1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
|
/*
*
* (C) 2013-22 - ntop.org
*
*
* This program is free software; you can redistribute it and/or modify
* it under the terms of the GNU General Public License as published by
* the Free Software Foundation; either version 3 of the License, or
* (at your option) any later version.
*
* This program is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
* GNU General Public License for more details.
*
* You should have received a copy of the GNU General Public License
* along with this program; if not, write to the Free Software Foundation,
* Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
*
*/
#ifndef _LOCAL_HOST_STATS_H_
#define _LOCAL_HOST_STATS_H_
class LocalHostStats: public HostStats {
protected:
/* Written by NetworkInterface::processPacket thread */
DnsStats *dns;
HTTPstats *http;
ICMPstats *icmp;
MostVisitedList *top_sites;
/* nextPeriodicUpdate done every 5 min */
time_t nextPeriodicUpdate;
u_int32_t num_contacts_as_cli, num_contacts_as_srv;
/* Estimate of the number of critical servers used by this host */
Cardinality num_dns_servers, num_smtp_servers, num_ntp_servers;
/* Estimate of the number of different Domain Names contacted */
Cardinality num_contacted_domain_names;
/* Estimate the number of contacted hosts using HyperLogLog */
struct ndpi_hll hll_contacted_hosts;
double old_hll_value, new_hll_value, hll_delta_value;
DESCounter contacted_hosts;
/* Estimate the number of contacted countries using HyperLogLog */
struct ndpi_hll hll_countries_contacts;
u_int8_t old_hll_countries_value, new_hll_countries_value, hll_delta_countries_value;
Cardinality num_contacted_hosts_as_client, /* # of hosts contacted by this host */
num_host_contacts_as_server, /* # of hosts that contacted this host */
num_contacted_services_as_client, /* DNS, TLS, HTTP.... */
num_contacted_ports_as_client, /* # of different ports this host has contacted */
num_host_contacted_ports_as_server, /* # of different server ports contacted by remote peers */
contacts_as_cli, contacts_as_srv; /* Minute reset host contacts */
PeerStats *peers;
void updateHostContacts();
void removeRedisSitesKey();
void addRedisSitesKey();
void updateContactedHostsBehaviour();
void updateCountriesContactsBehaviour();
#if defined(NTOPNG_PRO)
void resetTrafficStats();
#endif
public:
LocalHostStats(Host *_host);
LocalHostStats(LocalHostStats &s);
virtual ~LocalHostStats();
inline ICMPstats* getICMPStats() const { return(icmp); }
virtual void incStats(time_t when, u_int8_t l4_proto,
u_int ndpi_proto, ndpi_protocol_category_t ndpi_category,
custom_app_t custom_app,
u_int64_t sent_packets, u_int64_t sent_bytes, u_int64_t sent_goodput_bytes,
u_int64_t rcvd_packets, u_int64_t rcvd_bytes, u_int64_t rcvd_goodput_bytes,
bool peer_is_unicast);
virtual void updateStats(const struct timeval *tv);
virtual void getJSONObject(json_object *my_object, DetailsLevel details_level);
virtual void deserialize(json_object *obj);
virtual void lua(lua_State* vm, bool mask_host, DetailsLevel details_level);
virtual void resetTopSitesData();
virtual void addContactedDomainName(char* domain_name) { num_contacted_domain_names.addElement(domain_name,strlen(domain_name)); }
virtual u_int32_t getDomainNamesCardinality() { return num_contacted_domain_names.getEstimate(); }
virtual void resetDomainNamesCardinality() { num_contacted_domain_names.reset(); }
virtual void luaDNS(lua_State *vm, bool verbose) { if(dns) dns->lua(vm, verbose); }
virtual void luaHTTP(lua_State *vm) { if(http) http->lua(vm); }
virtual void luaICMP(lua_State *vm, bool isV4, bool verbose) { if (icmp) icmp->lua(isV4, vm, verbose); }
virtual void luaPeers(lua_State *vm);
virtual void incrVisitedWebSite(char *hostname);
virtual void lua_get_timeseries(lua_State* vm);
void luaContactsBehaviour(lua_State *vm);
virtual void luaHostBehaviour(lua_State* vm);
virtual void luaCountriesBehaviour(lua_State* vm);
virtual bool hasAnomalies(time_t when);
virtual void luaAnomalies(lua_State* vm, time_t when);
virtual HTTPstats* getHTTPstats() { return(http); };
virtual DnsStats* getDNSstats() { return(dns); };
virtual ICMPstats* getICMPstats() { return(icmp); };
virtual u_int16_t getNumActiveContactsAsClient() { return(num_contacts_as_cli); }
virtual u_int16_t getNumActiveContactsAsServer() { return(num_contacts_as_srv); }
virtual void incCliContactedPorts(u_int16_t port) { num_contacted_ports_as_client.addElement(port); }
virtual void incSrvPortsContacts(u_int16_t port) { num_host_contacted_ports_as_server.addElement(port); }
virtual u_int32_t getSlidingAvgCliContactedPeers() { return(peers->getCliSlidingEstimate()); };
virtual u_int32_t getSlidingAvgSrvContactedPeers() { return(peers->getSrvSlidingEstimate()); };
virtual u_int32_t getTotAvgCliContactedPeers() { return(peers->getCliTotEstimate()); };
virtual u_int32_t getTotAvgSrvContactedPeers() { return(peers->getSrvTotEstimate()); };
virtual bool getSlidingWinStatus() { return(peers->getSlidingWinStatus()); };
virtual u_int32_t getNTPContactCardinality() { return(num_ntp_servers.getEstimate()); };
virtual u_int32_t getDNSContactCardinality() { return(num_dns_servers.getEstimate()); };
virtual u_int32_t getSMTPContactCardinality() { return(num_smtp_servers.getEstimate()); };
virtual void incNTPContactCardinality(Host *h) { if(h->get_ip()) num_ntp_servers.addElement(h->get_ip()->key()); };
virtual void incDNSContactCardinality(Host *h) { if(h->get_ip()) num_dns_servers.addElement(h->get_ip()->key()); };
virtual void incSMTPContactCardinality(Host *h) { if(h->get_ip()) num_smtp_servers.addElement(h->get_ip()->key()); };
virtual void incCliContactedHosts(IpAddress *peer) {
peer->incCardinality(&num_contacted_hosts_as_client);
peer->incCardinality(&contacts_as_cli);
}
virtual void incSrvHostContacts(IpAddress *peer) {
peer->incCardinality(&num_host_contacts_as_server);
peer->incCardinality(&contacts_as_srv);
}
virtual void incContactedService(char *name) {
if(name && (name[0] != '\0'))
num_contacted_services_as_client.addElement(name, strlen(name));
}
virtual void incCountriesContacts(char *country) { ndpi_hll_add(&hll_countries_contacts, country, strlen(country)); }
virtual u_int8_t getCountriesContactsCardinality() { return((u_int8_t)ndpi_hll_count(&hll_countries_contacts)); }
virtual void resetCountriesContacts() { ndpi_hll_reset(&hll_countries_contacts); }
};
#endif
|
