gistfile1.txt
· 4.7 KiB · Text
Eredeti
def fw_events(file, filter_ip, filter_type, clients_dir, limit):
"""Format firewall drop events with dedup and counts"""
import glob
proto_map = {1: 'icmp', 6: 'tcp', 17: 'udp'}
ip_to_name = {}
for conf in glob.glob(f"{clients_dir}/*.conf"):
name = os.path.basename(conf).replace('.conf', '')
try:
with open(conf) as f:
for line in f:
if line.startswith('Address'):
ip = line.split('=')[1].strip().split('/')[0]
ip_to_name[ip] = name
except:
pass
events = []
last_seen = {}
try:
with open(file) as f:
for line in f:
try:
e = json.loads(line.strip())
src = e.get('src_ip', '')
if not src:
continue
if filter_ip and src != filter_ip:
continue
dst = e.get('dest_ip', '')
port = e.get('dest_port', '')
proto = e.get('ip.protocol', 0)
key = (src, dst, port, proto)
ts_str = e.get('timestamp', '')
try:
from datetime import datetime
ts = datetime.fromisoformat(ts_str).timestamp()
except:
ts = 0
windows = {1: 5, 6: 30, 17: 10}
window = windows.get(proto, 10)
if key in last_seen and (ts - last_seen[key]) < window:
continue
last_seen[key] = ts
events.append(e)
except:
pass
except:
pass
# Dedup consecutive same src+dst+port within 60s with count
deduped = []
counts = []
for e in events:
ts_str = e.get('timestamp', '')
try:
from datetime import datetime
ts = datetime.fromisoformat(ts_str).timestamp()
except:
ts = 0
src = e.get('src_ip', '')
dst = e.get('dest_ip', '')
port = e.get('dest_port', '')
proto = e.get('ip.protocol', 0)
key = (src, dst, port, proto)
if deduped and counts:
prev = deduped[-1]
try:
prev_ts = datetime.fromisoformat(prev.get('timestamp','')).timestamp()
except:
prev_ts = 0
prev_key = (prev.get('src_ip',''), prev.get('dest_ip',''),
prev.get('dest_port',''), prev.get('ip.protocol',0))
if key == prev_key and (ts - prev_ts) < 60:
counts[-1] += 1
continue
deduped.append(e)
counts.append(1)
grouped = []
group_counts = []
for e in deduped:
ts_str = e.get('timestamp', '')
try:
from datetime import datetime
dt = datetime.fromisoformat(ts_str)
# Truncate to minute for grouping
minute_key = dt.strftime('%Y-%m-%d %H:%M')
except:
minute_key = ts_str[:16]
src = e.get('src_ip', '')
dst = e.get('dest_ip', '')
port = e.get('dest_port', '')
proto = e.get('ip.protocol', 0)
key = (minute_key, src, dst, proto) # group within same minute
if grouped and group_counts:
prev = grouped[-1]
try:
prev_dt = datetime.fromisoformat(prev.get('timestamp',''))
prev_minute = prev_dt.strftime('%Y-%m-%d %H:%M')
except:
prev_minute = ''
prev_key = (prev_minute, prev.get('src_ip',''),
prev.get('dest_ip',''), prev.get('ip.protocol',0))
if key == prev_key:
group_counts[-1] += 1
continue
grouped.append(e)
group_counts.append(1)
for e, count in zip(deduped[-int(limit):], counts[-int(limit):]):
ts = e.get('timestamp', '')
try:
from datetime import datetime
dt = datetime.fromisoformat(ts)
ts = dt.strftime(DATETIME_FMT)
except:
pass
src = e.get('src_ip', '—')
dst = e.get('dest_ip', '—')
port = e.get('dest_port', '')
proto_num = e.get('ip.protocol', 0)
proto = proto_map.get(proto_num, str(proto_num))
dst_str = f"{dst}:{port}" if port else dst
client = ip_to_name.get(src, src)
if filter_type and not client.startswith(filter_type + '-'):
continue
count_str = f" (x{count})" if count > 1 else ""
print(f"{ts}|{client}|{dst_str}|{proto}{count_str}")
| 1 | def fw_events(file, filter_ip, filter_type, clients_dir, limit): |
| 2 | """Format firewall drop events with dedup and counts""" |
| 3 | import glob |
| 4 | proto_map = {1: 'icmp', 6: 'tcp', 17: 'udp'} |
| 5 | |
| 6 | ip_to_name = {} |
| 7 | for conf in glob.glob(f"{clients_dir}/*.conf"): |
| 8 | name = os.path.basename(conf).replace('.conf', '') |
| 9 | try: |
| 10 | with open(conf) as f: |
| 11 | for line in f: |
| 12 | if line.startswith('Address'): |
| 13 | ip = line.split('=')[1].strip().split('/')[0] |
| 14 | ip_to_name[ip] = name |
| 15 | except: |
| 16 | pass |
| 17 | |
| 18 | events = [] |
| 19 | last_seen = {} |
| 20 | |
| 21 | try: |
| 22 | with open(file) as f: |
| 23 | for line in f: |
| 24 | try: |
| 25 | e = json.loads(line.strip()) |
| 26 | src = e.get('src_ip', '') |
| 27 | if not src: |
| 28 | continue |
| 29 | if filter_ip and src != filter_ip: |
| 30 | continue |
| 31 | dst = e.get('dest_ip', '') |
| 32 | port = e.get('dest_port', '') |
| 33 | proto = e.get('ip.protocol', 0) |
| 34 | key = (src, dst, port, proto) |
| 35 | ts_str = e.get('timestamp', '') |
| 36 | try: |
| 37 | from datetime import datetime |
| 38 | ts = datetime.fromisoformat(ts_str).timestamp() |
| 39 | except: |
| 40 | ts = 0 |
| 41 | windows = {1: 5, 6: 30, 17: 10} |
| 42 | window = windows.get(proto, 10) |
| 43 | if key in last_seen and (ts - last_seen[key]) < window: |
| 44 | continue |
| 45 | last_seen[key] = ts |
| 46 | events.append(e) |
| 47 | except: |
| 48 | pass |
| 49 | except: |
| 50 | pass |
| 51 | |
| 52 | # Dedup consecutive same src+dst+port within 60s with count |
| 53 | deduped = [] |
| 54 | counts = [] |
| 55 | for e in events: |
| 56 | ts_str = e.get('timestamp', '') |
| 57 | try: |
| 58 | from datetime import datetime |
| 59 | ts = datetime.fromisoformat(ts_str).timestamp() |
| 60 | except: |
| 61 | ts = 0 |
| 62 | src = e.get('src_ip', '') |
| 63 | dst = e.get('dest_ip', '') |
| 64 | port = e.get('dest_port', '') |
| 65 | proto = e.get('ip.protocol', 0) |
| 66 | key = (src, dst, port, proto) |
| 67 | |
| 68 | if deduped and counts: |
| 69 | prev = deduped[-1] |
| 70 | try: |
| 71 | prev_ts = datetime.fromisoformat(prev.get('timestamp','')).timestamp() |
| 72 | except: |
| 73 | prev_ts = 0 |
| 74 | prev_key = (prev.get('src_ip',''), prev.get('dest_ip',''), |
| 75 | prev.get('dest_port',''), prev.get('ip.protocol',0)) |
| 76 | if key == prev_key and (ts - prev_ts) < 60: |
| 77 | counts[-1] += 1 |
| 78 | continue |
| 79 | |
| 80 | deduped.append(e) |
| 81 | counts.append(1) |
| 82 | |
| 83 | grouped = [] |
| 84 | group_counts = [] |
| 85 | for e in deduped: |
| 86 | ts_str = e.get('timestamp', '') |
| 87 | try: |
| 88 | from datetime import datetime |
| 89 | dt = datetime.fromisoformat(ts_str) |
| 90 | # Truncate to minute for grouping |
| 91 | minute_key = dt.strftime('%Y-%m-%d %H:%M') |
| 92 | except: |
| 93 | minute_key = ts_str[:16] |
| 94 | |
| 95 | src = e.get('src_ip', '') |
| 96 | dst = e.get('dest_ip', '') |
| 97 | port = e.get('dest_port', '') |
| 98 | proto = e.get('ip.protocol', 0) |
| 99 | key = (minute_key, src, dst, proto) # group within same minute |
| 100 | |
| 101 | if grouped and group_counts: |
| 102 | prev = grouped[-1] |
| 103 | try: |
| 104 | prev_dt = datetime.fromisoformat(prev.get('timestamp','')) |
| 105 | prev_minute = prev_dt.strftime('%Y-%m-%d %H:%M') |
| 106 | except: |
| 107 | prev_minute = '' |
| 108 | prev_key = (prev_minute, prev.get('src_ip',''), |
| 109 | prev.get('dest_ip',''), prev.get('ip.protocol',0)) |
| 110 | if key == prev_key: |
| 111 | group_counts[-1] += 1 |
| 112 | continue |
| 113 | |
| 114 | grouped.append(e) |
| 115 | group_counts.append(1) |
| 116 | |
| 117 | for e, count in zip(deduped[-int(limit):], counts[-int(limit):]): |
| 118 | ts = e.get('timestamp', '') |
| 119 | try: |
| 120 | from datetime import datetime |
| 121 | dt = datetime.fromisoformat(ts) |
| 122 | ts = dt.strftime(DATETIME_FMT) |
| 123 | except: |
| 124 | pass |
| 125 | src = e.get('src_ip', '—') |
| 126 | dst = e.get('dest_ip', '—') |
| 127 | port = e.get('dest_port', '') |
| 128 | proto_num = e.get('ip.protocol', 0) |
| 129 | proto = proto_map.get(proto_num, str(proto_num)) |
| 130 | dst_str = f"{dst}:{port}" if port else dst |
| 131 | client = ip_to_name.get(src, src) |
| 132 | if filter_type and not client.startswith(filter_type + '-'): |
| 133 | continue |
| 134 | count_str = f" (x{count})" if count > 1 else "" |
| 135 | print(f"{ts}|{client}|{dst_str}|{proto}{count_str}") |