Edit: /opt/dedrads/__pycache__/show-conns-adv.cpython-313.pyc (68414B)
}j V S SK r S SKrS SKrS SKrS SKrS SKrS SKrS SKJr S SK J r S SK
J r J r S SK
Jr S SKJr \R" " S5 r1 SkrS 1rS
rS rS rS
rSrSS1rSrSr Sr Sr 1 Skr Sr Sr!S r"S r# " S S5 r$ " S S 5 r%\&S :X a \%" 5 RO 5 gg) N defaultdict)datetime)
ip_address
ip_network) PrettyTable)colorss> *::::1[::] 127.0.0.1r
d SYN-RECVSYNRECV , > @ " g ?))sshdssh)eximsmtp)dovecotimap)pop3r$ )httpdhttp)apache2r& )nginxr& ) litespeedr& )
openlitespeedr& )cpsrvdcpanel)cwpsrv cwp_admin)z pure-ftpdftp)proftpdr/ )mysqldmysql)mariadbdr2 )nameddns) pdns_serverr5 c [ R R S5 ( a g[ R R S5 =( d [ R R S5 $ )Nz/usr/local/cpanel/cpanelFz/usr/local/cwpsrvz /opt/cwprads)ospathisfileisdir /opt/dedrads/show-conns-adv.py
is_cwp_serverr? 7 s? ww~~011
77==, - N ~1NNr= c D 1 Skn [ 5 ( a U SS1- $ U SS1- $ )N> r/ r r# r$ r! r2 webmailcwp_userr. r, whm)r? )servicess r> auth_attack_servicesrE = s. IH:{333 x' ''r= c \ \ rS rSrSrS rS\S\S\4S jrS\S\S\ 4S jr
S\S\ 4S jr S
r
g ) ServiceRegistryD zMaps services to ports.c z [ 5 ( a Su pOSu pXl X l SSS/SSS/S S
S /S / S
QSSS/SSS/USS/USS/SSS/SS /0
S /S /S .S .U l 0 0 S .U l U R R 5 H9 u p4UR 5 H u pVU H nUU R U U' M M" M; g )!N)rB r. )r, rC r& P i r# i r$ n i r! ) i iK r/ r i i" i# i& i' rA i/ i0 r2 i 5 { )r5 ntptcpudp)r?
panel_user panel_adminrD port_to_service_name_mapitems)selfrW rX protocolservice_to_ports_map service_name port_list port_numbers r> __init__ServiceRegistry.__init__G s ??&= #J &5 #J$& S c
c
BxDzT4LdD\D$<$ 4.
132(>%.2mm.A.A.C *H+?+E+E+G' #,K % 11(;# $- ,H /Dr= r` r\ returnc Z U R R U0 5 R US5 $ )NotherrY getr[ r` r\ s r> get_service_name ServiceRegistry.get_service_namef s- ,,002>BB
r= c > XR R U0 5 ; $ Nrf rh s r> is_tracked_port ServiceRegistry.is_tracked_portl s ; ; ? ?" MMMr= c h [ U R R U0 5 R 5 5 $ rl )setrY rg keys)r[ r\ s r>
get_all_ports ServiceRegistry.get_all_portsp s) 40044XrBGGIJJr= )rX rW rY rD N)__name__
__module__ __qualname____firstlineno____doc__ra intstrri boolrm rp rr __static_attributes__r< r= r> rG rG D sX ! %>
C
3
3
N3 N# N$ NKc Kc Kr= rG c \ rS rSrSrS r\S 5 rS rS r S r
S r S r S
r
S rS rS
rS rS rS rS rS rS rS rS rS r\S 5 r\S 5 rSAS jr S r S r S r \S 5 r \S 5 r!\S 5 r"S! r#SBS" jr$SCS# jr%S$ r&S% r'SDS& jr(S' r)S( r*S) r+S* r,S+ r-S, r.S- r/S. r0SES/ jr1\24S0 jr3\S1 5 r4S2 r5S3 r6 SFS4 jr7\S5 5 r8SGS6 jr9SGS7 jr:SGS8 jr; SHS9 jr
S< r?\S= 5 r@S> rAS? rBS@rCg)IConnectionReportert z Manages connection reporting.c [ 5 U l U R 5 U l [ 5 [ 5 S.U l [ 5 U l [ 5 U l SU l [ S 5 U l
[ S 5 U l [ S 5 U l [ S 5 U l
0 U l / U l [ 5 [ 5 S.U l 0 U l U R% 5 U l U R) 5 U R+ 5 g )NrT Fc [ [ 5 $ rl r ry r< r= r> -ConnectionReporter.__init__..~ ;s;Kr= c [ [ 5 $ rl r r< r= r> r r r r= c [ [ 5 $ rl r r< r= r> r r k#6Fr= c [ [ 5 $ rl r r< r= r> r r r r= )rG service_registry parse_command_line_argumentscommand_line_argsrp selected_ports_by_protocolrequested_tcp_portsrequested_udp_portsuse_explicit_port_filterr tcp_connections_by_portudp_connections_by_porttcp_states_by_portudp_states_by_portprocessed_connection_data#collected_client_ips_for_subnettingdiscovered_service_portsport_service_overrides_detect_server_ips
server_ips#_validate_command_line_combinations process_port_selection_from_argsr[ s r> ra ConnectionReporter.__init__w s / 1 !%!B!B!D 25%*F'#&5 #&5 (-%'23K'L$'23K'L$"-.F"G "-.F"G )+&35003ce(D%&(# 113 002 --/r= c SS1n [ R " S5 nU( a [ R " USS/[ R [ R SSS9nUR
S :X a UR R 5 Hj n[ R " S
U5 nU( d M# UR S 5 R S 5 S n U R [ [ U5 5 5 Ml U $ [ R " S
5 nU( a [ R " US/[ R [ R SSS9nUR
S :X aE UR R 5 H' n U R [ [ U5 5 5 M) U $ U $ ! [ a GM+ f = f! [ a U $ f = f! [ a M_ f = f! [ a U $ f = f)z@Collect addresses assigned to this host (loopback + interfaces).r r
ipz-oaddrTFstdoutstderrtextcheckr z\s(inet6?)\s([^\s/]+)r %hostnamez-I)shutilwhich
subprocessrunPIPE
returncoder
splitlinesresearchgroupsplitaddrz r
ValueErrorOSError)r ip_pathresultlinematchaddress
hostname_paths r> r %ConnectionReporter._detect_server_ips s "5)
,,t$
# dF+%??%?? $$) &
8 8 : " *BD I $ $"'++a."6"6s";A">% &NN3z'/B+C D
!;< % #LL 4M '^^&- ) ) ! # F ((A-'-}}':':' _is_web_port ConnectionReporter._is_web_port s. u / )%%k<FFr= c [ U5 nUR ( d3 UR ( d" UR ( d UR
( a gXR ; $ ! [ a gf = f)NFT)r r is_loopback
is_private
is_link_localis_unspecifiedr r[ ip_string ip_objects r> _is_internal_client&ConnectionReporter._is_internal_client s[ "9-I
! !##&&''OO++ s A
A-,A-c [ U5 nUR ( a gXR ; a gUR ( d UR
( a gg! [ a gf = f)Ninternalloopbackr[ private)r r r r r r r s r> _internal_client_reason*ConnectionReporter._internal_client_reason sW "9-I ' 9#:#: s A
A A c U R X#5 ( a- U R U5 ( a U SU R U5 S3$ U$ )N ())r r r )r[ r r` r\ s r> _format_client_ip$ConnectionReporter._format_client_ip sI k 4 4((33 [4#?#? #J"K1M Mr= c U R X#5 ( d U$ UR 5 VVs0 s H u pEU R U5 ( a M XE_M! snn$ s snnf rl )r rZ r )r[ ip_countsr` r\ r counts r> _external_ip_counts&ConnectionReporter._external_ip_counts s] 77 %.OO$5
$5 ++I6
I $5
s A Ac : SnSnU R R 5 Hw u p4UR S5 u pV[ U5 nU R Xu5 ( d M; US R 5 H% u pU R U5 ( a X-
nM! X)-
nM' My X4$ )Nr :ips)r rZ r ry r r )
r[ internal_totalexternal_totaldata_keyconnection_datar\ port_stringr` r r s
r> _web_internal_traffic_totals/ConnectionReporter._web_internal_traffic_totals s )-)G)G)M)M)O %H$,NN3$7 !H k*K$$[;;$3E$:$@$@$B ++I66"+N"+N %C *P --r= c 0 U R 5 u pX- nUS:X d US:X a g X- nU[ : a g [ U R 5 " SR S5 5 5 [ U R 5 " SUS SUS SUS S 35 5 [ 5 g )
Nr zWEB STACK NOTEr ,z of z HTTP connections (.0fu %) are from loopback, private, or this server's own IPs — typical Apache/Nginx/cPanel proxy/health-check traffic, not external clients.)r INTERNAL_WEB_DOMINANCE_THRESHOLDprint _warn_colorcenter)r[ r r web_totalinternal_shares r> _print_web_internal_note+ConnectionReporter._print_web_internal_note s )-)J)J)L&"3 >^q 0 '3 < <
d !1!8!8!=>?
^A&d9Q- 8"3' (DD
r= c U R R ( aI U R R ( a. [ S[ R
S9 [ R " S5 U R R bJ U R R S: a/ [ S[ R
S9 [ R " S5 g g g )Nz+Error: --subnet cannot be used with --watchfile z)Error: watch interval must be >= 1 second)r watchsubnetr sysr exitr s r> r 6ConnectionReporter._validate_command_line_combinations s ! ! ' 'D,B,B,I,I =ZZ
HHQK ! ! ' ' 3%%++a/A
S 0 4r= c [ S 5 U l [ S 5 U l [ S 5 U l [ S 5 U l 0 U l / U l [ 5 [ 5 S.U l 0 U l g )Nc [ [ 5 $ rl r r< r= r> r . r r= c [ [ 5 $ rl r r< r= r> r r r r= c [ [ 5 $ rl r r< r= r> r r r r= c [ [ 5 $ rl r r< r= r> r r r r= rT )
r r r r r r r rp r r r s r> _reset_collection_state*ConnectionReporter._reset_collection_state sc '23K'L$'23K'L$"-.F"G "-.F"G )+&35003ce(D%&(#r= c [ R " SS9nU R R S H) nUR SU 3SSUR 5 S3S9 M+ UR S SS
S9 UR S SS S9 UR S
SSS9 UR SSSSS9 UR SSSSS9 UR SSSS9 UR SSS [ [ S S [ S 3S 9 UR S!SS"S9 UR 5 $ )#Nz"Summarize TCP/UDP connection info.) descriptionrU z--
store_truez
Show only connections)actionhelpz--tcpzShow all TCP connectionsz--udpzShow all UDP connectionsz--topu2 Only show services ≥2000 connections or IPs >200z-sz--subnetz(Group connections by /24 and /16 subnetsz-pz--port+z(Specify up to 10 ports (space-separated))nargsr portsr z$Deprecated: use -p or --port insteadz-wz--watch?SECSz%Refresh every SECS seconds (default: z); Ctrl+C to exit)r consttypemetavarr z --all-portsz8Include every local TCP/UDP port with active connections) argparseArgumentParserr rD add_argumentupperDEFAULT_WATCH_INTERVALry
parse_args)r[ parserr^ s r> r /ConnectionReporter.parse_command_line_arguments% s ((<
! 1 1 : :5 AL \N##!,"4"4"6!7|D
B L/I
L/I
E
;
;
3%K
(78N7O P! !
K
""r= c SnU R R ( aW U R R S5 nU R S R U5 U R R U5 SnOU R R S Hx n[ U R US5 ( d M! U R R S U nU R S R U5 U R R U5 SnMz U R R ( aV U R R S5 nU R S R U5 U R R U5 Sn[ U R R =( d / 5 nUR U R R 5 U( Ga3 [ U5 S: a. [! S[" R$ S9 [" R& " S5 U H nUR) 5 ( d M [+ U5 nU R S R- U5 U R R- U5 U R R ( d< U R R. ( d! U R R1 US5 ( a9 U R S R- U5 U R R- U5 SnM U( dT U R R S5 nU R S R U5 U R R U5 U R R. ( a U R R S5 nU R S R U5 U R R U5 U R R ( ai U R3 5 ( dT U R R S5 nU R S R U5 U R R U5 Xl g ) NFrU TrV r zError: max 10 portsr r )r rU r rr r updater rD getattrrV r listportextendr lenr r r r isdigitry r toprm _has_explicit_tcp_selectionr ) r[ any_port_was_selected tcp_portsr^ r udp_portsexplicit_portsr r` s r> r 3ConnectionReporter.process_port_selection_from_args] s_ % ! ! % % --;;EBI + +E 2 9 9) D $ $ + +I 6$( ! $ 5 5 > >u E 411<GG 1 1 : :5 A, OE33E:AA%H,,33E:,0) !F ! ! % % --;;EBI + +E 2 9 9) D $ $ + +I 6$( ! d 4 4 9 9 ?R@ d 4 4 : :; >"R'+#**= - &&(("%k"2K33E:>>{K,,00= ..22 1155 00@@ ' 77>BB ' 0044[A,0)! .$ % --;;EBI + +E 2 9 9) D $ $ + +I 6 ! ! % % --;;EBI + +E 2 9 9) D $ $ + +I 6&&** 88:: 1 1 ? ? F //6==iH((// :(=%r= c & U R R ( a gU R R S H! n[ U R US5 ( d M! g U R R
( d U R R ( a gg)NTrU F)r rU r rD r r r )r[ r^ s r> r# .ConnectionReporter._has_explicit_tcp_selection sm ! ! % % 1 1 : :5 ALt--|UCC B ! ! & &$*@*@*F*Fr= c , [ U R 5 $ rl )r{ r r s r>
_wants_tcp ConnectionReporter._wants_tcp D,,--r= c , [ U R 5 $ rl )r{ r r s r>
_wants_udp ConnectionReporter._wants_udp r. r= c [ 5 nU R R S H2 n[ U R US5 ( d M! UR U5 M4 U R R ( a( UR U R R S 5 U R R ( a( UR U R R S 5 U$ )NrU FrV ) rp r rD r r r rU r rV )r[ selectedr^ s r> "_explicitly_selected_service_names5ConnectionReporter._explicitly_selected_service_names s 5 1 1 : :5 ALt--|UCC \* B ! ! % % OOD 1 1 : :5 A B ! ! % % OOD 1 1 : :5 A Br= c . U R R ( a g U R 5 nU( d g U R R 5 HC u p#U H8 nU R XB5 U; d M U R U R U5 M: ME g rl )r all_portsr4 r rZ r r r )r[ selected_servicesr\ r r` s r> -_merge_discovered_ports_for_selected_services@ConnectionReporter._merge_discovered_ports_for_selected_services s| ! ! + + C C E # < < B B DOH $ ))+@DUU33H=AA+N % Er= c U R R X!45 nU( a U$ U R R X5 $ rl )r rg r ri )r[ r` r\ overrides r> r $ConnectionReporter._get_service_name s: ..22H3JK O$$55kLLr= c U R R ( a gU R ( ar XR R U[ 5 5 ; a gXR R U[ 5 5 ; a" U R X5 U R 5 ; $ gU R R X5 ( a gXR R U[ 5 5 ; a gg)NTF) r r7 r r rg rp r r r4 r rm rh s r> _is_connection_allowed)ConnectionReporter._is_connection_allowed s ! ! + + ( ( = = A A(CE RR ; ; ? ?#% PP**;A>>@A 0 0 G G 77;;HceL Lr= c T U R 5 n[ H u p#X!; d M Us $ g rl )lowerPROCESS_SERVICE_HINTS)
process_field
process_lowerneedler^ s r> _service_from_process(ConnectionReporter._service_from_process s. %++-
$9 F&## %: r= c / n [ 5 nS H n[ R R US5 nU( d M, UR 5 nU( d ME [
R
US 5 nSnUS:X a [ U5 S: a US nOUS:X a [ U5 S: a US nXV4nXq; a M UR U5 U R UUS .5 M U $ )
N)
SSH_CLIENTSSH_CONNECTION r rJ r rK )r server_port)
rp r8 environrg r r~
_normalize_ipr r append)sessionsseenvariablevalueparts client_iprO session_keys r> _admin_ssh_sessions&ConnectionReporter._admin_ssh_sessions s u8HJJNN8R0EKKME*88qBI K<'CJ!O #Ah --#e*/ #Ah $2K" HH[ ! OO *
# 9* r= Nc n U R U R U5 U( a X0R X!4' g g rl )r r r )r[ r` r\ r^ s r> _register_discovered_port,ConnectionReporter._register_discovered_port s4 %%h/33K@ CO ' '(? @ r= c U R 5 H> nUS R 5 ( d M [ US 5 nU R USS5 M@ g )NrO rU r )rZ r! ry r] )r[ sessionr` s r> _apply_admin_session_ports-ConnectionReporter._apply_admin_session_ports sM //1G=)1133 gm 45K * *;u E 2r= c [ R " SUR 5 5 nUS S; a g [ R " SSUS 5 nUR SS5 u pV[ U5 nS nU R R Xr5 ( a# U R R Xr5 n U S :w a U nU( d, Sn
S
U; a XR S
5 S n
U R U
5 nU R XrU5 g ! [ [ 4 a g f = f) N\s+r > LISTENUNCONN^::ffff:rL rM r r re zusers:()r r stripsubrsplitry r
IndexErrorr rm ri indexrG r] ) r[ r r\
line_parts
local_address_r r` r^ trackedrD s r> _parse_listen_line%ConnectionReporter._parse_listen_line s XXfdjjl3
a= 4 4 FF;JqM BM * 1 1#q 9NA k*K 0 0 G G++<<G '! & MD $ZZ %:%; <
55mDL &&{lK J' s :C6 6D D c
~ [ 5 [ 5 S.U l 0 U l U R 5 S Hr u p [ R
" [ U/[ R [ R SSS9nUR R 5 H nU R XR5 M Mt U R 5 g ! [ R am UR SS5 n [ R
" [ U/[ R [ R SSS9n N! [ R a GM f = ff = f)NrT ))z-tlnprU )z-ulnprV Tr prL )rp r r ra r r ss_pathr CalledProcessErrorreplacer r rq r9 )r[ flagsr\ subprocess_outputfallback_flagsr s r> collect_listening_ports*ConnectionReporter.collect_listening_ports$ s 03ce(D%&(# '') COE
$.NN e$%??%?? %!& *00;;=''7 >+ D.
::< 00
!& sB!7 (2 .1 ) ) ! " )% "44
s) :B;;&D<":D D82D<7D88D<c h U R S5 ( a U R S5 ( a U SS $ U $ )N[]r )
startswithendswith)r s r> rQ ConnectionReporter._normalize_ipA s5 $ $););C)@)@ Qr? "r= c [ U 5 nUR ( d" UR ( d UR ( a g[ [ U SU 3SS95 $ ! [ a gf = f)Nlocal/Fstrictr
)r r r r rz r r )r prefixr s r>
_subnet_label ConnectionReporter._subnet_labelG s^
"9-I%% '' ++ zYKq"9%HI I s >A A
A&%A&c @ [ [ S[ R 5 $ )Nyellow)r r magentar< r= r> r ConnectionReporter._warn_colorU s uh
66r= c [ [ 5 nU R R 5 H] u p#UR S5 u pE[ U5 nU R US Xd5 nUR 5 H u pX== U -
ss' M M_ U$ )Nr r )r ry r rZ r r )
r[ r r r r\ r r` filtered_ipsr r s
r> _aggregate_ip_counts'ConnectionReporter._aggregate_ip_countsY s $ )-)G)G)M)M)O %H$,NN3$7 !H k*K 33 & L %1$6$6$8 $-$ %9
*P r= c [ [ 5 nUR 5 H* u pEU R XB5 nUS; d M X6== U-
ss' M, U$ )N> r
r )r ry rZ r )r[ r r
subnet_countsr r r s r> _subnet_counts!ConnectionReporter._subnet_countse sN #C(
) 1 I'' :F^+ %.% !2 r= c X [ U R X5 R 5 S S9S U $ )Nc U S * $ Nr r< items r> r 1ConnectionReporter._top_subnets..p s
d1gXr= key)sortedr rZ )r[ r r limits r> _top_subnets ConnectionReporter._top_subnetsm s5 2 8 8 :%
5 r= c " / nU R R 5 GH u p#UR S5 u pE[ U5 nU R Xd5 nU R US Xd5 nU( d MS [
UR 5 5 n [ U5 n
[ UR 5 S S9u pUR 5 SU SU S3n
U ( a X- S- OSnU [ : a! UR S U
S
U S U S US
S3S.5 U [ : a UR S U
SU SU
S3S.5 U[ 5 ; a? U
( a X- OSnU
[ : a( U[ :: a UR SU
SU
SUS S3S.5 [ U R# US5 R 5 S SS9u nnU[$ : a# US ; a UR SU
S U S U S 3S.5 U
S: d GM US : d GM U S!: d GM UR SU
S"U
S#US
S$3S.5 GM U$ )%Nr r c U S $ r r< r s r> r 5ConnectionReporter._analyze_threats.. s Qr= r r r r r highz
: hot source z has z connections (r z% of service traffic))severitymessageu : volume flood — z connections from unique IPsmediumu : possible auth brute-force — z unique IPs averaging .1fz conns/IP c U S $ r r< r s r> r r s ar= )rL r )r default> rL r
r z: /24 cluster z accounts for r rN i u : distributed pattern — z& sources, no single IP dominates (top z%))r rZ r ry r r sumvaluesr maxr HOT_IP_THRESHOLDrR HOT_SERVICE_THRESHOLDrE BRUTE_FORCE_MIN_UNIQUE_IPSBRUTE_FORCE_MAX_AVG_PER_IPr SUBNET_FLOOD_THRESHOLD)r[ alertsr r r\ r r` r^ r total
unique_ipstop_ip top_countlabel top_share
avg_per_ip
top_subnet subnet_counts r> _analyze_threats#ConnectionReporter._analyze_threatss s~ )-)G)G)M)M)O %H$,NN3$7 !H k*K 11 L 00 & I ((*+E Y J #IOO$5;O P F#))+,Ak]"XJaHE5:*c1I ,,
& ' vheI; G((1#6KM --
& '!4UG;M%,k3 3 553=U /1
"<<"&@@MM$, $g%E )l*@ )# .i 9# (+##Ir288:( ( $J 66 &88
( '
|>'. 6 S Y^
( '!;J< H77@oRI K *PZ
r= c [ [ 5 nUS:X a U R O U R nUR 5 H( nUR 5 H u pVX%== U-
ss' M M* U$ NrU )r ry r r r rZ )r[ r\ state_countsstates_by_port port_states
state_namer s r> _aggregate_states$ConnectionReporter._aggregate_states sp "3' 5
# #((
*002K%0%6%6%8!
(E1( &9 3 r= c z U( d g[ UR 5 S S9nSR S US U 5 5 $ )NrL c U S * U S 4$ )Nr r r< r s r> r :ConnectionReporter._format_state_summary.. s T!WHd1g3Fr= r , c 3 6 # U H u pU S US 3v M g7f)r r Nr< .0r r s r> ;ConnectionReporter._format_state_summary.. s'
%;!
l!E!9 %%;s )r rZ join)r[ r r ordered_statess r> _format_state_summary(ConnectionReporter._format_state_summary sH &F
yy
%3FU%;
r= c l / nU R 5 ( a+ U R S5 nU( a UR SU45 U R 5 ( a+ U R S5 nU( a UR SU45 U( d g [ [
R " SR S5 5 5 U GH u pE[ UR 5 5 n[ / SQ5 n[ UR 5 S S 9 H, u pU( a X- S- OS
n
UR XU
S S 3/5 M. S
UR S' SUR S' SUR S ' [ [
R " UR S5 5 5 UR! 5 R# 5 H n SU ; d SU ; a~ [$ R& " SU 5 n U ( a? [) U R+ S5 5 S: a! [ [
R, " U 5 5 Ml [ U R/ 5 " U 5 5 M [ [
R " U 5 5 M [ S UR 5 5 5 n
U
S: d GM [ [
R, " SU
S S35 5 GM [ 5 g )NrU zTCP connection statesrV zUDP socket stateszCONNECTION STATE BREAKDOWNr )StateCountr c U S * $ r r< r s r> r EConnectionReporter.print_connection_state_breakdown.. s
Qxr= r r r r lr rr r r z\|\s+(\d+)\s+\|r 2 c 3 B # U H u pU[ ; d M Uv M g 7frl )SUSPICIOUS_TCP_STATESr s r> r FConnectionReporter.print_connection_state_breakdown.. s% )=%J !66 )=s z ! High SYN-RECV count (r u ) — possible SYN flood)r, r rR r0 r r r r r r r r rZ add_rowaligncyan
get_stringr r r ry r redr )r[ sections
tcp_states
udp_statestitler r tabler r sharer count_match
suspiciouss r> print_connection_state_breakdown3ConnectionReporter.print_connection_state_breakdown s4 ?? //6J!8* EF ?? //6J!4j AB
emm 8 ? ? DEF#+ E ++-.E 78E%+ ""$*?&!
27 #-A
zU3Kq/ BC &
$'EKK #&EKK "EKK %**U\\# ./ 0 ((*557 %d):"$)),>"EK"s;+<+ B- -7 $,B r= c
[ S U R R 5 5 5 n[ S U R R 5 5 5 nU R 5 n[ U5 nX- n[ [ R " S5 5 [ [ R " S[ R " 5 R S5 3R S5 5 5 [ [ R " SUS S US S
US S US 3R S5 5 5 [ [ R " S5 5 [ 5 U R 5 nU( a [ [ R " S R S5 5 5 U H nUS
( a SUS
3OSnSUS SU 3n US U; a$ [ [ R " U S35 5 MO [ [ R " U S35 U R 5 " S5 - [ R " S5 - 5 M [ 5 / n
S Hn n [ U R U 5 HO n U R R# X5 ( a M% U R% X5 n
U
R' U
SU SU 35 MQ Mp U
( a [ U R 5 " SR S5 5 5 [ U R 5 " SSR) U
S S 5 35 5 [ U
5 S : a/ [ U R 5 " S [ U
5 S -
S 35 5 [ 5 U R+ 5 U R- 5 nU( a [ U R 5 " S R S5 5 5 [ US S!S"9 HT nS#US$ 3n US% S&:X a! [ [ R. " U 5 5 M5 [ U R 5 " U 5 5 MV [ 5 U R1 5 U R3 US'S(S)9nU( a [ [ R4 " S*R S5 5 5 [7 / S+Q5 nU H/ u nnU( a UU- S- OS,nUR9 UUUS- S.3/5 M1 S/UR: S0' S1UR: S2' S1UR: S3' UR= 5 R? 5 H" n [ [ R " U 5 5 M$ [ 5 g g )4Nc 3 ` # U H$ u pUR S 5 ( d M US v M& g7f)tcp:r Nr r r datas r> r =ConnectionReporter.print_executive_summary.. +
C ~~f%
DM C . .c 3 ` # U H$ u pUR S 5 ( d M US v M& g7f)udp:r Nr r s r> r r r r zd====================================================================================================zCONNECTION SNAPSHOT z%Y-%m-%d %H:%M:%Sr zTotal: r z connections | Unique IPs: z
| TCP: z
| UDP: zYOUR SSH SESSION(S)rO zport z unknown portr r z connected to z (visible below)r zchecking discovered portsr rT r r zDISCOVERED LISTEN PORTSr z ... +z moreALERTSc U S $ )Nr r< r s r> r .W s j)9r= T)r reversez ! r r r r r )r r z TOP /24 SUBNETS (all services))Subnet Connections
% of totalr r r r r r r r ) r r rZ r r r r r r nowstrftimer rZ r r r r rm r rR r r r r r r r r r r r r )r[ tcp_total udp_totalr r total_connectionsadmin_sessionsr`
port_labelr extra_portsr\ r` r^ r alert top_subnets subnet_tabler r r s r> print_executive_summary*ConnectionReporter.print_executive_summary
s
! ; ; A A C
! ; ; A A C
--/ ^
% 1
ejj#$
JJ' (?(?@S(T'UV
JJ / 2 3##-a. 1 %a=
9Q-A &+
ejj#$
113 %** 2 9 9# >? @) }- GM 234'
GDM?. E4=I-%**v-=%>?@
dV2;/ **,-HIJ **S/* *
G &H %d&C&CH&M N ((88OO # 5 5k L ""l^1[M8*#MN O ' $""$%>%E%Ec%JK L $""$r$))K4D*E)F%GH I; "$d&&(73{3Cb3H2I)OPQ G %%'&&( $""$X__S%9: ; 94 eI . /0$.%))D/*$**,T23
G --/'' "A'F %-- @ G G LM N&'NOL!,
=N!22c9TU $$fec{!_%EF "- ,/L x (03L } -/2L | ,$//1<<>ejj&' ? G r= c x [ ( d/ [ S[ R S9 [ R " S5 g g )NzError: ss command not foundr r )ru r r r r r s r> _require_ss ConnectionReporter._require_ssp s& w /cjj A HHQK r= c U R 5 [ R " [ S/[ R SSS9nWR R 5 H nU R USU R 5 M" g ! [ R
a1 [
S[ R S9 [ R " S5 Nf = f)Nz-tanTr r r zError running: ss -tanr r rU )r r r ru r rv r r r r r r _parse_ss_output_liner r[ ry r s r> collect_tcp_connections*ConnectionReporter.collect_tcp_connectionsv *&!! ! &,,779D & &eT 9 9
: ,, * < HHQK +A< collect_udp_connections*ConnectionReporter.collect_udp_connections r r c < [ R " SUR 5 5 n[ U5 S: d US S; a g US n [ R " SSUS 5 n[ R " SSUS 5 nUR S S
5 u pUR S S
5 u pU R U5 nU R U
5 n
U S :X d U S :X a g U[ ; d
U
[ ; a g [ U 5 n U R X5 ( d g U R R ( a U R R U
5 g US :X a U R O U R" n
X U== S
-
ss' X< U
== S
-
ss' g ! [ a g f = f! [ a g f = f)
Nrd r r > r re rg rL rM rN r r r rU )r r rh r ri rj r rQ SKIPPED_SERVER_IPSSKIPPED_CLIENT_IPSry r? r r r rR r r )r[ r r\ connection_storage_dictrm connection_stateserver_address_stringclient_address_string server_ipserver_port_stringrX client_port_stringr`
state_storages r> r (ConnectionReporter._parse_ss_output_line s XXfdjjl3
z?Q *Q-3F"F %a= $&FF;JqM$J !$&FF;JqM$J !,A,H,Ha,P )I,A,H,Ha,P )I &&y1 &&y1 $(:c(A * *i;M.M 01K **;AA ! ! ( ( 4 4 ; ;I F 5
# #((
"#3494 ,Y71<79 s% A E> ( F >
F
F
FFc U R 5 ( ag U R R 5 HI u nn[ UR 5 5 U[ U R U 5 S.U R SU 3' MK U R 5 ( ah U R R 5 HI u nn[ UR 5 5 U[ U R U 5 S.U R SU 3' MK g g )Nr r statesr r ) r, r rZ r r dictr r r0 r r )r[ r` ip_to_count_maps r> summarize_collected_connections2ConnectionReporter.summarize_collected_connections s ?? --335 ! !7!7!9 :* "4#:#:;#G HH..k]/CD 6 ?? --335 ! !7!7!9 :* "4#:#:;#G HH..k]/CD 6 r= c J U R 5 ( a< U R H, nSU 3nX R ; d M S0 0 S.U R U' M. U R 5 ( a= U R H, nSU 3nX R ; d M S0 0 S.U R U' M. g g )Nr r r. r )r, r r r0 r )r[ r` r s r> (ensure_all_requested_services_in_summary;ConnectionReporter.ensure_all_requested_services_in_summary s ?? # 7 7 !+ /#A#AA!" !"$@D228< 8 ?? # 7 7 !+ /#A#AA!" !"$@D228< 8 r= c f [ R " 5 R $ ! [ a Us $ f = frl )r get_terminal_sizecolumnsr )r[ r s r> _terminal_width"ConnectionReporter._terminal_width s0 ++-55 5 N s ! 00c p [ SU R 5 [ - 5 n[ S[ XU5 5 $ r )r r: ESTIMATED_TABLE_WIDTHmin)r[ table_count preferred width_baseds r> _tables_per_row"ConnectionReporter._tables_per_row s1 !T 1 1 37L LM 1c++>??r= c # V # [ S[ U 5 U5 H nXX!- v M
g 7f)Nr )ranger )tables_with_row_data max_per_rowstarts r>
_chunk_tables ConnectionReporter._chunk_tables s- 1c"6 7EE&U-@A A Fs ')c V US nU[ : nUR 5 US S3US S S3/nUR SS5 nUS: a UR US S35 UR S S
5 nUR S S
5 nU( a UR S U 35 U( a UR S
U 35 SR U5 n U( a/ [ [ R " U R S5 5 5 g [ [ R " U R S5 5 5 g )N connectionsr z connsr r internal_web_connectionsr z internal/web-stackr rL
state_summaryz top /24: zstates: z | r )
r r rg rR r r r r r r )
r[
service_titleservice_totalsr
service_is_hot title_parts internal_webr rN title_strings
r> _print_service_title'ConnectionReporter._print_service_title s" *= 9*.CC ""$% #6 * l+A.k :
&))*DaH ! ,q!11D E F#'' b9
&**?B?
:, 7 8 - 9 : zz+. %))L / / 45 6 %-- 3 3C 89 :r= c ^ ^ / n/ nU H u pEpgUR UR 5 R 5 5 UR U VV s1 s HA u pU [ : d M T R Xg5 ( a T R U5 ( a M? UiMC sn n5 M [
S U 5 5 n
U HP n U ( d M [ U S 5 n [ U 5 U
: d M+ U R SU - 5 [ U 5 U
: a M% MR [ U
5 GH, n
/ n[ U5 H u pX mU
S:H nTR 5 R S5 =( d TR 5 ( + nU( a' UR [ R " T5 5 Mw U( a' UR [ R " T5 5 M [ UU 4S jUU 5 5 nU( a' UR [ R " T5 5 M UR T5 M [# SR% U5 5 GM/ g s sn nf )Nc 3 H # U H o( d M [ U5 v M g 7frl )r )r liness r> r .% s
$<5JCJJ$# U H nTR TU5 v M g 7frl )_line_contains_ip)r hot_ipr r[ s r> r rZ > s, &'F ..tV<<'s "r )rR r r r r r r r rE enumeraterh r r r r anyr r r )r[ rF list_of_table_line_lists list_of_high_traffic_ip_setsr rowsr` r\ r r
max_heightrY table_widthirm current_table_index is_header is_border is_hot_liner s ` @r> _print_table_row_chunk)ConnectionReporter._print_table_row_chunk s #% ')$2F .E $ + +E,<,<,>,I,I,K L ( / /!%1!%IB ,, %%k<< 004 !%1
3G
$<
.E eAh-Ke*z) S; ./ e*z) . z"AJ.7(/*# x F JJL 3 3C 8 L
r QConnectionReporter.print_service_tables_side_by_side...V s /$haE$ N)r )r ro rc s r> r GConnectionReporter.print_service_tables_side_by_side..U s+ (%9MAQ /$///%9s #%)rL r r ) r r rB rU r rI r_ r rk ) r[ rO rF rP rG displayed_connectionsro rc r table_chunks chunk_indexchunks r> !print_service_tables_side_by_side4ConnectionReporter.print_service_tables_side_by_sideJ s $ !$' (%9( % !
5 ! .B-AMAQ%)EB %) -A N ..s3G/HIK !!-@ 3 A
#,L"9 KQ ' ' . #: 's Cc 4 SU S3U ; =( d SU S3U ; $ )Nz| r[ |r< )r r s r> r] $ConnectionReporter._line_contains_ipq s' B4qzT!7r"QZ4%77r= c h [ [ 5 n[ [ 5 nSnSnUR 5 H u pxXXS -
nUS R 5 HC u pU R Xr5 ( a U R U 5 ( a Xj-
nM7 X9== U
-
ss' ME UR S0 5 R 5 H u pXK== U
-
ss' M M Sn U R
US5 n
U
( a [ U
R 5 S S9S n UXV-
U[ U5 U S ; a U OSU R U5 S
.$ ) Nr r r r/ rL r c U S $ r r< r s r> r 4ConnectionReporter._service_totals.. s T!Wr= r > r
r )rL external_connectionsrM r r rN )
r ry rZ r r rg r r r r )r[
ports_datar\ r r r
rM r` infor r r r
subnet_totalss r> _service_totals"ConnectionReporter._service_totalsu s: $ "3' #$ !+!1!1!3 K g . $(K$5$5$7 %%k<< 00;;,5, (E1( %8 &*XXh%;%A%A%C!
(E1( &D "4
++Ir:
] 0 0 28LMaPJ -$5$P(@ i.(2.(H*b ! 7 7 E
r= c / nUR 5 H u pVUS S:: a M US n[ US R 5 S S9S S n[ UR 5 SU 3SS /5 n U H4 u pX- S
- n U R U R XU5 U U S S 3/5 M6 S U l S
U R S' S
U R S ' UR XXS45 M U$ )Nr r r c U S * $ r r< )xs r> r :ConnectionReporter._build_service_tables.. s
adUr= r r r r r r r r r )rZ r r r r r r rR )
r[ r^ r r\ tables_to_printr` r
service_totalrc r r r r s
r> _build_service_tables(ConnectionReporter._build_service_tables s
!+!1!1!3 KG}! MM$u+++-?CCRHD #))+,Ak];E %) .#5
**98L SkO %) EK#&EKK "EKK " "E#G H- "4. r= c ^ ^ [ S UR 5 5 5 nUS:: a g[ UU 4S jUR 5 5 5 nT R R
( + =( d US: =( d U$ )Nc 3 * # U H oS v M g7f)r Nr< )r ds r> r ;ConnectionReporter._should_print_service.. s H4Gq'
4Grq r Fc 3 ># U H: u pTR US UT5 R 5 H u p4US: v M M< g7f)r r N)r rZ )r r` r r r r\ r[ s r> r r sS
%7! $($<$<U [(%eg%
CK%
%7s AAr )r r r` rZ r r" )r[ r r\ r
any_ip_over_200s ` ` r> _should_print_service(ConnectionReporter._should_print_service ss HJ4E4E4G H H !
%/%5%5%7
))---
% 8
r= c | U( a5 U R X%S9( a U R UUU R X%S9US9 g g g )Nr\ )rP rG )r rw r )r[ rO r r rG r\ s r> _print_service_if_needed+ConnectionReporter._print_service_if_needed sY t 9 9 :
2 2 # 3 3 4 (
3
?r= c
0 [ S 5 nU R R 5 HW u p#UR S5 u pE[ U5 nU R Xd5 nUS US UR
S0 5 S.XU4 U' MY SU R R U R R SS S
S S S
S/
SS/S.nS GHU nUS:X a U R 5 ( d M! X n Sn
U
[ U 5 : a X nUS:X a US :X a| / SQn / n 0 n
U HG nUR
XN40 5 nU
R U5 U R U R UUUS95 MI U R SU
U [ US9 U
[ U 5 -
n
M UR
XG40 5 n
U
( a" U R X}US9n U R UU
U US9 U
S-
n
U
[ U 5 : a M UR
US40 5 nU( d GM2 U R SUUS9n U R SUU US9 GMX g )Nc [ S 5 $ )Nc S0 S.$ )Nr )r r r< r< r= r> r XConnectionReporter.generate_connection_report_tables.... s !B(?r= r r< r= r> r FConnectionReporter.generate_connection_report_tables.. s
K ?@r= r r r r/ r. r& r! r# r$ rA r r/ r2 r5 rS rT rV r rU )r# r$ rA r z
MAIL SERVICES)rG r\ r re )r r rZ r ry r rg r rW rX r0 r r r r r MAIL_SERVICES_MAX_PER_ROW)r[ service_map_by_protocolr r r\ r r` r^ service_print_order_by_protocolservice_print_orderrf combined_mail_servicesr r sub_service_namesub_service_ports_dataother_ports_datas r> !generate_connection_report_tables4ConnectionReporter.generate_connection_report_tables s "- @#
*.)G)G)M)M)O %H$,NN3$7 !H k*K 11 L )1&u-)--h;N #|$< =k J
*P %%00%%11 5>+
' 'H5 ):):"A"K Ac-.. 2 5 u$ )?-H*&(O!#J,B(1H1L1L % 8"2. #))*@A'.. 6 6 0 6)1 7 -C 11'"'$=!) 2 344A 4 8 8 ,b
&*&@&@$8 'A 'O 11$"'!) 2 Q[ c-..^ 7 : :7#R "&"<"< - #= # --$# % . y 'r= c [ [ 5 n[ [ 5 nU R H n [ U5 nUR ( d" UR
( d UR ( a MD U[ [ U S3SS95 == S-
ss' U[ [ U S3SS95 == S-
ss' M SU4SU44 GH u pVU( d M [ UR 5 S S 9nU R R ( a U Vs/ s H oS S
: d M
UPM n nOUS S n U ( d Mn [ S S
/5 n
XZl [! U 5 V Vs1 s H u pUS S
: d M U iM n n nU H nU
R# U5 M SU
R$ S ' SU
R$ S
' U
R' 5 R) 5 n
[! U
5 H{ u pU S; a! [+ [, R. " U5 5 M, U S: a* U S-
U ; a! [+ [, R0 " U5 5 M\ [+ [, R2 " U5 5 M} [+ 5 GM g ! [ a GM; f = fs snf s snn f )Nz/24Fr r z/16zTop /24 SubnetszTop /16 Subnetsc U S * $ r r< )kvs r> r CConnectionReporter.generate_subnet_summary_tables..R s
BqE6r= r r rN r r r r > r rM r )r ry r r r r r rz r r r rZ r r" r r r_ r r r r r r r r r )r[ slash_24_subnet_countsslash_16_subnet_countsr ip_address_objecttable_title_labelsubnet_counts_dataall_rows_sortedrowrows_to_displayr rf high_traffic_row_indicesrY r s r> generate_subnet_summary_tables1ConnectionReporter.generate_subnet_summary_tables4 sX !,S!1 !,S!1 AAI
$.y$9!%11(33(77 &
&7%8#I/AI I*I* I/ I/
I'&I'c D U R 5 U R 5 U R R ( a[ U R 5 ( a U R 5 U R
5 ( a U R 5 U R 5 g U R
5 ( a U R 5 U R 5 ( a U R 5 U R 5 U R 5 U R 5 U R 5 g rl )
r r{ r r r, r r0 r r r2 r5 r r r s r> _run_report_once#ConnectionReporter._run_report_oncev s $$& ! ! ( ( ,,. ,,. / / 1 ?? ( ( * ?? ( ( * ,,. 557 $$& ..0r= c ` [ R R 5 ( a [ SSS9 g g )Nz[2J[HrL )end)r r isattyr r< r= r>
_clear_screen ConnectionReporter._clear_screen s$ :: /r * r= c f U R R n[ [ R " SU S35 5 U R 5 U R
5 U R 5 [ R " U5 MH ! [ a" [ [ R " S5 5 g f = f)Nz Watch mode: refreshing every zs (Ctrl+C to exit)z
Watch mode stopped.) r r r r r r r r timesleepKeyboardInterrupt)r[ intervals r> run_watch_mode!ConnectionReporter.run_watch_mode s ))//
JJ/z9KL
7""$,,.%%'
8$
! 7 %** 45 6 7s A B )B0/B0c t U R R b U R 5 g U R 5 g rl )r r r r r s r> r ConnectionReporter.run s/ ! ! ' ' 3 ! r= )r r r r r r r r r r r r r r r rl )r )r r )rN )r )NN)rU r )Drt ru rv rw rx ra staticmethodr r r r r r r r r r r r r# r, r0 r4 r9 r r? rG rZ r] ra rq r{ rQ r r r r r r r r r r r r r r r2 r5 r: DEFAULT_MAX_TABLES_PER_ROWrB rI rU rk rw r] r r r r r r r r r r r| r< r= r> r~ r~ t s '0& , ,\G ,
. &
)5#p?>B.. OM $ 4P
FL2=:
7 7
Ob
0daF $$&=R.* 6P @ B B;02)p %N 8 8
@ 6
GK"aH@D1. + +7" r= r~ __main__)(r r8 r r r r r collectionsr r ipaddressr r prettytabler radsr r ru r" r# r r r r r r r r r r= r r rC r? rE rG r~ rt r r< r= r> r s
# , #
,,t
< U #Y/ *#& *O (-K -K`s s l) z r=