0

我有一个防火墙日志文件，如下所示：

"编号","时间","源","目的地","协议","信息""1","0.000000","172.16.113.168","172.16.112.50","TELNET","Telnet数据..." "2","0.000426","172.16.112.50","172.16.113.168","TELNET","Telnet 数据..." "3","0.019849","172.16.113.168", "172.16.112.50","TCP","21582 > telnet [ACK] Seq=2Ack=2 Win=32120 Len=0" "4","0.530125","172.16.113.168","172.16.112.50"," TELNET","Telnet 数据 ..." "5","0.530634","172.16.112.50","172.16.113.168","TELNET","Telnet 数据 ..." "6","0.549962","172.16.113.168","172.16.112.50","TCP","21582

远程登录 [ACK] Seq=3 Ack=3 Win=32120 Len=0"

我希望能够按文件名运行文件（我使用的是 Linux），例如。

log1.py logfile.csv（程序名称后跟日志文件名称）并获得以下输出：

$ log1.py logfile.csv 源 IP 目标 IP 协议计数

        0.0.0.0     255.255.255.255      BOOTP         20
    0.1.125.174         131.84.1.31        TCP          2
    192.168.1.1         172.168.1.2        TCP        100 

       (............lots more here .....................)

Oracle_89:a5:9f       3com_9c:b2:54        ARP         14

                                        Total:     649787

我想拥有的另一个非常有用的功能是当我使用源 IP 地址和目标 IP 地址运行程序时。我希望输出看起来类似于以下内容：

$ log1.py 172.16.112.50 日志文件.csv

      Source IP      Destination IP   Protocol      Count

  172.16.112.50      135.13.216.191        IMF          4
                                          SMTP         53
                                           TCP         43
                                        TELNET         35
        (............lots more here .....................)

                     172.16.112.194       SMTP          7
                                           TCP         42
                                        TELNET       3745

                                        Total:      38369

最后，我希望能够同时指定源 IP 地址和目标 IP 和地址，并获得以下输出：

$ log1.py 172.16.112.50 202.77.162.213 packet.csv 源 IP 目标 IP 协议计数

  172.16.112.50      202.77.162.213       ICMP          1
                                       Portmap          5
                                           RSH          9
                                       SADMIND          1
                                           TCP         30
                                        TELNET         41

                                        Total:         87

我是一名初级系统管理员，并没有太多的编程经验（只是 HTML）我已经开始学习但是，在过去的 3 天里我一直被这个问题困住，这是我到目前为止所拥有的：

# Function for validating IP address is valid or not 
def ip_validation(ip_address):
    ip_regex= re.match('^[\d]{1,3}[.][\d]{1,3}[.][\d]{1,3}[.][\d]{1,3}$', ip_address)
    return ip_regex
def filereader(file_name):
    file_dump= open(file_name,'r')
    for eachline in file_dump:
        line_a= eachline.replace('\"','') # removes all quotes from the file
        line_b= line_a.split(',') # Delimate each fild based on ','             
        src_ip= line_b[2] # Source IP
        dst_ip= line_b[3] # Destination IP
        prot= line_b[4] # Protocol
        eachline= src_ip, dst_ip, prot      
        itlist.append(eachline) 
        itlist.sort()
        print itlist
4

1 回答 1

0

解析日志文件并创建列表列表，其中每个子列表包含（源 IP、目标 IP、协议、计数）。

现在，您只需在这个外部列表上应用过滤器功能。如果您需要进一步说明，请回复。

于 2013-10-15T09:14:50.883 回答