· 10 years ago · Apr 10, 2016, 04:30 AM
1#!/usr/bin/env python3
2
3import configparser as cg
4import logging as log
5import sys
6from multiprocessing import Process, Pipe
7from subprocess import Popen, PIPE, STDOUT
8import pdb
9import MySQLdb as sql
10
11# Logging Config settings
12log.basicConfig(level=log.DEBUG,
13 format='[%(asctime)s] [%(levelname)-8s] [%(message)s]',
14 datefmt='%a %d %b %Y] [%H:%M:%S',
15 filename='tcpdump2.log',
16 filemode='a')
17
18# DEFINE CONFIG VARIABLES
19config = cg.RawConfigParser()
20config.read('config.cfg')
21config.sections()
22
23# Configure Database
24host = config.get('DataBase', 'db_host')
25user = config.get('DataBase', 'db_user')
26password = config.get('DataBase', 'db_password')
27db = config.get('DataBase', 'db')
28
29
30class ExternalProcess(Process):
31 def __init__(self, command, pipe):
32 super(ExternalProcess, self).__init__()
33 self.command = command
34 self.pipe = pipe
35
36 def run(self):
37 with Popen(self.command, stdout=PIPE, stderr=STDOUT, universal_newlines=True) as process:
38 for line in process.stdout:
39 self.pipe.send(line)
40
41
42def tcpdump():
43 ## conn = sql.connect('rouge_dhcp.db')
44 conn = sql.connect(host, user, password, db)
45 c = conn.cursor()
46 ## c.execute('''CREATE DATABASE IF NOT EXISTS ''',db)
47 c.execute(
48 '''CREATE TABLE IF NOT EXISTS BAD_MAC(
49 ID INTEGER PRIMARY KEY AUTO_INCREMENT NOT NULL,
50 source_mac CHAR(12) NOT NULL,
51 destination_mac CHAR(12) NOT NULL,
52 timestamp DATETIME NOT NULL
53 )''')
54 log.debug("DATABASE: Table Created successfully")
55 conn.commit()
56 ## conn.commit()
57 ## tcpdump_cmd = ['tcpdump','-e','-n','-i', 'eno16777736','src', 'port', '67', '-w', 'test.pcap'] # 'and', 'net', 'not', '127.0.0.1'
58 ##tcpdump_cmd = ['sudo', 'tcpdump', '-e', '-n', '-tttt', '-i', 'eno16777736', '-r', 'DHCP-tcpdump.pcap',
59 ## 'src port 67']
60 tcpdump_cmd = ['sudo', 'tcpdump', '-tttt', '-eni', 'ens192', 'src', '\"port', '67', 'and', 'net', 'not', 'xxx.xxx.xxx.xxx/16\"']
61 #tcpdump_cmd = ['sudo','tcpdump','-tttt','-en','-r','test.pcap']
62 print(tcpdump_cmd)
63 tcpdump_send_con, tcpdump_recv_con = Pipe()
64 log.warning("WARNING: ",tcpdump_send_con)
65 log.warning("WARNING: " ,tcpdump_recv_con)
66 print("1")
67 tcpdump_process = ExternalProcess(tcpdump_cmd, tcpdump_send_con)
68 log.debug(tcpdump_process)
69 print("2")
70 tcpdump_process.start()
71 print("3")
72 pdb.set_trace()
73 while True:
74 try:
75 print("true")
76 output = tcpdump_recv_con.recv()
77 print("4")
78 log.debug(output)
79 print("5")
80 print(output)
81 output_split = output.split(',')
82 log.debug(output_split)
83 print(output_split)
84 print("6")
85 if len(output_split) == 5:
86 [data, ether_type, ip_info, reply, length] = output_split
87 ##[data, ether_type] = tcpdump_recv_con.recv().split(',')
88 print("OUTPUT: ", data, ether_type,ip_info, reply, length)
89 log.debug("OUTPUT: ", data, ether_type, ip_info, reply, length)
90 [date, time, Source_Mac, to, Destination_Mac] = data.split(' ')
91 sourceMac = Source_Mac.replace(':', '')
92 log.debug(sourceMac)
93 destinationMac = Destination_Mac.replace(':', '')
94 log.debug(destinationMac)
95 print('TCPDUMP DHCP OFFENDERS: ', date, time, Source_Mac, Destination_Mac)
96 log.debug('TCPDUMP DHCP OFFENDERS: ', Source_Mac, Destination_Mac)
97 insert_q = "INSERT INTO BAD_MAC (source_mac,destination_mac,timestamp) VALUES('%s','%s',NOW())" % (
98 Source_Mac, Destination_Mac)
99 c.execute(insert_q)
100 log.debug('DataBase:%s\t%s', Source_Mac, Destination_Mac)
101 print("7")
102 conn.commit()
103 except KeyboardInterrupt:
104 tcpdump_process.terminate()
105 log.debug(tcpdump_process)
106 conn.close()
107 sys.exit(0)
108
109
110def tshark():
111 tshark_cmd = ['tshark', '-ni', 'eno16777736', '-Y', 'bootp.option.type == 53']
112 tshark_send_con, tshark_recv_con = Pipe()
113 tshark_process = ExternalProcess(tshark_cmd, tshark_send_con)
114 tshark_process.start()
115 while True:
116 try:
117 print('tshark output:', tshark_recv_con.recv())
118 except KeyboardInterrupt:
119 tshark_process.terminate()
120 sys.exit(0)
121
122if __name__ == '__main__':
123 tcpdump()