np_tcpconn.py

该软件根据网络数据生成NetFlow记录。NetFlow可用于网络规划、负载均衡、安全监控等

        if dflags:
            delays.append(dflags)
            self.delays = delays
            self.dly = dly = (self.open/1000000.0, nfpkts-nreqr, self.cdpkts,
                              self.sdpkts, delays)
        else:
            delays = self.delays = None
            self.dly = dly = (self.open/1000000.0, self.cdpkts-1,
                              self.cdpkts, self.sdpkts)

        return (gotreq, dflags)

#############################################################################

    def calc_pkt_loss(self, imps, adict):

        t = self.model(imps, adict)
        if not t:
            str = 'TCPConn #%d Couldn\'t model: ' % (self.id)
            #raw_input('...')
            self.logfun(str)
    

#############################################################################
		
    def get_delays(self, d_or_n):

        #
        # Return None if no delays on the connection else number or duration
        # of delays (depending on value of d_or_n) as:
        # [0: flags,
        #  1: not connected,
        #  2: not connected after dup client SYNs,
        #  3: connected after dup client SYNs,
        #  4: connected - no req,
        #  5:  duplicate first requests,
        #  6: retrans packets on any subsequent requests,
        #  7: no reply,
        #  8: server early retransmits,
        #  9: server later retransmits,
        # 10: server fin delays,
        # 11: server long retransmits
        # ]
        #


        dels = self.delays
        if not dels:
            return None
        flags = dels[-1]
        if not (flags & D_BIGDEL):
            return None

        #print '%d %x' % (self.id, dels[-1]), 
        #print dels
        dl = [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]
        di = d_or_n # 1 yields delay in ms, 0 yields number of occurences
        si = d_or_n -2
        dl[0] = flags
        try:
            if flags & D_DUPFREQ:
                dl[5] = dels[di]
                di += 2
            elif flags & D_REQNOTSEEN and not (flags & D_NOT_CONNECTED):
                dl[4] = dels[di]
                di += 2   
            if flags & D_CRETRANS:
                dl[6] = dels[di]
                di += 2
            if flags & D_DUPCSYN:
                if flags & D_NOT_CONNECTED:
                    dl[2] = dels[di]
                else:
                    dl[3] = dels[di]
                di += 2
            elif flags & D_NOT_CONNECTED:
                dl[1] = dels[di]
                di += 2
            if flags & D_REPNOTSEEN and not (flags & D_REQNOTSEEN):
                dl[7] = dels[di]
            if flags & D_REPBDLY:
                dl[8] = dels[si]
                si -= 2
            if flags & D_REPSDLY:
                dl[9] = dels[si]
                si -= 2
            if flags & D_SFINDLY:
                dl[10] = dels[si]
                si -= 2
            if flags & D_REPSLRTMT:
                dl[11] = dels[si]
        except IndexError:
            str = 'TCPConn #%d Get_delays error: flags%x di%d len%d' % (self.id, flags, di, len(dels))
            whoops(str)

            self.logfun(str)

        return dl
            
#############################################################################

    def get_ttms(self):

        def patch_tend():

            raw_input('...')

            tl = self.translist
            ti = 1
            tr = tl[ti]
            rqs = tr.reqstart

            for p in self.sdpkts:
                tm = p.tm
                if rqs < tm:
                    tr.repend = lastm
                    ti += 1
                    if ti == len(tl):
                        break
                    tr = tl[ti]
                    rqs = tr.reqstart
                lastm = tm
                    

        
	#
	# Get any info we have on usage of the connection
	#
        i = 0
        if self.http_status and self.tlist:
	    self.ttms = []
            for i in range(len(self.tlist)):
                self.ttms.append(Trans_Tms_t(self.tlist[i], i, self.open))
            self.uagent = self.tlist[0].get_uagent()
            self.sagent = self.tlist[0].get_server()
            if i > 0:
                str = 'TCPConn #%d Multiple transactions:' % (self.id)
                self.logfun(str)
            else:
                str = 'TCPConn #%d Single transaction:' % (self.id)
                self.logfun(str)
        elif self.http_status and self.translist:
	    self.ttms = []
            for i in range(len(self.translist)):
                self.ttms.append(Trans_Tms_T(self.translist[i], i))
            self.uagent = self.translist[0].uagent
            self.sagent = self.translist[0].server
            if i > 0:
                patch_tend()
                str = 'TCPConn #%d Multiple transactions:' % (self.id)
                self.logfun(str)
            else:
                str = 'TCPConn #%d Single transaction:' % (self.id)
                self.logfun(str)
	else:
	    self.ttms = [None]
	    str = 'TCPConn #%d NO TRANSACTIONS:' % (self.id)
	    if self.trace: 
		whoops(str)
	    self.logfun(str)
	    #self.valid = 0
	    self.uagent = None
	    self.sagent = None
            raise TCPModelNoTrans


#############################################################################
		
    def model(self, imps, adict):

        self.make_clusters()
        self.calc_delays(self.client, imps, adict)
        t = None
        try:
            self.get_ttms()
            try:
                t = TCP_Machine(self, imps, self.logfun,
                                trace=self.trace)
                try:
                    imps.set_start()
                    simp, cimp = t.do_pkts()
                    self.modelled = 1
                    #stats.add_TCPStats(t)
                    str = 'TCPConn #%d Modelled: ' % (self.id)
                    self.logfun(str)
                except TCPNoModel:
                    # can't model this one
                    cimp = simp = t = None
                    str = 'TCPConn #%d Can\'t model: ' % (self.id)
                    whoops(str)
                    self.logfun(str)
                
            except TCPModelPkts:
                cimp = simp = t = None
                print 'INSUFFICIENT PACKETS'
            except:
                #something really bad
                str = 'TCPConn #%d Total failure: ' % (self.id)
                #raw_input('...')
                whoops(str)
                self.logfun(str)
                cimp = simp = t = None
                raise
        except TCPModelNoTrans:
            cimp = simp = t = None
            print 'NO TRANS'
        

        if adict:
            adict.add(SERVER, self.server, self.sagent, cimp)
            adict.add(CLIENT, self.client, self.uagent, simp)

        if simp and simp.iw_fact == 0:
            str = 'TCPConn #%d Zero server IWF: ' % (self.id)
            self.logfun(str)

        if cimp and cimp.iw_fact == 0:
            str = 'TCPConn #%d Zero client IWF: ' % (self.id)
            self.logfun(str)

        self.cimp = cimp
        self.simp = simp
        self.model = t
        
        return t

#############################################################################
		
    def print_pktlist(self):


	for p in self.pktlist:

	    #way = ord(p.way)
	    way = p.dir
	    #flags = ord(p.flags)
	    flags = p.flags
	    if flags & TH_ACK:
		ackstr = 'ack%s' % (Longstring(p.ack, width=10))
	    else:
		ackstr = ''
	    if way == SERVER:
		dir = '<'
		col = F_WHITE
	    elif way == CLIENT:
		dir = '>'
		col = F_GREEN
            else:
                dir = 'X'
                col = F_RED

	    flagstr = ''
	    if flags & TH_SYN:
		flagstr = flagstr+'S'
	    if flags & TH_ACK:
		flagstr = flagstr+'A'
	    if flags & TH_FIN:
		flagstr = flagstr+'F'
	    if flags & TH_RST:
		flagstr = flagstr+'R'
	    if flags & TH_PUSH:
		flagstr = flagstr+'P'
	    if flags & TH_URG:
		flagstr = flagstr+'U'

	    tstr = rjust('%.3f' % (p.tm/1000.0), 9)

	    str = '%3d %s %s %s +%4d %s w:%5d %-5s' % (p.indx, tstr, dir, 
					  Longstring(p.seq, width=10),
					  p.len, ackstr,
					  p.window, flagstr)

	    #cprint(col, str)
	    print str
		    


#############################################################################

    def printself(self, fnm=None):

        #print self.FileRec.recsets
	tconn = self.FileRec.build_tconn(self.FileRec.recsets)[0]
        if fnm:
            tconn.printself_tofile(fnm, 0)
        else:
            tconn.printself(0)

#############################################################################

    def printself_with_pkts(self):

	tconn = self.FileRec.build_tconn(self.FileRec.recsets)[0]
	tconn.printself(0)
	self.print_pktlist()

#############################################################################

    def printself_with_trans(self, fnm=None):
	
	tconn, hlist, translist = self.FileRec.build_tconn(self.FileRec.recsets)

        if not fnm:
            tconn.printself(0)
            for t in translist:
                t.printself(tconn)
        else:
            tconn.printself_tofile(fnm, 0)
            i = 0
            for t in translist:
                t.printself_tofile(i, tconn, fnm, 'a')
                i += 1

#############################################################################
#############################################################################

#
# Represents a TCP pkt
#

class TCPHdr:

    #
    # hdrs is the tcp_hdrs object containing the buffer of dumped tcp_dumphdr
    # structs and the abs time to which time stamps are relative
    # indx is in to the hdr buffer
    #
    def __init__(self, hdrs, indx, atm, i):

        self.indx = i
        self.seq = ul2l(hdrs.get_seq(indx))
        self.ack = ul2l(hdrs.get_ack(indx))
        self.abtm = atm + hdrs.get_rtm(indx)
        fw = hdrs.get_flags_way(indx)
        self.flags = fw >> 8
        self.dir = fw & 0xff
        wl = hdrs.get_win_len(indx)
        self.window = ul2l(wl >> 16)
        self.len = wl & 0xffff
        #self.trig = 0
        #self.delay = 0
        

#############################################################################
#############################################################################