A Python script that parses nfdump captures and lists the top ten source ASNs along with the number of packets and bytes from each. Also uses RIPE's REST API to resolve each ASN to something meaningful.

busy_as.py

#!/usr/bin/env python
import requests
import pynfdump
from xml.dom import minidom

# The path to the directory where the nfcapd files are stored - this should be directory that contains
# 'live'
#
nfStore="/var/netflow"

# The list of routers that we want to process data from
#
routerList = ['router1','router2','router3']

d=pynfdump.Dumper(nfStore, sources=routerList)
d.set_where(start="2013-03-06 00:00")
records=d.search( "", statistics="srcas", statistics_order="bytes", limit=10 )

print "Srcas,ASname,packets,Gigabytes"

for r in records:
  theAS = r['srcas']
	theURL = "https://apps.db.ripe.net/whois/grs-search?source=ripe-grs&source=arin-grs&source=apnic-grs&query-string=AS"+ str(theAS) + "&flags=rC"

	xml = requests.get( theURL )

	dom = minidom.parseString( xml.text )
	for node in dom.getElementsByTagName('attribute'):
        	if node.hasAttribute('name'):
                	if node.getAttribute('name') == 'as-name':
                        	asName = node.getAttribute('value')
	gBytes = ((r['bytes']/1024)/1024)/1024

	print str( r['srcas'] ) + "," + asName + "," + str( r['packets'] ) + "," + str( gBytes )