCAN EXEC PGM=ISRSUPC,PARM=('L SRCHCMP ANYC')
//OUTDD DD SYSOUT=*
//NEWDD DD DISP=SHR,DSN=&DSN
//SYSIN DD DISP=SHR,DSN=KQKTEMP.$TSO.JCLLIB(SCANPARM)
//ENDOFIT PEND
//S0A EXEC PROC=PROC001,DSN='KQKTEMP.$TSO.JCLLIB'
//* scanparm looks like this:
//
SRCHFOR 'KQKTEMP'
Ken Klein
Sr. Systems Programmer
Kentucky Farm Bureau Insurance - Louisville
kenneth.kl...@kyfb.com
502-495-5000 x7011
-Original Message-
From: IBM Mainframe Discussion List [mailto:ibm-m...@bama.ua.edu] On
Behalf Of Ted MacNEIL
Sent: Thursday, June 25, 2009 12:45 PM
To: IBM-MAIN@bama.ua.edu
Subject: Re: question about searching datasets for ip addresses
>Does anyone have a technique using ibm utilities or free software, they
would be willing to share, for searching mainframe datasets for certain
ip addresses?
ISPF 3.14 -- SRCHFOR
-
Too busy driving to stop for gas!
--
For IBM-MAIN subscribe / signoff / archive access instructions, send
email to lists...@bama.ua.edu with the message: GET IBM-MAIN INFO Search
the archives at http://bama.ua.edu/archives/ibm-main.html
--
For IBM-MAIN subscribe / signoff / archive access instructions,
send email to lists...@bama.ua.edu with the message: GET IBM-MAIN INFO
Search the archives at http://bama.ua.edu/archives/ibm-main.html
Re: question about searching datasets for ip addresses
Schlueter, Edward wrote: but, is there an easy way to find, for example, 100.020.002.020 and 100.20.2.20 (which is really the same IP address) You could be in for a surprise later in life... c:\br>ping 100.020.002.020 Pinging 100.16.2.16 with 32 bytes of data: 0nn means octal nn. Bob -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@bama.ua.edu with the message: GET IBM-MAIN INFO Search the archives at http://bama.ua.edu/archives/ibm-main.html
Re: question about searching datasets for ip addresses
but, is there an easy way to find, for example, 100.020.002.020 and 100.20.2.20 (which is really the same IP address) without finding extras, such as 100.120.112.120 (which would show up with some wildcarding) -Original Message- From: IBM Mainframe Discussion List [mailto:ibm-m...@bama.ua.edu] On Behalf Of Ted MacNEIL Sent: Thursday, June 25, 2009 11:45 AM To: IBM-MAIN@bama.ua.edu Subject: Re: question about searching datasets for ip addresses >Does anyone have a technique using ibm utilities or free software, they would be willing to share, for searching mainframe datasets for certain ip addresses? ISPF 3.14 -- SRCHFOR - Too busy driving to stop for gas! -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@bama.ua.edu with the message: GET IBM-MAIN INFO Search the archives at http://bama.ua.edu/archives/ibm-main.html Anheuser-Busch InBev Email Disclaimer www.ab-inbev.com -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@bama.ua.edu with the message: GET IBM-MAIN INFO Search the archives at http://bama.ua.edu/archives/ibm-main.html
Re: question about searching datasets for ip addresses
>Does anyone have a technique using ibm utilities or free software, they would >be willing to share, for searching mainframe datasets for certain ip addresses? ISPF 3.14 -- SRCHFOR - Too busy driving to stop for gas! -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@bama.ua.edu with the message: GET IBM-MAIN INFO Search the archives at http://bama.ua.edu/archives/ibm-main.html
Re: question about searching datasets for ip addresses
2009/6/25 Scott Barry : > On Thu, 25 Jun 2009 08:03:51 -0700, Kurt Eastwood wrote: >>Does anyone have a technique using ibm utilities or free software, they > would be willing to share, for searching mainframe datasets for certain ip > addresses? > ISPF 3.14 Search-For (in batch)? We're probably missing the problem. Are these IP addresses in text form, e.g. 10.1.2.3, or are they in 32-bit binary form, e.g. X'0A010203'? In either case it's easy to search a dataset for these strings with ISPF. Are you looking to do wildcarding, e.g. search for 10.1.*.* perhaps? This is a problem in binary, because the number of false hits rises rapidly as the search string gets shorter, and unless you know the layout of what's in these datasets, you aren't going to be able to distinguish IP addresses from other data. Tony H. -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@bama.ua.edu with the message: GET IBM-MAIN INFO Search the archives at http://bama.ua.edu/archives/ibm-main.html
Re: question about searching datasets for ip addresses
On Thu, 25 Jun 2009 08:03:51 -0700, Kurt Eastwood wrote: >Hello, > >Does anyone have a technique using ibm utilities or free software, they would be willing to share, for searching mainframe datasets for certain ip addresses? > >Thanks for any help given, >Kurt > ISPF 3.14 Search-For (in batch)? Scott Barry SBBWorks, Inc. -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@bama.ua.edu with the message: GET IBM-MAIN INFO Search the archives at http://bama.ua.edu/archives/ibm-main.html
question about searching datasets for ip addresses
Hello, Does anyone have a technique using ibm utilities or free software, they would be willing to share, for searching mainframe datasets for certain ip addresses? Thanks for any help given, Kurt -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@bama.ua.edu with the message: GET IBM-MAIN INFO Search the archives at http://bama.ua.edu/archives/ibm-main.html
