1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
|
#!/usr/bin/env python3
import os
import sys
sys.path.append(os.path.dirname(sys.argv[0]) + '/../../dependencies')
import nDPIsrvd
from nDPIsrvd import nDPIsrvdSocket, TermColor
global args
def prettifyEvent(color_list, whitespaces, text):
term_attrs = str()
for color in color_list:
term_attrs += str(color)
fmt = '{}{:>' + str(whitespaces) + '}{}'
return fmt.format(term_attrs, text, TermColor.END)
def checkEventFilter(json_dict):
if json_dict['flow_event_name'] == 'guessed':
if args.guessed is True:
return True
if json_dict['flow_event_name'] == 'not-detected':
if args.undetected is True:
return True
if 'ndpi' in json_dict and 'flow_risk' in json_dict['ndpi']:
if args.risky is True:
return True
if json_dict['midstream'] != 0:
if args.midstream is True:
return True
if args.guessed is False and args.undetected is False and \
args.risky is False and args.midstream is False:
return True
return False
def onJsonLineRecvd(json_dict, current_flow, global_user_data):
instance_and_source = ''
instance_and_source += '[{}]'.format(TermColor.setColorByString(json_dict['alias']))
instance_and_source += '[{}]'.format(TermColor.setColorByString(json_dict['source']))
if 'basic_event_id' in json_dict:
print('{} {}: {}'.format(instance_and_source, prettifyEvent([TermColor.WARNING, TermColor.BLINK], 16, 'BASIC-EVENT'), json_dict['basic_event_name']))
return True
elif 'flow_event_id' not in json_dict:
return True
if checkEventFilter(json_dict) is False:
return True
ndpi_proto_categ_breed = ''
ndpi_frisk = ''
if 'ndpi' in json_dict:
if 'proto' in json_dict['ndpi']:
ndpi_proto_categ_breed += '[' + str(json_dict['ndpi']['proto']) + ']'
if 'category' in json_dict['ndpi']:
ndpi_proto_categ_breed += '[' + str(json_dict['ndpi']['category']) + ']'
if 'breed' in json_dict['ndpi']:
ndpi_proto_categ_breed += '[' + str(json_dict['ndpi']['breed']) + ']'
if 'flow_risk' in json_dict['ndpi']:
cnt = 0
for key in json_dict['ndpi']['flow_risk']:
ndpi_frisk += str(json_dict['ndpi']['flow_risk'][key]) + ', '
cnt += 1
ndpi_frisk = '{}: {}'.format(
TermColor.WARNING + TermColor.BOLD + 'RISK' + TermColor.END if cnt < 2
else TermColor.FAIL + TermColor.BOLD + TermColor.BLINK + 'RISK' + TermColor.END,
ndpi_frisk[:-2])
line_suffix = ''
flow_event_name = ''
if json_dict['flow_event_name'] == 'guessed' or json_dict['flow_event_name'] == 'not-detected':
flow_event_name += '{}{:>16}{}'.format(TermColor.HINT, json_dict['flow_event_name'], TermColor.END)
else:
if json_dict['flow_event_name'] == 'new' and json_dict['midstream'] != 0:
line_suffix = '[{}]'.format(TermColor.WARNING + TermColor.BLINK + 'MIDSTREAM' + TermColor.END)
flow_event_name += '{:>16}'.format(json_dict['flow_event_name'])
if json_dict['l3_proto'] == 'ip4':
print('{} {}: [{:.>6}] [{}][{:.>5}] [{:.>15}]{} -> [{:.>15}]{} {}{}' \
''.format(instance_and_source, flow_event_name,
json_dict['flow_id'], json_dict['l3_proto'], json_dict['l4_proto'],
json_dict['src_ip'].lower(),
'[{:.>5}]'.format(json_dict['src_port']) if 'src_port' in json_dict else '',
json_dict['dst_ip'].lower(),
'[{:.>5}]'.format(json_dict['dst_port']) if 'dst_port' in json_dict else '',
ndpi_proto_categ_breed, line_suffix))
elif json_dict['l3_proto'] == 'ip6':
print('{} {}: [{:.>6}] [{}][{:.>5}] [{:.>39}]{} -> [{:.>39}]{} {}{}' \
''.format(instance_and_source, flow_event_name,
json_dict['flow_id'], json_dict['l3_proto'], json_dict['l4_proto'],
json_dict['src_ip'].lower(),
'[{:.>5}]'.format(json_dict['src_port']) if 'src_port' in json_dict else '',
json_dict['dst_ip'].lower(),
'[{:.>5}]'.format(json_dict['dst_port']) if 'dst_port' in json_dict else '',
ndpi_proto_categ_breed, line_suffix))
else:
raise RuntimeError('unsupported l3 protocol: {}'.format(json_dict['l3_proto']))
if len(ndpi_frisk) > 0:
print('{} {:>18}{}'.format(instance_and_source, '', ndpi_frisk))
return True
if __name__ == '__main__':
argparser = nDPIsrvd.defaultArgumentParser()
argparser.add_argument('--guessed', action='store_true', default=False, help='Print only guessed flow events.')
argparser.add_argument('--undetected', action='store_true', default=False, help='Print only undetected flow events.')
argparser.add_argument('--risky', action='store_true', default=False, help='Print only risky flow events.')
argparser.add_argument('--midstream', action='store_true', default=False, help='Print only midstream flow events.')
args = argparser.parse_args()
address = nDPIsrvd.validateAddress(args)
sys.stderr.write('Recv buffer size: {}\n'.format(nDPIsrvd.NETWORK_BUFFER_MAX_SIZE))
sys.stderr.write('Connecting to {} ..\n'.format(address[0]+':'+str(address[1]) if type(address) is tuple else address))
nsock = nDPIsrvdSocket()
nsock.connect(address)
nsock.loop(onJsonLineRecvd, None)
|