-
-
Save nextime/f0372203a29df83ccbf52ed87e550c0e to your computer and use it in GitHub Desktop.
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
#!/usr/bin/python3 | |
from setproctitle import setproctitle | |
from shell_cmd import sh | |
from nfstream import NFStreamer | |
import time | |
setproctitle("dpi") | |
online_streamer = NFStreamer(source="br0", promiscuous_mode=False, splt_analysis=20, statistical_analysis=False) | |
Names = { | |
'DNS': 'dns', | |
'Web': 'web', | |
} | |
Categories = { | |
'SocialNetwork': 'socialnet', | |
'DNS': 'dns' | |
} | |
Already=[] | |
class NexDPI(): | |
def __init__(self): | |
print(time.asctime(), "NexDPI created") | |
def main(self): | |
print(time.asctime(), "NexDPI started") | |
for flow in online_streamer: | |
#print(time.asctime()+" "+flow.application_name) # print it.from nfstream import NFStreamer | |
#print(time.asctime()+" "+flow.application_category_name) | |
fullname=flow.application_name+"_"+flow.application_category_name | |
if not fullname in Already: | |
print(time.asctime(), "NEWRECORD:", fullname) | |
Already.append(fullname) | |
if flow.application_category_name=='SocialNetwork' and not flow.application_name.startswith('DNS.'): | |
triplet=str(flow.dst_ip)+","+str(flow.dst_port)+","+str(flow.src_ip) | |
print(time.asctime(), sh("ipset test social_triplet "+triplet+" || ipset add social_triplet "+triplet+" timeout 3600")) | |
#print(flow.application_is_guessed) | |
#print(flow.src_ip) | |
#print(flow.src_port) | |
#print(flow.dst_ip) | |
#print(flow.dst_port) | |
#print(flow.requested_server_name) | |
print("############################################") | |
time.sleep(0.1) | |
if __name__ == "__main__": | |
import sys | |
ndpi=NexDPI() | |
ndpi.main() | |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment