Alphabetical List of TAWK Functions

Introduction

This sections presents an overview of all tawk functions available.

  • Parameters between brackets are optional,
  • IPs can be given as string ("1.2.3.4"), hexadecimal (0xffffffff) or int (4294967295),
  • Network masks can be given as string ("255.255.255.0"), hexadecimal (0xffffff00) or CIDR notation (24),
  • Networks can be given as string, hexadecimal or int, e.g., "1.2.3.4/24" or "0x01020304/255.255.255.0",
  • String functions can be made case insensitive by adding the suffix i, e.g., streq (case sensitive) becomes streqi (case insensitive),
  • More details and examples can be found for every function by running tawk -d funcname.

A

abs, aggr, aggrrep, ah

abs(v) Return the absolute value of v.
aggr(fields[,val[,num]]) Perform aggregation of fields and store the sum of val.
fields and val can be tab separated lists of fields, e.g., $srcIP4 "\t" $dstIP4.
Results are sorted according to the first value of val.
If val is omitted or equal to "flows", count the number of flows.
If num is omitted or 0, return the full list,
If num > 0 return the top num results,
If num < 0 return the bottom num results.
aggrrep(fields[,val[,num[,ign_e[,sep]]]]) Perform aggregation of the repetitive fields and store the sum of val.
val can be a tab separated lists of fields, e.g., $numBytesSnt "\t" $numPktsSnt.
Results are sorted according to the first value of val.
If val is omitted or equal to "flows", count the number of flows.
If num is omitted or 0, return the full list,
If num > 0 return the top num results,
If num < 0 return the bottom num results.
If ign\_e is omitted or 0, consider all values, otherwise ignore emtpy values.
sep can be used to change the separator character (default: ";")
ah([p]) Return true if the protocol is equal to 51 (AH).

B

base64, bfeq, bitsallset, bitsanyset

base64d(s) Decode a base64 encoded string s.
bfeq(val1,val2) Return true if the hexadecimal numbers val1 and val2 are equal.
bitsallset(val,mask) Return true if all the bits set in mask are also set in val.
bitsanyset(val,mask) Return true if one of the bits set in mask is also set in val.

C

chomp, contains, cvalcontains

chomp(s) Remove leading and trailing spaces from a string.
contains(val,txt) Return true if val contains the substring txt.
cvalcontains(val,item) Alias for valcontains(val, "\_", item).

D

dhcp, dhost, diff, dnet, dns, dport

dhcp() Return true if the flow contains DHCP traffic.
dhost([ip|net]) Return true if the destination IP is equal to ip or belongs to net.
If ip is omitted, return the destination IP.
diff(file[,mode]) Compare file and the input, and print the name of the columns which differ.
The mode parameter can be used to control the format of the output.
dnet([ip|net]) Alias for dhost([ip|net]).
dns() Return true if the flow contains DNS traffic.
dport([p]) Return true if the destination port is equal to p.
If p is omitted, return the destination port.

E

esp

esp([p]) Return true if the protocol is equal to 50 (ESP).

F

ffsplit, flow

ffsplit([s[,k[,h]]]) Split the input file into smaller more manageable files.
The files to create can be specified as argument to the function (one comma separated string).
If no argument is specified, create one file per column whose name ends with Stat,
e.g., dnsStat, and one for pwxType (pw) and covertChannels (cc).
If k > 0, then only print relevant fields and those controlled by h, a comma separated list of
fields to keep in each file, e.g., "srcIP,dstIP".
flow(f) Return all flows whose index appears in f.

G

gre

gre([p]) Return true if the protocol is equal to 47 (GRE).

H

haspreffix, hassuffix, hdr, host, hrnum, http

hasprefix(val,pre) Return true if val begins with the prefix pre.
hassuffix(val,suf) Return true if val finished with the suffix suf.
hdr() Use this function in your tests to keep the header (column names).
host([ip|net]) Return true if the source or destination IP is equal to ip or belongs to net.
If ip is omitted, return the source and destination IP.
hrnum(num[,mode[,suffix]]) Convert the number num to its human readable form.
http() Return true if the flow contains HTTP traffic.

I

icmp, icmp6, igmp, isip, isip6, isiphex, isipnum, isipstr, isnum, ip, ip2mask, ip2num, ip2hex, ip2str, ip62str, ip6compress, ip6expand, ipinnet, ipinrange, ipv4, ipv6

icmp([p]) Return true if the protocol is equal to 1 (ICMP).
icmp6([p]) Return true if the protocol is equal to 58 (ICMPv6).
igmp([p]) Return true if the protocol is equal to 2 (IGMP).
isip(v) Return true if v is an IPv4 address in hexadecimal, numerical or dotted decimal notation.
isip6(v) Return true if v is an IPv6 address.
isiphex(v) Return true if v is an IPv4 address in hexadecimal notation.
isipnum(v) Return true if v is an IPv4 address in numerical (int) notation.
isipstr(v) Return true if v is an IPv4 address in dotted decimal notation.
isnum(v) Return true if v is a number.
ip() Return true if the flow contains IPv4 or IPv6 traffic.
ip2mask(ip) Convert an IP address to a network mask (int).
ip2num(ip) Convert an IP address to a number.
ip2hex(ip) Convert an IPv4 address to hex.
ip2str(ip) Convert an IPv4 address to string.
ip62str(ip) Convert an IPv6 address to string.
ip6compress(ip) Compress an IPv6 address.
ip6expand(ip[,trim]) Expand an IPv6 address.
If trim is different from 0, remove leading zeros.
ipinnet(ip,net[,mask]) Test whether an IP address belongs to a given network.
ipinrange(ip,low,high) Test whether an IP address lies between two addresses.
ipv4() Return true if the flow contains IPv4 traffic.
ipv6() Return true if the flow contains IPv6 traffic.

J

join, json

join(a,s) Convert an array to string, separating each value with s.
json(s) Convert the string s to JSON. The first record is used as column names.

L

localtime, loopback, lstrip

localtime(t) Convert UNIX timestamp to string (localtime).
loopback(ip) Return true if ip is a loopback address.
lstrip(s) Remove leading spaces from a string.

M

mask2ip, mask2ip6, mask2ip6str, mask2ipstr, max, max2, max3, mcast, mean, min, min2, min3

mask2ip(m) Convert a network mask (int) to an IPv4 address (int).
mask2ip6(m) Convert a network mask (int) to an IPv6 address (int).
mask2ip6str(m) Convert a network mask (int) to an IPv6 address (string).
mask2ipstr(m) Convert a network mask (int) to an IPv4 address (string).
max(c) Keep track of the max value of a column c.
The result can be accessed with get_max(c) or printed with print_max([c]).
max2(a,b) Return the maximum value between a and b.
max3(a,b,c) Return the maximum value between a, b and c.
mcast(ip) Return true if ip is a multicast address.
mean(c) Compute the mean value of a column c.
The result can be accessed with get_mean(c) or printed with print_mean([c]).
min(c) Keep track of the min value of a column c.
The result can be accessed with get_min(c) or printed with print_min([c]).
min2(a,b) Return the minimum value between a and b.
min3(a,b,c) Return the minimum value between a, b and c.

N

net, not

net([ip|net]) Alias for host([ip|net]).
not(q) Return the logical negation of a query q.
This function must be used to keep the header when negating a query.

P

packet, port, printerr, privip, proto, proto2str

packet(p) Return all packets whose number appears in f.
port([p]) Return true if the source or destination port is equal to p
(multiple ports ("p1;p2") or port ranges ("p1-p2") can also be specified).
If p is omitted, return the source and destination port.
printerr(s) Print the string s in red with an added newline.
privip(ip) Return true if ip is a private IP.
proto([p]) Return true if the protocol is equal to p.
If p is omitted, return the string representation of the protocol.
proto2str(p) Return the string representation of the protocol number p.
If p is omitted, return the protocol.

R

rstrip, rsvp, rvalcontains

rstrip(s) Remove trailing spaces from a string.
rsvp([p]) Return true if the protocol is equal to 46 (RSVP).
rvalcontains(val,item) Alias for valcontains(val, ";", item).

S

sctp, shark, shost, snet, splitc, splitr, sport, streq, strip, strisempty, strneq

sctp([p]) Return true if the protocol is equal to 132 (SCTP).
shark(q) Query flow files according to Wireshark’s syntax.
shost([ip|net]) Return true if the source IP is equal to ip or belongs to net.
If ip is omitted, return the source IP.
snet([ip|net]) Alias for shost([ip|net]).
splitc(val[,num[,osep]]) Split compound values. Alias for t2split(val, "\_", num, osep).
splitr(val[,num[,osep]]) Split repetitive values. Alias for t2split(val, ";", num, osep).
sport([p]) Return true if the source port is equal to p.
If p is omitted, return the source port.
streq(val1,val2) Return true if val1 is equal to val2.
strip(s) Remove leading and trailing spaces from a string.
strisempty(val) Return true if val is an empty string.
strneq(val1,val2) Return true if val1 and val2 are not equal.

T

t2sort, t2split, tcp, tcpflags, texscape, timestamp, tuple2, tuple3, tuple4, tuple5, tuple6

t2sort(col[,num[,type]]) Sort the file according to col.
If num is omitted or 0, return the full list,
If num > 0 return the top num results,
If num < 0 return the bottom num results.
type can be used to specify the type of data to sort:
"ip", "num" or "str" (default is based on the first matching record).
t2split(val,sep[,num[,osep]]) Split values according to sep.
If num is omitted or 0, val is split into osep separated columns.
If num > 0, return the num repetition.
If num < 0, return the num repetition from the end, e.g., -1 for last element.
Multiple num can be specified, e.g., "1;-1;2".
Output separator osep, defaults to OFS.
tcp([p]) Return true if the protocol is equal to 6 (TCP).
tcpflags([val]) If val is specified, return true if the specified flags are set.
If val is omitted, return a string representation of the TCP flags.
texscape(s) Escape the string s to make it LaTeX compatible.
timestamp(t) Convert date to UNIX timestamp.
tuple2() Return the 2 tuple (source IP and destination IP).
tuple3() Return the 3 tuple (source IP, destination IP and port).
tuple4() Return the 4 tuple (source IP and port, destination IP and port).
tuple5() Return the 5 tuple (source IP and port, destination IP and port, protocol).
tuple6() Return the 6 tuple (source IP and port, destination IP and port, proto, VLANID).

U

udp, unquote, urldecode, utc

udp([p]) Return true if the protocol is equal to 17 (UDP).
unquote(s) Remove leading and trailing quotes from a string.
urldecode(url) Decode the encoded URL url.
utc(t) Convert UNIX timestamp to string (UTC).

V

valcontains

valcontains(val,sep,item) Return true if one item of val split by sep is equal to item.

W

wildcard

wildcard(expr) Print all columns whose name matches the regular expression expr.
If expr is preceded by an exclamation mark, return all columns whose name does NOT match expr.