#!/bin/env python3
import re, collections, sys

r_conntrack = re.compile(r"\s*(?P<type>udp|tcp)\s+\d+\s+\d+\s+(?P<cmd>[\w+\_]+\s+)?src=(?P<src>(?:\d{1,3}\.){3}\d{1,3})\s+dst=(?P<dst>(?:\d{1,3}\.){3}\d{1,3})\s+sport=(?P<src_port>\d{1,5})\s+dport=(?P<dst_port>\d{1,5})\s+packets=(?P<packets>\d+)\s+bytes=(?P<bytes>\d+)\s+src=(?P<src2>(?:\d{1,3}\.){3}\d{1,3})\s+dst=(?P<dst2>(?:\d{1,3}\.){3}\d{1,3})\s+sport=(?P<src_port2>\d{1,5})\s+dport=(?P<dst_port2>\d{1,5})\s+packets=(?P<packets2>\d+)\s+bytes=(?P<bytes2>\d+)\s+(?P<info>.+)")
r_router = re.compile(r"\s*10\.3\.50\.52\s*")
r_internal = re.compile(r"\s*10\.3\.1[02]\.\d{1,3}\s*")

def matches_router_ip(addr):
    return r_router.match(addr) != None

def matches_internal_ip(addr):
    return r_internal.match(addr) != None

def connection_name(m):
    addr1 = m.groupdict()["src"]
    addr2 = m.groupdict()["dst"]
    if addr1 < addr2:
        name = addr1 + " <-> " + addr2
    else:
        name = addr2 + " <-> " + addr1
    return name

def type_stats(matches):
    udp = 0
    tcp = 0
    for m in matches:
        if m.groupdict()["type"] == "udp":
            udp += 1
        elif m.groupdict()["type"] == "tcp":
            tcp += 1
    return {"udp": udp, "tcp": tcp}

def conn_ranking(matches, num = None):
    names = [connection_name(m) for m in matches]
    counter = collections.Counter(names)
    return counter.most_common(num)

def traffic_ranking(matches, num = None):
    keys = []
    values = []
    for m in matches:
        name = connection_name(m)
        if not name in keys:
            keys.append(name)
            values.append(0)
        values[keys.index(name)] += int(m.groupdict()["bytes"])+int(m.groupdict()["bytes2"])

    ranking = sorted([(k, v) for k, v in zip(keys, values)], key=lambda r: r[1])[::-1]
    if not num:
        return ranking
    if len(ranking) <= num:
        return rankking
    return ranking[:num]

if __name__ == "__main__":
    if len(sys.argv) != 2:
        raise("Specify input file:")

    internal_matches = []
    external_matches = []

    f = open(sys.argv[1])
    for l in f:
        m = r_conntrack.match(l)
        if m:
            addr1 = m.groupdict()["src"]
            addr2 = m.groupdict()["dst"]
            addr1_internal = matches_router_ip(addr1) or matches_internal_ip(addr1)
            addr2_internal = matches_router_ip(addr2) or matches_internal_ip(addr2)
            if addr1_internal and addr2_internal:
                internal_matches.append(m)
            else:
                external_matches.append(m)
    f.close()

    # traffic types
    print("traffic types: ", type_stats(external_matches), "")

    # connection count ranking
    print("\n\nexternal connections (top 20):")
    rank = conn_ranking(external_matches, num=20)
    for r in rank:
        print(r)

    print("\n\ninternal connections (top 20):")
    rank = conn_ranking(internal_matches, num=20)
    for r in rank:
        print(r)

    # connection traffic ranking
    print("\n\nexternal traffic (top 20):")
    rank = traffic_ranking(external_matches, 20)
    for r in rank:
        print(r)

    print("\n\ninternal traffic (top 20):")
    rank = traffic_ranking(internal_matches, 20)
    for r in rank:
        print(r)