1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
|
#!/usr/bin/env python3
#
# python-ipfix (c) 2013-2014 Brian Trammell.
#
# Many thanks to the mPlane consortium (http://www.ict-mplane.eu) for
# its material support of this effort.
#
# This program is free software: you can redistribute it and/or modify it under
# the terms of the GNU Lesser General Public License as published by the Free
# Software Foundation, either version 3 of the License, or (at your option) any
# later version.
#
# This program is distributed in the hope that it will be useful, but WITHOUT
# ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS
# FOR A PARTICULAR PURPOSE. See the GNU Lesser General Public License for more
# details.
#
# You should have received a copy of the GNU General Public License along with
# this program. If not, see <http://www.gnu.org/licenses/>.
#
import ipfix.ie
import ipfix.reader
import ipfix.message
import ipfix.v9pdu
import socketserver
import argparse
import csv
import bz2
import gzip
from sys import stdin, stdout, stderr
def parse_args():
parser = argparse.ArgumentParser(description="Convert an IPFIX file or stream to CSV")
parser.add_argument('ienames', metavar="ie", nargs="+",
help="column(s) by IE name")
parser.add_argument('--spec', '-s', metavar="specfile", action="append",
help="file to load additional IESpecs from")
parser.add_argument('--file', '-f', metavar="file", nargs="?",
help="IPFIX file to read (default stdin)")
parser.add_argument('--gzip', '-z', action="store_const", const=True,
help="Decompress gzip-compressed IPFIX file")
parser.add_argument('--bzip2', '-j', action="store_const", const=True,
help="Decompress bz2-compressed IPFIX file")
parser.add_argument('--netflow9', '-9', action="store_const", const=True,
help="Decode as NetFlow version 9 instead of IPFIX (with --file or stdin only)")
parser.add_argument('--collect', '-c', metavar="transport", nargs="?",
help="run CP on specified transport")
parser.add_argument('--bind', '-b', metavar="bind", nargs="?",
default="", help="address to bind to as CP (default all)")
parser.add_argument('--port', '-p', metavar="port", nargs="?", type=int,
default="4739", help="port to bind to as CP (default 4739)")
return parser.parse_args()
def init_ipfix(specfiles = None):
ipfix.ie.use_iana_default()
ipfix.ie.use_5103_default()
if specfiles:
for sf in specfiles:
ipfix.ie.use_specfile(sf)
def stream_to_csv(instream, ienames, reader_fn=ipfix.reader.from_stream):
cols = ipfix.ie.spec_list(ienames)
r = reader_fn(instream)
w = csv.writer(stdout, dialect='unix')
w.writerow([e.name for e in cols])
for rec in r.tuple_iterator(cols):
w.writerow([col.unparse(val) for val, col in zip(rec, cols)])
class TcpCsvHandler(socketserver.StreamRequestHandler):
def handle(self):
stderr.write("connection from "+str(self.client_address)+"\n")
stream_to_csv(self.rfile, args.ienames)
#######################################################################
# MAIN PROGRAM
#######################################################################
if __name__ == "__main__":
# get args
args = parse_args()
# initialize information model
init_ipfix(args.spec)
# select reader creator function
if args.netflow9:
reader_fn = ipfix.v9pdu.from_stream
else:
reader_fn = ipfix.reader.from_stream
# die on invalid arguments
if args.netflow9 and args.collect:
raise ValueError("NetFlow9 only supported from files or stdin")
if args.file is None and (args.bzip2 or args.gzip):
raise ValueError("Decompression only supported from file input")
# now run the gauntlet
if args.collect == 'tcp':
stderr.write("starting TCP CP on "+args.bind+":"+
str(args.port)+"; Ctrl-C to stop\n")
stderr.flush()
ss = socketserver.TCPServer((args.bind, args.port), TcpCsvHandler)
ss.serve_forever()
elif args.collect:
raise ValueError("Unsupported transport "+args.collect+"; must be 'tcp' in this revision")
elif args.file:
if args.bzip2:
with bz2.open (args.file, mode="rb") as f:
stream_to_csv(f, args.ienames, reader_fn)
elif args.gzip:
with gzip.open (args.file, mode="rb") as f:
stream_to_csv(f, args.ienames, reader_fn)
else:
with open (args.file, mode="rb") as f:
stream_to_csv(f, args.ienames, reader_fn)
else:
stdin = stdin.detach()
stream_to_csv(stdin, args.ienames, reader_fn)
|
