+++ /dev/null
-#!/usr/bin/env python
-
-""" This runs netstat on a local or remote server. It calculates some simple
-statistical information on the number of external inet connections. It groups
-by IP address. This can be used to detect if one IP address is taking up an
-excessive number of connections. It can also send an email alert if a given IP
-address exceeds a threshold between runs of the script. This script can be used
-as a drop-in Munin plugin or it can be used stand-alone from cron. I used this
-on a busy web server that would sometimes get hit with denial of service
-attacks. This made it easy to see if a script was opening many multiple
-connections. A typical browser would open fewer than 10 connections at once. A
-script might open over 100 simultaneous connections.
-
-./topip.py [-s server_hostname] [-u username] [-p password] {-a from_addr,to_addr} {-n N} {-v} {--ipv6}
-
- -s : hostname of the remote server to login to.
- -u : username to user for login.
- -p : password to user for login.
- -n : print stddev for the the number of the top 'N' ipaddresses.
- -v : verbose - print stats and list of top ipaddresses.
- -a : send alert if stddev goes over 20.
- -l : to log message to /var/log/topip.log
- --ipv6 : this parses netstat output that includes ipv6 format.
- Note that this actually only works with ipv4 addresses, but for versions of
- netstat that print in ipv6 format.
- --stdev=N : Where N is an integer. This sets the trigger point for alerts and logs.
- Default is to trigger if max value is above 5 standard deviations.
-
-Example:
-
- This will print stats for the top IP addresses connected to the given host:
-
- ./topip.py -s www.example.com -u mylogin -p mypassword -n 10 -v
-
- This will send an alert email if the maxip goes over the stddev trigger value and
- the the current top ip is the same as the last top ip (/tmp/topip.last):
-
-
- This will print the connection stats for the localhost in Munin format:
-
- ./topip.py
-
-Noah Spurrier
-
-$Id: topip.py 489 2007-11-28 23:40:34Z noah $
-"""
-
-import pexpect, pxssh # See http://pexpect.sourceforge.net/
-import os, sys, time, re, getopt, pickle, getpass, smtplib
-import traceback
-from pprint import pprint
-
-TOPIP_LOG_FILE = '/var/log/topip.log'
-TOPIP_LAST_RUN_STATS = '/var/run/topip.last'
-
-def exit_with_usage():
-
- print globals()['__doc__']
- os._exit(1)
-
-def stats(r):
-
- """This returns a dict of the median, average, standard deviation, min and max of the given sequence.
-
- >>> from topip import stats
- >>> print stats([5,6,8,9])
- {'med': 8, 'max': 9, 'avg': 7.0, 'stddev': 1.5811388300841898, 'min': 5}
- >>> print stats([1000,1006,1008,1014])
- {'med': 1008, 'max': 1014, 'avg': 1007.0, 'stddev': 5.0, 'min': 1000}
- >>> print stats([1,3,4,5,18,16,4,3,3,5,13])
- {'med': 4, 'max': 18, 'avg': 6.8181818181818183, 'stddev': 5.6216817577237475, 'min': 1}
- >>> print stats([1,3,4,5,18,16,4,3,3,5,13,14,5,6,7,8,7,6,6,7,5,6,4,14,7])
- {'med': 6, 'max': 18, 'avg': 7.0800000000000001, 'stddev': 4.3259218670706474, 'min': 1}
- """
-
- total = sum(r)
- avg = float(total)/float(len(r))
- sdsq = sum([(i-avg)**2 for i in r])
- s = list(r)
- s.sort()
- return dict(zip(['med', 'avg', 'stddev', 'min', 'max'] , (s[len(s)//2], avg, (sdsq/len(r))**.5, min(r), max(r))))
-
-def send_alert (message, subject, addr_from, addr_to, smtp_server='localhost'):
-
- """This sends an email alert.
- """
-
- message = 'From: %s\r\nTo: %s\r\nSubject: %s\r\n\r\n' % (addr_from, addr_to, subject) + message
- server = smtplib.SMTP(smtp_server)
- server.sendmail(addr_from, addr_to, message)
- server.quit()
-
-def main():
-
- ######################################################################
- ## Parse the options, arguments, etc.
- ######################################################################
- try:
- optlist, args = getopt.getopt(sys.argv[1:], 'h?valqs:u:p:n:', ['help','h','?','ipv6','stddev='])
- except Exception, e:
- print str(e)
- exit_with_usage()
- options = dict(optlist)
-
- munin_flag = False
- if len(args) > 0:
- if args[0] == 'config':
- print 'graph_title Netstat Connections per IP'
- print 'graph_vlabel Socket connections per IP'
- print 'connections_max.label max'
- print 'connections_max.info Maximum number of connections per IP'
- print 'connections_avg.label avg'
- print 'connections_avg.info Average number of connections per IP'
- print 'connections_stddev.label stddev'
- print 'connections_stddev.info Standard deviation'
- return 0
- elif args[0] != '':
- print args, len(args)
- return 0
- exit_with_usage()
- if [elem for elem in options if elem in ['-h','--h','-?','--?','--help']]:
- print 'Help:'
- exit_with_usage()
- if '-s' in options:
- hostname = options['-s']
- else:
- # if host was not specified then assume localhost munin plugin.
- munin_flag = True
- hostname = 'localhost'
- # If localhost then don't ask for username/password.
- if hostname != 'localhost' and hostname != '127.0.0.1':
- if '-u' in options:
- username = options['-u']
- else:
- username = raw_input('username: ')
- if '-p' in options:
- password = options['-p']
- else:
- password = getpass.getpass('password: ')
- else:
- use_localhost = True
-
- if '-l' in options:
- log_flag = True
- else:
- log_flag = False
- if '-n' in options:
- average_n = int(options['-n'])
- else:
- average_n = None
- if '-v' in options:
- verbose = True
- else:
- verbose = False
- if '-a' in options:
- alert_flag = True
- (alert_addr_from, alert_addr_to) = tuple(options['-a'].split(','))
- else:
- alert_flag = False
- if '--ipv6' in options:
- ipv6_flag = True
- else:
- ipv6_flag = False
- if '--stddev' in options:
- stddev_trigger = float(options['--stddev'])
- else:
- stddev_trigger = 5
-
- if ipv6_flag:
- netstat_pattern = '(\S+)\s+(\S+)\s+(\S+)\s+(\S+)\s+::ffff:(\S+):(\S+)\s+.*?\r'
- else:
- netstat_pattern = '(\S+)\s+(\S+)\s+(\S+)\s+(\S+)\s+(?:::ffff:)*(\S+):(\S+)\s+.*?\r'
- #netstat_pattern = '(\S+)\s+(\S+)\s+(\S+)\s+(\S+)\s+(\S+):(\S+)\s+.*?\r'
-
- # run netstat (either locally or via SSH).
- if use_localhost:
- p = pexpect.spawn('netstat -n -t')
- PROMPT = pexpect.TIMEOUT
- else:
- p = pxssh.pxssh()
- p.login(hostname, username, password)
- p.sendline('netstat -n -t')
- PROMPT = p.PROMPT
-
- # loop through each matching netstat_pattern and put the ip address in the list.
- ip_list = {}
- try:
- while 1:
- i = p.expect([PROMPT, netstat_pattern])
- if i == 0:
- break
- k = p.match.groups()[4]
- if k in ip_list:
- ip_list[k] = ip_list[k] + 1
- else:
- ip_list[k] = 1
- except:
- pass
-
- # remove a few common, uninteresting addresses from the dictionary.
- ip_list = dict([ (key,value) for key,value in ip_list.items() if '192.168.' not in key])
- ip_list = dict([ (key,value) for key,value in ip_list.items() if '127.0.0.1' not in key])
-
- # sort dict by value (count)
- #ip_list = sorted(ip_list.iteritems(),lambda x,y:cmp(x[1], y[1]),reverse=True)
- ip_list = ip_list.items()
- if len(ip_list) < 1:
- if verbose: print 'Warning: no networks connections worth looking at.'
- return 0
- ip_list.sort(lambda x,y:cmp(y[1],x[1]))
-
- # generate some stats for the ip addresses found.
- if average_n <= 1:
- average_n = None
- s = stats(zip(*ip_list[0:average_n])[1]) # The * unary operator treats the list elements as arguments
- s['maxip'] = ip_list[0]
-
- # print munin-style or verbose results for the stats.
- if munin_flag:
- print 'connections_max.value', s['max']
- print 'connections_avg.value', s['avg']
- print 'connections_stddev.value', s['stddev']
- return 0
- if verbose:
- pprint (s)
- print
- pprint (ip_list[0:average_n])
-
- # load the stats from the last run.
- try:
- last_stats = pickle.load(file(TOPIP_LAST_RUN_STATS))
- except:
- last_stats = {'maxip':None}
-
- if s['maxip'][1] > (s['stddev'] * stddev_trigger) and s['maxip']==last_stats['maxip']:
- if verbose: print 'The maxip has been above trigger for two consecutive samples.'
- if alert_flag:
- if verbose: print 'SENDING ALERT EMAIL'
- send_alert(str(s), 'ALERT on %s' % hostname, alert_addr_from, alert_addr_to)
- if log_flag:
- if verbose: print 'LOGGING THIS EVENT'
- fout = file(TOPIP_LOG_FILE,'a')
- #dts = time.strftime('%Y:%m:%d:%H:%M:%S', time.localtime())
- dts = time.asctime()
- fout.write ('%s - %d connections from %s\n' % (dts,s['maxip'][1],str(s['maxip'][0])))
- fout.close()
-
- # save state to TOPIP_LAST_RUN_STATS
- try:
- pickle.dump(s, file(TOPIP_LAST_RUN_STATS,'w'))
- os.chmod (TOPIP_LAST_RUN_STATS, 0664)
- except:
- pass
- # p.logout()
-
-if __name__ == '__main__':
- try:
- main()
- sys.exit(0)
- except SystemExit, e:
- raise e
- except Exception, e:
- print str(e)
- traceback.print_exc()
- os._exit(1)
-
git.ucc.asn.au / progcomp10.git / blobdiff
UCC git Repository :: git.ucc.asn.au