summaryrefslogtreecommitdiff
path: root/examples/py-flow-info/flow-info.py
Commit message (Collapse)AuthorAge
* nDPIsrvd.(h|py): Added socket read/recv timeout.lns2022-04-17
| | | | | | * nDPIsrvd.h: support for O_NONBLOCK nDPIsrvd_socket Signed-off-by: lns <matzeton@googlemail.com>
* Executing ./tests/run_tests.sh w/o zLib should not result in diff's anymore.Toni Uhlig2022-03-24
| | | | Signed-off-by: Toni Uhlig <matzeton@googlemail.com>
* Renamed basic event to error event for the sake of the logic.Toni Uhlig2022-03-13
| | | | Signed-off-by: Toni Uhlig <matzeton@googlemail.com>
* Disconnect nDPIsrvd clients immediately instead waiting for a failed write().Toni Uhlig2022-03-13
| | | | | | | | | * nDPIsrvd: Collector/Distributor logging improved * nDPIsrvd: Command line option for max remote descriptors * nDPId: Stop spamming nDPIsrvd Collector with the same events over and over again * nDPId: Refactored some variable names and events Signed-off-by: Toni Uhlig <matzeton@googlemail.com>
* Fixed some pyhton issues with static class members.Toni Uhlig2022-03-08
| | | | Signed-off-by: Toni Uhlig <matzeton@googlemail.com>
* Added daemon event: DAEMON_EVENT_STATUS (periodically send's daemon statistics.)Toni Uhlig2022-03-06
| | | | | | | | | | * Improved distributor timeout handling (per-thread). * flow-info.py / flow-dash.py: Distinguish between flow risk severities. * nDPId: Skip tag switch datalink packet dissection / processing. * nDPId: Fixed incorrect value for current active flows. * Improved JSON schema's. Signed-off-by: Toni Uhlig <matzeton@googlemail.com>
* Serialize flow risk score / confidence.Toni Uhlig2022-02-27
| | | | | | | * bump libnDPI to 8b062295cc76a60e3905c054ce37bd17669464d1 * removed ndpi_id_struct's Signed-off-by: Toni Uhlig <matzeton@googlemail.com>
* Improved py-flow-info to provide more optional information about received ↵Toni Uhlig2022-02-05
| | | | | | | | | | timestamps. * py-flow-dashboard: Added color mapping for PieCharts/Graph that make more sense * nDPId: Renamed `flow_type' to a more precisely `flow_state' * nDPId: Changed the default setting to process only as much packets as libnDPI does Signed-off-by: Toni Uhlig <matzeton@googlemail.com>
* Added additional (minimalistic) detection information to flow updates.Toni Uhlig2022-02-04
| | | | | | | | | | | | | This will only affect flows with the state `FT_FINISHED' (detection done). * nDPIsrvd.py: force use of JSON schema Draft 7 validator * flow-dash.py: gather/use total processed layer4 payload size * flow-info.py: added additional event filter * flow-info.py: prettified flow events printing whose detection is in progress * py-semantic-validation.py: added validation checks for FT_FINISHED * updated flow event JSON schema Signed-off-by: Toni Uhlig <matzeton@googlemail.com>
* Improved Plotly/Dash example. It is now somehow informative.Toni Uhlig2022-01-25
| | | | | | | * TCP timeout after FIN/RST: switched back to the value from a35fc1d5ea8570609cc0c8cf6edadc81f8f5bb76 * py-flow-info: reset 'guessed' flag after detection/detection-update received Signed-off-by: Toni Uhlig <matzeton@googlemail.com>
* Major nDPId extension. Sorry for the huge commit.Toni Uhlig2022-01-20
| | | | | | | | | | | | | | | | | | | | | | | | | | | | - nDPId: fixed invalid IP4/IP6 tuple compare - nDPIsrvd: fixed caching issue (finally) - added tiny c example (can be used to check flow manager sanity) - c-captured: use flow_last_seen timestamp from `struct nDPIsrvd_flow` - README.md update: added example JSON sequence - nDPId: added new flow event `update` necessary for correct timeout handling (and other future use-cases) - nDPIsrvd.h and nDPIsrvd.py: switched to an instance (consists of an alias/source tuple) based flow manager - every flow related event **must** now serialize `alias`, `source`, `flow_id`, `flow_last_seen` and `flow_idle_time` to make the timeout handling and verification process work correctly - nDPIsrvd.h: ability to profile any dynamic memory (de-)allocation - nDPIsrvd.py: removed PcapPacket class (unused) - py-flow-dashboard and py-flow-multiprocess: fixed race condition - py-flow-info: print statusbar with probably useful information - nDPId/nDPIsrvd.h: switched from packet-flow only timestamps (`pkt_*sec`) to a generic flow event timestamp `ts_msec` - nDPId-test: added additional checks - nDPId: increased ICMP flow timeout - nDPId: using event based i/o if capturing packets from a device - nDPIsrvd: fixed memory leak on shutdown if remote descriptors were still connected Signed-off-by: Toni Uhlig <matzeton@googlemail.com>
* py-flow-info: Support for --ipwhois, --new and --detection.Toni Uhlig2021-04-30
| | | | Signed-off-by: Toni Uhlig <matzeton@googlemail.com>
* Added IPv6 support for -I / -E.Toni Uhlig2021-04-11
| | | | | | | * added another Python search path and try-catch ModuleNotFoundError again * run_tests.sh checks for OpenBSD netcat (required for -q) Signed-off-by: Toni Uhlig <matzeton@googlemail.com>
* Added JSON schema validation to run_tests.shToni Uhlig2021-04-09
| | | | | | | * Python3 scripts are now compatible with versions <3.6 * improved and prettified run_tests.sh Signed-off-by: Toni Uhlig <matzeton@googlemail.com>
* nDPId-test: added JSON distribution + JSON parsing (Multithreaded design ↵Toni Uhlig2021-04-09
| | | | | | | | | | | | | | re-using most of nDPId/nDPIsrvd core) * improved Makefile.old install targets * splitted nDPIsrvd_parse into nDPIsrvd_parse_line and nDPIsrvd_parse_all for the sake of readability * minor Python script improvments (check for nDPIsrvd.py on multiple locations, may be superseeded by setuptools in the future) * some paths needs to be absolute (chdir() during daemonize) and therefor additional checks introduced * test run script checks and fails if certain files are are missing (PCAP file <=> result output file) * removed not very useful "internal format error" JSON serialization if a BUG for same exists * fixed invalid l4 type statistics counters for nDPIsrvd-collectd Signed-off-by: Toni Uhlig <matzeton@googlemail.com>
* Fixed possible NULL pointer deref in dependencies/nDPIsrvd.h and ↵Toni Uhlig2021-02-28
| | | | | | | | | | examples/c-captured/c-captured.c * `make install` C examples * examples/py-flow-info/flow-info.py supports filtering * added breed to examples/py-flow-info/flow-info.py Signed-off-by: Toni Uhlig <matzeton@googlemail.com>
* Extended nDPIsrvd.h with address parsing.Toni Uhlig2021-02-23
| | | | | | | | | * nDPId supports looading of custom nDPI protocol/category files * extended JSON schemas according to nDPI / nDPId JSON serializing * removed memory holes in nDPId * extended examples/c-captured Signed-off-by: Toni Uhlig <matzeton@googlemail.com>
* Aligned nDPIsrvd.py to nDPIsrvd.h for consistency.Toni Uhlig2021-02-16
| | | | | | | | | * Simplified Python interface as well. * c-captured and flow-undetected-to-pcap.py produce similiar results * Removed overloaded nDPIsrvd.py event structures. * flow-info.py prints (with a color-hash) additional information e.g. alias/source and midstream Signed-off-by: Toni Uhlig <matzeton@googlemail.com>
* All colors are beautiful for py-flow-info.Toni Uhlig2021-01-26
| | | | | | * instance alias is now mandatory (will be required for future use-cases) Signed-off-by: Toni Uhlig <matzeton@googlemail.com>
* Increased serialization buffer size as required for recent nDPI builds.Toni Uhlig2020-11-18
| | | | | | | * added .gitignore to prevent SCM check-ins of unwanted files * fixed invalid include path for python examples Signed-off-by: Toni Uhlig <matzeton@googlemail.com>
* cosmetics, exception verbosityToni Uhlig2020-10-17
| | | | Signed-off-by: Toni Uhlig <matzeton@googlemail.com>
* py-flow-info: Print BasicEvents.Toni Uhlig2020-10-12
| | | | Signed-off-by: Toni Uhlig <matzeton@googlemail.com>
* Improved python event validation with focus on readability.Toni Uhlig2020-09-30
| | | | Signed-off-by: Toni Uhlig <matzeton@googlemail.com>
* Centralized some python code parts to make future modifications easier.Toni Uhlig2020-09-29
| | | | Signed-off-by: Toni Uhlig <matzeton@googlemail.com>
* Improved event parsing for Python scripts.Toni Uhlig2020-09-26
| | | | Signed-off-by: Toni Uhlig <matzeton@googlemail.com>
* Added event validation functions and fixed Python scripts.Toni Uhlig2020-09-26
| | | | Signed-off-by: Toni Uhlig <matzeton@googlemail.com>
* Centralized EventName validation and moved code parts.Toni Uhlig2020-09-26
| | | | Signed-off-by: Toni Uhlig <matzeton@googlemail.com>
* Added new flow event: FLOW_EVENT_DETECTION_UPDATEToni Uhlig2020-09-25
| | | | | | | * This event will be triggered when nDPI detection has some new information for us (hopefully). * Detection change is based on hashing with 32-bit murmur3 certain members of the ndpi flow struct. Signed-off-by: Toni Uhlig <matzeton@googlemail.com>
* Process extra packets with nDPI, still not perfect but results in a more ↵Toni Uhlig2020-09-24
| | | | | | | | | accurate detection. * set default user used for setuid() * added 2 TODOs Signed-off-by: Toni Uhlig <matzeton@googlemail.com>
* merged code to reduce code duplicatesToni Uhlig2020-08-18
| | | | Signed-off-by: Toni Uhlig <matzeton@googlemail.com>
* flow-info.py, flow-undetected-to-pcap.py: throw socket error runtime ↵Toni Uhlig2020-08-13
| | | | | | exception if disconnect received Signed-off-by: Toni Uhlig <matzeton@googlemail.com>
* flow-info.py: fixed buffering issueToni Uhlig2020-08-08
| | | | Signed-off-by: Toni Uhlig <matzeton@googlemail.com>
* flow-info.py overhaul, terminal color support, ndpi ↵Toni Uhlig2020-08-07
| | | | | | protocol/category/flow-risk output Signed-off-by: Toni Uhlig <matzeton@googlemail.com>
* added python flow info script, improved IPv4/IPv6 string conversionToni Uhlig2020-08-06
Signed-off-by: Toni Uhlig <matzeton@googlemail.com>
Powered by cgit, Themed by Ted Yin.