Guest User

Untitled

a guest
Dec 11th, 2019
892
0
Never
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
Python 2.61 KB | None | 0 0
  1. import struct
  2. import socket
  3. import humanize
  4.  
  5. templatecache = {}
  6.  
  7.  
  8. def unpack(buf):
  9.     (version, count) = struct.unpack('!HH', buf[0:4])
  10.     if version != 9:
  11.         raise Exception(f"A version {version} packet found.")
  12.     bufpoint = 20
  13.     offset = 0
  14.     totalbytes = 0
  15.     while bufpoint < len(buf):
  16.         (flowsetid, length) = struct.unpack('!HH', buf[bufpoint:bufpoint + 4])
  17.         if not length:
  18.             return
  19.         offset = bufpoint + 4
  20.  
  21.         if flowsetid > 255:  # We have a data flowset
  22.             while offset < length:
  23.                 if flowsetid not in templatecache:
  24.                     offset += length  # Skip until such a template is defined
  25.                 else:
  26.                     for fieldid, fieldlength in templatecache.get(flowsetid, []):
  27.                         bufbuf = buf[offset:offset + fieldlength]
  28.                         if not len(bufbuf):
  29.                             break
  30.                         offset += fieldlength
  31.                         if fieldid not in (1, 23):  # ignore everything other than IN_BYTES and OUT_BYTES
  32.                             continue
  33.  
  34.                         if fieldlength == 1:
  35.                             x = struct.unpack("!B", bufbuf)[0]
  36.                         elif fieldlength == 2:
  37.                             x = struct.unpack("!H", bufbuf)[0]
  38.                         elif fieldlength == 4:
  39.                             x = struct.unpack("!I", bufbuf)[0]
  40.                         elif fieldlength == 8:
  41.                             x = struct.unpack("!Q", bufbuf)[0]
  42.                         else:
  43.                             raise Exception(f"Unsupported fieldlength: {fieldlength}")
  44.  
  45.                         totalbytes += x
  46.  
  47.         elif flowsetid <= 255:  # We have a template flowset
  48.             offset = bufpoint + 4
  49.             while offset < length:
  50.                 (templateid, fieldcount) = struct.unpack('!HH', buf[offset:offset + 4])
  51.                 offset += 4
  52.                 for field in range(fieldcount):
  53.                     (fieldid, fieldlength) = struct.unpack("!HH", buf[offset:offset + 4])
  54.                     templatecache.setdefault(templateid, [])
  55.                     templatecache[templateid].append([fieldid, fieldlength])
  56.                     offset += 4
  57.         bufpoint += length
  58.     return totalbytes
  59.  
  60.  
  61. if __name__ == "__main__":
  62.     s = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
  63.     s.bind(("0.0.0.0", 9995))
  64.     totalbytes = 0
  65.     while(True):
  66.         buf, addr = s.recvfrom(10000)
  67.         totalbytes += unpack(buf)
  68.         print(f"Total Bytes: {humanize.naturalsize(totalbytes)}")
Advertisement
Add Comment
Please, Sign In to add comment