np_tcpconn.py

该软件根据网络数据生成NetFlow记录。NetFlow可用于网络规划、负载均衡、安全监控等

	    sthresh = 1
	try:
	    cthresh = (cdur/self.cdpkts)/2
	except ZeroDivisionError:
          ##   str = 'TCPConn #%d C Zero data packets:' % (self.id)
##             if trace:
##                 inform(str)
##             self.logfun(str)
	    cthresh = 1
	    
	#print 'spkts = %d cpkts = %d' % (self.sdpkts, self.cdpkts)
	#print 'sthresh = %.3f cthresh = %.3f ' % (sthresh/1000.0, cthresh/1000.0)

        cclus = []
        sclus = []
        self.sdbw = []
        self.cdbw = []
	for way, pl, clul, thresh, bwl in [
            (SERVER, self.spktlist, sclus, sthresh, self.sdbw),
            (CLIENT, self.cpktlist, cclus, cthresh, self.cdbw)
            ]:
            if not pl:
                continue
	    clu = 0
	    lt = pl[0].tm
            cl = []
	    for p in pl:
		if p.len or p.flags & (TH_SYN | TH_FIN):
		    if p.tm-lt > thresh:
                        clul.append(cl)
                        cl = []
			clu = clu+1
			p.clu = clu
                        cl.append(p)
		    else:
			p.clu = clu
                        cl.append(p)
		    lt = p.tm
		else:
		    p.clu=999
            clul.append(cl)
		#print 'pkt %d next %d clu %d' % (p.indx, p.nxt.indx, p.clu)

            for cl in clul:
                if len(cl) > 1:
                    octs = 0
                    for p in cl[:-1]:
                        octs += p.len + 20 + 20 + 18
                    per = cl[-1].tm - cl[0].tm
                    bw = float(octs)/per
                    bwl.append(bw)

            if self.trace:
                if way == SERVER:
                    w = 'Server'
                else:
                    w = 'Client'
                print self.id, w,'clusters ['
                for cl in clul:
                    print '[',
                    octs = 0
                    for p in cl:
                        octs += p.len + 20 + 20 + 18
                        print '(', p.indx, p.clu, p.tm/1000, ')',
                    octs -= cl[-1].len + 20 + 20 + 18
                    print ']',
                    if len(cl) > 1:
                        print octs, '/', cl[-1].tm - cl[0].tm, '=', float(octs)/(cl[-1].tm - cl[0].tm)
                    else:
                        print
                print ']'
		

#############################################################################
		
    def calc_delays(self, cliid, imps, adict):

        #
        # find delays associated with this connection
        #

        def report(s, n, d):
            str = 'WebClient #%s %s - clients: TCPConn #%d %d %d' \
                  % (intoa_string(cliid), s, self.id, n, d)
            self.logfun(str)
            if self.trace:
                whoops(str)
            str = 'TCPConn #%d %s - conns: Client #%s %d %d' % ( self.id,
                                            s, intoa_string(cliid), n, d)
            self.logfun(str)
            if self.trace:
                whoops(str)

        delays = []
        cflags = self.cflags
        sflags = self.sflags
        connected = sflags & TSP_SYN
        gotreq = self.cdpkts
        gotrep = self.sdpkts
        ncsyns = 1
        csyndelay = 0
        nfirstreqr = 0
        firstreqdelay = 0
        nreqr = 0
        reqdelay =0
        nfpkts = 0
        dflags = 0
        nspkts = 0
        nsertmts = 0
        nsrtmts = 0
        repbdelay = 0
        repsdelay = 0
        spkts = []
        cgoodacks = 0
        sFIN = 0
        sRTTest = 0
        nslrtmts = 0
        slrtmtdelay = 0

        if (cflags & TSP_DUP_SYN) or self.closs or self.sloss:
            ncsyns = 0
            chiseq = 0
            lastreqtm = 0L
            lastspkt = 0L
            gotreq = 0
            gotrep = 0
            sfirst = cfirst = 1
            for p in self.pktlist:
                if p.dir == SERVER:
                    seq = p.seq
                    len = p.len
                    end = seq + len
                    if sfirst:
                        shiseq = stopseq = end
                        sfirst = 0
                    if p.flags & TH_SYN:
                        end = seq + 1
                        shiseq = ssynseq = seq
                        shiseq += 1
                        stopseq = shiseq
                        spkts.append([seq, seq+1, 0, [p.tm], p.indx])
                        #print  p.indx, 'on plist', seq-ssynseq, seq+1-ssynseq, p.tm
                        #print 'SYN chiseq', chiseq
                    elif len:
                        gotrep = 1
                        end = seq+len
                        #print seq, len, end
                        if seq == shiseq or seq == stopseq:
                            shiseq += len
                            lastspkt = p.tm
                            nspkts += 1
                            #print 'ok'
                            spkts.append([seq, end, 0, [p.tm], p.indx])
                            #print  p.indx, 'on plist', seq-ssynseq, end-ssynseq, p.tm
                        #elif seq > chiseq:
                        elif end <= stopseq:
                            if sFIN and end >= sFIN and p.tm - sFINtm > L_RTMT_THRESH:
                                sfindly = p.tm - sFINtm
                                #print p.indx, 'REPLAST', 'dly=', sfindly/1000
                                dflags |= D_SFINDLY
                                if self.translist:
                                    try:
                                        self.translist[0].delrepend = self.translist[0].repend + sfindly
                                    except AttributeError:
                                        print self.translist[0]
                                        raise
                            else:
                                for pp in spkts:
                                    if pp[0] <= seq < pp[1]:
                                        pp[2] = 1
                                        pp[3].append(p.tm)
                                    #print  p.indx, 'set to revisit', seq-ssynseq, end-ssynseq, '(->', pp[4], pp[0]-ssynseq, pp[1]-ssynseq, pp[3], ')'
                            sdelay = p.tm - lastspkt
                    if p.flags & TH_FIN:
                        if not sFIN:
                            sFINtm = p.tm
                        sFIN = end
                        #print p.indx, 'sFIN', sFIN-ssynseq
                    stopseq = max(end, stopseq)
                        
                    #print 'topseq=', stopseq-ssynseq, 'hiseq=', shiseq-ssynseq
                else:
                    seq = p.seq
                    len = p.len
                    if cfirst:
                        chiseq = ctopseq = end = seq+len
                        lastreqtm = p.tm
                    if p.flags & TH_ACK:
                        ack = p.ack
                        sacki = 0
                        bads = 0
                        for pp in spkts:
                            if ack < pp[1]:
                                break
                            #print p.indx, 'ack', ack-ssynseq, 'saw', pp[4],
                            if not pp[2]:
                                if not bads:
                                    cgoodacks += 1
                                    #print 'goodack', cgoodacks
                                #else:
                                    #print
                            else:
                                bads += 1
                                if cgoodacks < 3:
                                    cgoodacks = 0
                                lastbad = sacki
                                #print 'nullack'
                            sacki += 1
                        if bads:
                            lb = spkts[lastbad]
                            sdelay = lb[3][-1] - lb[3][0]
                            if sdelay < L_RTMT_THRESH:
                                sRTTest = 1
                            if sRTTest:
                                if sdelay < L_RTMT_THRESH:   
                                    nsrtmts += 1
                                    repsdelay += sdelay
                                    dflags |= D_REPSDLY
                                    # print p.indx, 'smalldelay', lb[3][-1]/1000, lb[3][0]/1000, sdelay/1000, lb[4]
                                else:   
                                    nslrtmts += 1
                                    slrtmtdelay += sdelay
                                    dflags |= D_REPSLRTMT
                                    # print p.indx, 'long retransmit', lb[3][-1]/1000, lb[3][0]/1000, sdelay/1000, lb[4]
                            else:
                                nsertmts += 1
                                repbdelay += sdelay
                                dflags |= D_REPBDLY
                                #print p.indx, 'bigdelay', lb[3][-1]/1000, lb[3][0]/1000, sdelay/1000, lb[4]
                            
                        del spkts[0:sacki]
                        #print 'del->', sacki
                        
                    if p.flags & TH_SYN:
                        ncsyns += 1
                        if ncsyns > 1:
                            dflags |= D_DUPCSYN
                            csyndelay = p.abtm - self.abstart
                        chiseq = csynseq = seq
                        chiseq += 1
                        ctopseq = chiseq
                        #print 'SYN chiseq', chiseq
                    elif len:
                        gotreq = 1
                        end = seq+len
                        #print seq, len, end
                        ctopseq = max(end, ctopseq)
                        if seq == csynseq + 1: # first request
                            if end <= chiseq:
                                nfirstreqr += 1
                                firstreqdelay += p.tm - lastreqtm
                                dflags |= D_DUPFREQ
                                #print 'D_DUPFREQ'
                            chiseq = end
                            lastreqtm = p.tm
                        else:
                            #print 'follower', 
                            nfpkts += 1
                            if seq == chiseq or seq == ctopseq:
                                chiseq += len
                                lastreqtm = p.tm
                                #print 'ok'
                            #elif seq > chiseq:
                            elif end <= ctopseq:
                                nreqr += 1
                                reqdelay += p.tm - lastreqtm
                                dflags |= D_CRETRANS
                                #print 'rtmt'
            #raw_input('...')

        if self.sloss:
            dflags |= D_SLOSS


        if not gotreq:
            dflags |= D_REQNOTSEEN
        if not gotrep:
            dflags |= D_REPNOTSEEN


        if connected:
            if nfirstreqr:
                delays.append(nfirstreqr)
                delays.append(int(firstreqdelay/1000))
                if firstreqdelay/1000 < 1000:
                    # first req rtmtd in less than 1s
                    report('Fast request retransmit', nfirstreqr, int(firstreqdelay/1000))
                if gotrep:
                    report('Duplicate requests', nfirstreqr, int(firstreqdelay/1000))
                else:
                    report('Duplicate requests - no server response', nfirstreqr, int(firstreqdelay/1000))
            elif not gotreq:
                report('No request', 1, int(self.dur/1000))
                delays.append(1)
                delays.append(int(self.dur/1000))
            elif not gotrep:
                report('No server response', 1, int(self.dur/1000))
            if nreqr:
                delays.append(nreqr)
                delays.append(int(reqdelay/1000))
                report('Request pkt retransmit', nreqr, int(reqdelay/1000))
        else:
            dflags |= D_NOT_CONNECTED
            csyndelay = self.dur


        if dflags & D_DUPCSYN:
            delays.append(ncsyns-1)
            delays.append(int(csyndelay/1000))
            if connected:
                report('Duplicate CliSYN', ncsyns-1, int(csyndelay/1000))
            else:
                report('Duplicate CliSYN, connection refused', ncsyns-1, int(csyndelay/1000))
        elif not connected:
            report ('Connection refused', 0, int(csyndelay/1000))
            delays.append(0)
            delays.append(int(csyndelay/1000))

        if (not gotrep) and gotreq:
            delays.append(1)
            delays.append(int(self.dur/1000))

##         if dflags & D_SLOSS:
##             report('Server pkt loss')
##             #self.calc_pkt_loss(imps, adict)
##             delays.append(self.soop)
##             delays.append(self.srtmtp)

        if dflags & D_REPSLRTMT:
            report('Server long rtmt',  nslrtmts, int(slrtmtdelay/1000))
            delays.append(nslrtmts)
            delays.append(int(slrtmtdelay/1000))

        if dflags & D_SFINDLY:
            report('Server fin delay', 1, int(sfindly/1000))
            delays.append(nsrtmts)
            delays.append(int(sfindly/1000))

        if dflags & D_REPSDLY:
            report('Server later loss', nsrtmts, int(repsdelay/1000))
            delays.append(nsrtmts)
            delays.append(int(repsdelay/1000))

        if dflags & D_REPBDLY:
            report('Server early loss', nsertmts, int(repbdelay/1000))
            delays.append(nsertmts)
            delays.append(int(repbdelay/1000))