Traffic monitoring script compiled using tcpdump + python

Some employees of the company love surfing the Internet, so they write a traffic monitoring script. if the traffic is too high, they will send an email to the administrator. Only applicable to the company. First, use tcpdump to capture packets, and then use the python regular expression to process them. Then count the traffic. I have just learned python and hope you can advise me. Tcpdump script #! /Bi

Some employees of the company love surfing the Internet, so they write a traffic monitoring script. if the traffic is too high, they will send an email to the administrator. Only applicable to the company. UseTcpdumpCapture the packet and then process it with the python regular expression. Then count the traffic. I have just learned python and hope you can advise me.

Tcpdump packet capture script

#! /Bin/bash
Tcpdump-I eth0 ip-nn 'src net! 192.168.2.0/24 and! 192.168.3.0/24 and! 192.168.0.0/24 '-vv>/root/tcpdump. log &
Sleep 3
Killall-9 tcpdump

#! /Usr/bin/python
Def singleipflow (dstip): This function is used to count the traffic of a single ip address for a certain period of time.
Import sys
Import re
Import string
Countflow = 0
Starttime = []
Q = open ('/root/tcpdump. log', 'r ')
M = q. readlines ()
Q. close ()
For eachline in m:
If re. search ('length', eachline) andre. search ('IP', eachline) and re. search (dstip, eachline) is notNone:
Info = re. match ('(/d +:/d + /. /d + | ). * length/s (/d + ). */)/s (/d {1, 3 }/. /d {1, 3 }/. /d {1, 3 }/. /d {1, 3 }). *? (/D {1, 3}/./d {1, 3}/./d {1, 3}/./d {1, 3}). * ', eachline)
# Print info. groups ()
If info. group (1 )! = '':
Dstipinfo = info. group (4)
Singleflow = info. group (2)
Ifdstipinfo = dstip:
Countflow + = int (singleflow)
Starttime. append (info. group (1 ))
Else:
Continue
Sumflow = (countflow, starttime)
Return sumflow
 

Import OS
Import sys
Import re
Import string
While True:
OS. system ('/python/tcpdump. sh ')
Import time
Datetime = time. time ()
# Print type (datetime)
Timestring = time. ctime (datetime)
# Print type (timestring)
Print timestring
Del datetime
For j in [2, 3]:
For I in range (1,254, 1 ):
Dstip = '1970. 192. '+ str (j) +'. '+ str (I)
M = singleipflow (dstip)
If len (m [1]) <= 1:
Pass
Elif len (m [1])> 1:
Begintime = re. search ('(/d) :(/d /. /d {6}) ', m [1] [0])
Endtime = re. search ('(/d) :(/d /. /d {6}) ', m [1] [len (m [1])-1])
Starttime = float (begintime. group (1) * 60 + float (begintime. group (2) * 60 + float (begintime. group (3 ))
Stoptime = float (endtime. group (1) * 60 + float (endtime. group (2) * 60 + float (endtime. group (3 ))
Time = stoptime-starttime
Iftime> 1:
Avgflow = int (m [0])/time/1024/2
Print '%-15 s % 20 s % 20 s % 10skB/s' % (dstip, m [1] [0], m [1] [len (m [1])-1], str (avgflow) [: 5])

If avgflow> 100:
File = open ('/python/text', 'w ')
File. write (dstip)
File. close ()
Print '%-15 s % 20 s % 20 s % 10skB/s is overflow' % (dstip, m [1] [0], m [1] [len (m [1])-1], str (avgflow) [: 5])
OS. system ('mail-s "ip is overflow" xxx@163.comElse:
Pass
Print 'one round is over'
Print''
OS. system ('rm-rf/root/tcpdump. log ')