Dropbear ash sort command issue

[okoolo]

I'm trying to sort filtered conntrack output by number of packets in dropbear but I'm running into issues as sort command does not seem to work even though in bash it works fine
I'm using:
cat /proc/net/nf_conntrack |grep "192.168.2.162" | grep "udp" | grep -E "packets=[1-9]{2,}"| awk '{print "type " $3 " " $7 " " $9 " " $10}' | sort -n -t '=' -k4

to get this:

ype udp ip src=192.168.2.162 dport=443 packets=10
type udp ip src=192.168.2.162 dport=443 packets=11
type udp ip src=192.168.2.162 dport=443 packets=15
type udp ip src=192.168.2.162 dport=443 packets=208
type udp ip src=192.168.2.162 dport=50013 packets=189
type udp ip src=192.168.2.162 dport=50013 packets=744
type udp ip src=192.168.2.180 dport=443 packets=134
type udp ip src=192.168.2.180 dport=443 packets=347
type udp ip src=192.168.2.180 dport=443 packets=62
type udp ip src=192.168.2.180 dport=443 packets=715
type udp ip src=192.168.2.188 dport=443 packets=25

I tried it in bash on a pc and it works fine but on ash it does not sort at all. Any ideas?

[efahl]

The busybox sort does not implement field separators, it just ignores those parameters, which is probably the root cause of your issue. You could either opkg install coreutils-sort, or maybe try splitting stuff up and reordering it with awk and sorting on the reordered output...

$ busybox sort --help
BusyBox v1.36.1 (2024-01-27 18:09:25 UTC) multi-call binary.

Usage: sort [-nru] [FILE]...

Sort lines of text

        -n      Sort numbers
        -r      Reverse sort order
        -s      Stable (don't sort ties alphabetically)
        -u      Suppress duplicate lines
        -z      NUL terminated input and output

[efahl]

Here's another thing that might help. awk's -F (the split delimiter) takes a regex, so you could say something like this, which splits the fields at either a sequence of spaces or at '='.

awk -F'( +|=)' '/192.168.2.162/ { if ($3 == "udp") print "...whatever..." }'

(Note that the parens in the -F expression are optional, I just added them to more clearly show the space character before the + sign.)