1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
|
#!/usr/bin/perl
##########################################################################
# $Id: rt314,v 1.4 2003/12/15 18:09:23 kirk Exp $
##########################################################################
#############################################################################
# rt314: logwatcher processing script for NetGear RT314 router syslog output.
# Author: Daniel J. Barrett, dbarrett@blazemonger.com.
# Public Domain.
# $Id: rt314,v 1.4 2003/12/15 18:09:23 kirk Exp $
#############################################################################
use Socket;
$Detail = $ENV{'LOGWATCH_DETAIL_LEVEL'} || 0;
my $separator = "-------------------------------------------------------\n";
### Partition the data into types
my (@portscanlines, @genlines, @otherlines, $begin, $end);
my $psl = 0;
my $gl = 0;
my $ol = 0;
while (my $line = <STDIN>) {
$line =~ s/netgear RAS: //;
unless ($begin) {
$begin = substr($line, 0, 15);
}
$end = $line;
if ( $line =~ /dpo=/ ) {
$portscanlines[$psl++] = $line;
} elsif ( $line =~ / GEN/ ) {
$genlines[$gl++] = $line;
} elsif ( $line =~ /last message repeated/ ) {
;
} else {
$otherlines[$ol++] = $line;
}
}
exit(0) unless ($end);
$end = substr($end, 0, 15);
### Print summary
if ($Detail >= 10) {
print "=== Summary ===\n\n";
}
print "Begin:\t$begin\n";
print "End:\t$end\n";
print "\n";
# Extract the port number and source IP address.
my @portarray;
my %ipaddrs;
foreach my $line (@portscanlines) {
my $portnum;
my $ipaddr;
my $dup = $line;
$dup =~ s/^.*Src=([0-9.]+) .* dpo=([0-9]*).*$/\1/;
$ipaddr = $1;
$portnum = $2;
$portarray[$portnum]++;
if (exists($ipaddrs{$ipaddr})) {
$ipaddrs{$ipaddr}++;
} else {
$ipaddrs{$ipaddr} = 1;
}
}
# Summarize port scans by port number
my $total = 0;
print "Port #\t\tScans\tService Name\n";
print $separator;
for (my $i = 0; $i <= $#portarray; $i++) {
if ( $portarray[$i] > 0 ) {
print "$i\t\t" . $portarray[$i] . "\t" . getservbyport($i, "tcp") . "\n";
$total += $portarray[$i];
}
}
print $separator;
print "Total\t\t$total\n";
print "\n";
# Summarize port scans by initiating host
my @keys = sort {$a <=> $b} (keys %ipaddrs);
print "Scanned by\tScans\tHostname Lookup\n";
print $separator;
$total = 0;
foreach my $ip (@keys) {
print "$ip\t" . $ipaddrs{$ip} . "\t" . gethostbyaddr(inet_aton($ip), AF_INET) . "\n";
$total += $ipaddrs{$ip};
}
print $separator;
print "Total\t\t$total\n";
print "\n";
# Summarize other rule firings
if ( $#genlines > 0 ) {
print "Rules fired:\t" . $#genlines . "\n";
print "\n";
}
# Summarize remaining output
if ( $#otherlines > 0 ) {
print "Uncategorized:\t" . $#otherlines . "!!!!!!!\n";
print "\n";
}
if ($Detail >= 10) {
## Print all data
print "=== Raw Data ===\n\n";
if ( $#portscanlines > 0 ) {
print "Port scans:\n";
foreach my $line (@portscanlines) {
print $line;
}
print "\n";
}
if ( $#genlines > 0 ) {
print "Rule lines:\n";
foreach my $line (@genlines) {
print $line;
}
print "\n";
}
if ( $#otherlines > 0 ) {
print "Other lines:\n";
foreach my $line (@otherlines) {
print $line;
}
print "\n";
}
}
exit(0);
# vi: shiftwidth=3 tabstop=3 et
|
