1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
|
--
-- (C) 2021 - ntop.org
--
local dirs = ntop.getDirs()
package.path = dirs.installdir .. "/scripts/lua/modules/?.lua;" .. package.path
require "lua_utils"
local json = require "dkjson"
sendHTTPContentTypeHeader('text/html')
local mode = _GET["ebpf_data"] or "processes"
local host = _GET["host"]
local username = _GET["username"]
local uid = _GET["uid"]
local pageinfo = {
["sortColumn"] = "column_bytes",
["maxHits"] = 15,
["a2zSortOrder"] = false,
["hostFilter"] = host,
["usernameFilter"] = username,
["detailsLevel"] = "high", -- to obtain processes information
}
local flows_stats = interface.getFlowsInfo(host, pageinfo)
local res = {}
if not flows_stats then
res[#res + 1] = {label = "Other", value = 1}
-- print('[ { "label": "Other", "value": 1 } ]') -- No flows found
else
flows_stats = flows_stats["flows"]
local tot = 0
local aggregation = {}
for _, f in pairs(flows_stats or {}) do
local key
-- Prepare aggregation parameter
if mode == "processes" then
if f["client_process"] and f["client_process"]["user_name"] == username then
key = f["client_process"]["name"]
elseif f["server_process"] and f["server_process"]["user_name"] == username then
key = f["server_process"]["name"]
end
elseif mode == "applications" then
key = f["proto.ndpi"]
elseif mode == "breeds" then
key = f["proto.ndpi_breed"]
elseif mode == "categories" then
key = f["proto.ndpi_cat"]
end
-- Do aggregation
if key then
if aggregation[key] == nil then aggregation[key] = 0 end
local v = f["cli2srv.bytes"] + f["srv2cli.bytes"]
aggregation[key] = aggregation[key] + v
tot = tot + v
end
end
-- Print up to this number of entries
local max_num_entries = 10
-- Print entries whose value >= 5% of the total
local threshold = (tot * 5) / 100
local num = 0
local accumulate = 0
for key, value in pairsByValues(aggregation, rev) do
if value < threshold and num > 0 then
break
end
res[#res + 1] = {label = key, value = value}
accumulate = accumulate + value
num = num + 1
if num >= max_num_entries then
break
end
end
-- In case there is some leftover do print it as "Other"
if accumulate < tot then
res[#res + 1] = {label = "Other", value = (tot - accumulate)}
end
end
print(json.encode(res))
|
