title: awk: hping: print difference between icmp originate/receive
body: <p>I have the following output from <a href="http://ports.su/net/hping" rel="nofollow noreferrer"><code>hping</code></a> on OpenBSD:</p>
  
  <pre><code># hping --icmp-ts www.openbsd.org
  HPING www.openbsd.org (re0 129.128.5.194): icmp mode set, 28 headers + 0 data bytes
  len=46 ip=129.128.5.194 ttl=237 id=23807 icmp_seq=0 rtt=155.3 ms
  ICMP timestamp: Originate=22085077 Receive=22085171 Transmit=22085171
  ICMP timestamp RTT tsrtt=156
  
  len=46 ip=129.128.5.194 ttl=237 id=4150 icmp_seq=1 rtt=154.8 ms
  ICMP timestamp: Originate=22086078 Receive=22086171 Transmit=22086171
  ICMP timestamp RTT tsrtt=155
  
  ^C
  --- www.openbsd.org hping statistic ---
  2 packets tramitted, 2 packets received, 0% packet loss
  round-trip min/avg/max = 154.8/155.0/155.3 ms
  </code></pre>
  
  <p>I require some extra arithmetic <a href="https://networkengineering.stackexchange.com/questions/5132/measure-one-way-latency-jitter-packet-loss">to troubleshoot asymmetric routes</a>, as available in <a href="http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=651270" rel="nofollow noreferrer">a patch in some bugreport</a>, but I don't want to have to recompile the software.</p>
  
  <p>TL;DR, the two new fields are calculated as <code>Receive − Originate</code> and <code>Originate + tsrtt − Transmit</code>, to result in something like the following (without necessarily having to span 4 lines).</p>
  
  <pre><code>len=46 ip=129.128.5.194 ttl=237 id=23807 icmp_seq=0 rtt=155.3 ms
  ICMP timestamp: Originate=22085077 Receive=22085171 Transmit=22085171
  ICMP timestamp RTT tsrtt=156  src-&gt;dst=94  dst-&gt;src=62
  </code></pre>
  
  <p>How do I do this with <code>awk</code>?  (I'm fine with any other *BSD tool, too.)</p>