np_grabrec.py

该软件根据网络数据生成NetFlow记录。NetFlow可用于网络规划、负载均衡、安全监控等

                        set = []
                        for rr in r:
                            files[rr[2]] = 1
                                    
            except EOFError:
                break

        print 'Files are:'
        for f in files.keys():
            print f

    def move_all(self, newrecfile):

        recfiles = {}
        #self.getfile('read')
        nfd = os.open(newrecfile, (os.O_CREAT | os.O_WRONLY))
        ngfnm = os.path.dirname(self.fnm) + '/' \
                + os.path.basename(self.fnm).replace('.grabs',
                                                     '.relocated.grabs')
        ngf = open(ngfnm, 'w')

        n = 0
        while 1:
            try:
                read = load(self.gfile)
                for rec in read:
                    if len(rec) == 3: # old type - no rooturl
                        seti = 2
                    elif len(rec) == 4: # new type with rooturl
                        seti = 3
                    else:
                        print 'Recs wrong len %d' % (len(recs))
                        sys.exit(1)
                    newsets = []
                    sets = rec[seti]
                    for r in sets:
                        newr = []
                        for rr in r:
                            rr = list(rr)
                            try:
                                file = recfiles[rr[2]] # file already open?
                            except KeyError:
                                try:
                                    file = np_file(rr[2], 0)
                                except IOError, s:
                                    print 'Can\'t open %s: %s' % (rr[2], s)
                                    sys.exit(1)
                                recfiles[rr[2]] = file
                            rr[2] = newrecfile
                            rr[3] = file.copy_rec(rr[3], nfd, n)
                            rr = tuple(rr)
                            newr.append(rr)
                            n += 1
                        newsets.append(newr)
                    rec[seti] = newsets
                    dump([rec], ngf, BINARY_DUMP)
                                    
            except EOFError:
                break
            
        file.write_pseudocounters(nfd, n)

    def draw_objects(self, what, obrefs, obdict):

        oblist = []
        tlist = []
        clist = []

        #
        # If redrawing reload relevant modules - this allows source to be
        # edited and re-run without exiting
        #

        if what.find('Redraw') == 0:
            #reload(np_obnode)
            reload(np_WebHost)
            reload(np_TCOConn)
            reload(np_HTTPTrans)
            what = what.split()[1]
            if what == 'Connections':
                reload(np_TCPDisplay)
            elif what == 'Trees':
                reload(np_Obtree)
                reload(np_TScreen)
        
        for m in obrefs:
            #print m
            ref = m[0]
            if type(ref) == types.TupleType:
                #print 'tuple'
                for o in ref:
                    #print o
                    oblist.append(o)
            else:
                #print 'ob', ref
                oblist.append(ref)
                
        for o in oblist:
            rec = obdict[o][0]
            ob = rec.reconstruct(trace=1)
            if ob.Class == 'WebClient' or ob.Class == 'WebServer' \
                   or ob.Class == 'WebHosts':
                ob.rooturl = obdict[o][1]
                tlist.append(ob)
            elif ob.Class == 'TCPConn':
                clist.append(ob)

##         if len(tlist) and len(clist):
##             print 'Selection includes TCP connections and HTTP Clients'

        if len(tlist) and what == 'Trees':
            np_TScreen.Tscreen(tlist, standalone='no', trace=1)

        if len(clist) and what == 'Connections':
            for c in clist:
                c.adjust_tm_offsets(c.abstart)
            np_TCPDisplay.TcpDisplay(clist, standalone='no', path='', trace=1)

    def reconstruct(self, quickmode):

        self.log = []
        obdict = {}
        tcp_imps = TCP_Imps()

        # collect objects for quick mode
        conns = []
        trees = []

        if quickmode:
            logfun = sys.stdout.write
        else:
            logfun = self.write_log

        logfun('')
        logfun('#######################################################\n')
        logfun('GrabRec - Multi-Log Composite:\n\n')
        logfun('#######################################################\n')

        for grab in self.grabs:

            obj = grab[0].reconstruct(logfun=logfun)
            obdict[obj.id] = (grab[0], grab[2])
            if obj.Class == 'WebHosts' or  obj.Class == 'WebServer' \
                   or  obj.Class == 'WebClient':
                obj.rooturl = grab[2]
                if quickmode:
                    obj.trace = 1
                    trees.append(obj)
                else:
                    obdict[intoa_string(obj.addr)] = (grab[0], grab[2])
                    obj.make_tree(logfun=logfun)
                    # logfun('WebClient #%s %s:' % (intoa_string(obj.addr),
                    #                                     grab[1]))
                    logfun('XMsg Interesting Clients: WebClient: %s: %s' \
                           % (intoa_string(obj.addr), grab[1]))
            elif obj.Class == 'TCPConn':
                if quickmode:
                    conns.append(obj)
                else:
                    obdict['%d' % (obj.id)] = (grab[0], grab[2])
                    #logfun('TCPConn #%d %s:' % (obj.id, grab[1]))
                    logfun('XMsg Interesting Connections: TCPConn: %s: %s'\
                                   % (obj.id, grab[1])) 
                    obj.adjust_tm_offsets(obj.abstart)
                    obj.model(tcp_imps, None)
            else:
                print 'Can\t handle object type \'%s\'' % (obj.Class)

        #for s in self.log:
            #print s

        if quickmode:
            if trees:
                np_TScreen.Tscreen(trees, standalone='yes', trace=1)
            if conns:
                np_TCPDisplay.TcpDisplay(conns, standalone='yes', path='',
                                         trace=1)

        else:

            # display options
            draw_menu = [
                    ['Connections', ['TCPConn'], 0],
                    ['Trees', ['WebClient'], 1],
                    ['Redraw Connections', ['TCPConn'], 1],
                    ['Redraw Trees', ['WebHosts', 'WebClient', 'WebServer'], 1]
                    ]

            if not self.root:
                self.root = Tk()
            Sellist(draw_menu, self.log, obdict, self.draw_objects,
                    root=self.root)

        
	    
##############################################################################

def usage(s):
    
    print "usage: " + s + '[-h(elp)] [-q(uick)] [-s(howfiles)] [grabfile]'

    sys.exit(1)
    
##############################################################################
        
def main(argv):
    
    import getopt
    
    scriptname = os.path.basename(argv[0])
    quickmode = 0
    show_files = 0
    moveto = ''
    
    try:
        optlist, args = getopt.getopt(sys.argv[1:], 'hqst:')
        
    except getopt.error, s:
        print '%s: %s' % (scriptname, s)
        usage(scriptname)
        sys.exit(1)

    for opt in optlist:
        if opt[0] == "-h":
            usage(scriptname)
        if opt[0] == '-q':
            quickmode = 1
        if opt[0] == '-s':
            show_files = 1
        if opt[0] == '-t':
            moveto = opt[1]

    if args:
        gfnm = args[0]
    else:
        gfnm = None

    if show_files:
        gr = GrabRec(mode='read', fnm=gfnm)
        gr.show_files()
        return

    if moveto:
        gr = GrabRec(mode='read', fnm=gfnm)
        gr.move_all(moveto)
        return
        
    
    #print 'main'
    gr = GrabRec(mode='read', fnm=gfnm)
    #print 'got grabrec'
    if gr.gfile:
        gr.load()
        # print 'loaded'
        
        # for r, c in gr.grabs:
        #print r
        
        gr.reconstruct(quickmode)


    
##############################################################################

    
# Call main when run as script
if __name__ == '__main__':

    main(sys.argv)