From ba5c2c6e2d6864155e0d7f30cf0b8b965f3b77ca Mon Sep 17 00:00:00 2001 From: jim-p Date: Fri, 5 Feb 2010 16:07:44 -0500 Subject: Update the state summary to properly detect and use source IP and destination IP, as well as summarize by IP pairing (src -> dst). --- config/states-summary/diag_states_summary.php | 129 +++++++++++++++++++++++++- 1 file changed, 127 insertions(+), 2 deletions(-) (limited to 'config/states-summary/diag_states_summary.php') diff --git a/config/states-summary/diag_states_summary.php b/config/states-summary/diag_states_summary.php index 242c06e9..adad9b6b 100644 --- a/config/states-summary/diag_states_summary.php +++ b/config/states-summary/diag_states_summary.php @@ -1,8 +1,40 @@ 0) { @@ -15,11 +47,20 @@ if(count($states) > 0) { /* break up info and extract $srcip and $dstip */ $ends = preg_split("/\?/", $info); - $parts = split(":", $ends[0]); + + if (strpos($info, '->') === FALSE) { + $srcinfo = $ends[count($ends) - 1]; + $dstinfo = $ends[0]; + } else { + $srcinfo = $ends[0]; + $dstinfo = $ends[count($ends) - 1]; + } + + $parts = split(":", $srcinfo); $srcip = trim($parts[0]); $srcport = trim($parts[1]); - $parts = split(":", $ends[count($ends) - 1]); + $parts = split(":", $dstinfo); $dstip = trim($parts[0]); $dstport = trim($parts[1]); @@ -31,6 +72,24 @@ if(count($states) > 0) { if (!empty($dstport)) { $srcipinfo[$srcip]['protos'][$proto]['dstports'][$dstport]++; } + + $dstipinfo[$dstip]['seen']++; + $dstipinfo[$dstip]['protos'][$proto]['seen']++; + if (!empty($srcport)) { + $dstipinfo[$dstip]['protos'][$proto]['srcports'][$srcport]++; + } + if (!empty($dstport)) { + $dstipinfo[$dstip]['protos'][$proto]['dstports'][$dstport]++; + } + + $pairipinfo["{$srcip} -> {$dstip}"]['seen']++; + $pairipinfo["{$srcip} -> {$dstip}"]['protos'][$proto]['seen']++; + if (!empty($srcport)) { + $pairipinfo["{$srcip} -> {$dstip}"]['protos'][$proto]['srcports'][$srcport]++; + } + if (!empty($dstport)) { + $pairipinfo["{$srcip} -> {$dstip}"]['protos'][$proto]['dstports'][$dstport]++; + } } } @@ -45,6 +104,7 @@ include("fbegin.inc"); ?>

+

By Source IP

@@ -78,4 +138,69 @@ include("fbegin.inc");
IP
+ +

By Destination IP

+ + + + + + + + + + $ipinfo) { ?> + + + + + + + + + $protoinfo) { ?> + + + + + + + + + + +
IP# StatesProto# StatesSrc PortsDst Ports
    
  
+ +

By IP Pair

+ + + + + + + + + + $ipinfo) { ?> + + + + + + + + + $protoinfo) { ?> + + + + + + + + + + +
IP# StatesProto# StatesSrc PortsDst Ports
    
  
-- cgit v1.2.3