I love simple SQL.

select COUNT(id) as Count,FROM_UNIXTIME(MIN(oob_time_sec)) as MIN,FROM_UNIXTIME(MAX(oob_time_sec)) as MAX,INET_NTOA(ip_saddr), tcp_dport, udp_dport,icmp_type from ulog where FROM_UNIXTIME(oob_time_sec) > DATE_SUB(CURDATE(), INTERVAL 28 DAY) group by ip_saddr,tcp_dport,udp_dport order by ip_saddr;