tail -F -n 1 /var/log/syslog | stdbuf -oL -eL grep "OUT packet" | while read line; do
  dst=`echo "$line" | cut -d " " -f 13 | cut -d "=" -f 2`
  proto=`echo "$line" | cut -d " " -f 20 | cut -d "=" -f 2 | tr A-Z a-z`
  dpt=`echo "$line" | cut -d " " -f 22 | cut -d "=" -f 2`
  rest=`echo "$line" | cut -d " " -f 25-`

  app=`netstat -tuapn | grep "$dst" | tr -s " " | cut -d " " -f 7 | tr "\n" ","`

  if [ "$dst" = "$prevdst" ]; then # do not repeat on multiple packets
    continue
  fi

  echo "? $line"

  alert=`zenity --entry --title "pkt $dst:$dpt" --text "Packet\nDST $dst\nPROTO $proto\nPORT $dpt\nINFO $rest\nPID $app\n?"`
  if [ $? -eq 0 ]; then # user acked the packet
    bash /root/add-ip-excp.sh "$proto" "$dst" "$dpt" "$alert"
  fi
  prevdst="$dst"
done