def process_msg(m):

    if m['type'] != "EXPIRATION":
        return 
    
    if m['rrtype'] != 1:
        return

    if m['rrttl'] > MAX_SUSPICIOUS_TTL:
        return

    if len(m['rdata']) < MIN_SUSPICIOUS_RRSET_SIZE and m['rrttl'] > VERY_SHORT_TTL: 
        return

    qname = wdns.domain_to_str(m['rrname'])
    qcount = m['count']
    ttl   = m['rrttl']
    rrset_str = Set([])
    for rr in m['rdata']:
        rr_str = str(wdns.rdata(rr, m['rrclass'], m['rrtype']))
        rrset_str.add(rr_str)

    diversity = rdata_diversity(rrset_str) 
    if diversity < 0:
        return

    if len(m['rdata']) >= MIN_SUSPICIOUS_RRSET_SIZE and diversity < MIN_SUSPICIOUS_DIVERSITY:
        return

    first_seen = datetime.fromtimestamp(m['time_first'])
    last_seen = first_seen
    if 'time_last' in m.keys():
        last_seen  = datetime.fromtimestamp(m['time_last'])
    msg_creation = datetime.fromtimestamp(m.time_sec)
    delta = msg_creation - first_seen
    seconds = delta.days * 86400 + delta.seconds
    if seconds == 0:
        return # we cannot compute the avg num of queries in 1h for this message

    # normalized_1h_count = qcount*1.0/seconds * 3600
    # print qname, ttl, "("+str(normalized_1h_count)+")"
    # print diversity
    # for rr_str in rrset_str:
    #     print rr_str
    # print "-----------------------"

    add_to_candidate_domains(qname, qcount, ttl, rrset_str, first_seen, last_seen, msg_creation)
示例#2
0

parser = argparse.ArgumentParser()
parser.add_argument('--output', '-o', default='-', help='Output to file')
parser.add_argument('input', help='Input file')
args = parser.parse_args()

if args.output == '-':
    out = sys.stdout
else:
    out = open(args.output, 'w')

for m in nmsg_input(nmsg.input.open_file(args.input)):
    print >> out, 'count: %d' % m['count']
    print >> out, 'time_first: %s' % datetime.datetime.fromtimestamp(
        m['time_first']).isoformat()
    print >> out, 'time_last: %s' % datetime.datetime.fromtimestamp(
        m['time_last']).isoformat()
    if 'response_ip' in m.fields:
        print >> out, 'response_ip: %s' % m['response_ip']
    print >> out, 'bailiwick: %s' % wdns.domain_to_str(m['bailiwick'])
    print >> out, 'rrname: %s' % wdns.domain_to_str(m['rrname'])
    print >> out, 'rrclass: %s (%d)' % (wdns.rrclass_to_str(
        m['rrclass']), m['rrclass'])
    print >> out, 'rrtype: %s (%d)' % (wdns.rrtype_to_str(
        m['rrtype']), m['rrtype'])
    print >> out, 'rrttl: %d' % m['rrttl']
    for rdata in m['rdata']:
        print 'rrdata: %s' % repr(wdns.rdata(rdata, m['rrclass'], m['rrtype']))
    print >> out
示例#3
0
        m = input.read()
        if not m:
            break
        yield m

parser = argparse.ArgumentParser()
parser.add_argument('--output','-o', default='-',
        help='Output to file')
parser.add_argument('input', help='Input file')
args = parser.parse_args()

if args.output == '-':
    out = sys.stdout
else:
    out = open(args.output, 'w')

for m in nmsg_input(nmsg.input.open_file(args.input)):
    print >>out, 'count: %d' % m['count']
    print >>out, 'time_first: %s' % datetime.datetime.fromtimestamp(m['time_first']).isoformat()
    print >>out, 'time_last: %s' % datetime.datetime.fromtimestamp(m['time_last']).isoformat()
    if 'response_ip' in m.fields:
        print >>out, 'response_ip: %s' % m['response_ip']
    print >>out, 'bailiwick: %s' % wdns.domain_to_str(m['bailiwick'])
    print >>out, 'rrname: %s' % wdns.domain_to_str(m['rrname'])
    print >>out, 'rrclass: %s (%d)' % (wdns.rrclass_to_str(m['rrclass']), m['rrclass'])
    print >>out, 'rrtype: %s (%d)' % (wdns.rrtype_to_str(m['rrtype']), m['rrtype'])
    print >>out, 'rrttl: %d' % m['rrttl']
    for rdata in m['rdata']:
        print 'rrdata: %s' % repr(wdns.rdata(rdata, m['rrclass'], m['rrtype']))
    print >>out