使用scapy,iftop样式计算每个IP的带宽使用情况

Question

我正在使用scapy来嗅探镜像端口并生成前10个"谈话者"的列表,即使用我网络上最大带宽的主机列表.我知道已有的工具,如iftop和ntop,但我需要更多控制输出.

以下脚本对流量进行30秒的采样,然后以"源主机 - >目标主机:字节"格式打印前10个谈话者的列表.这很好,但我怎样才能计算每秒的平均字节数？

我意识到将sample_interval更改为1秒不允许对流量进行良好的采样,因此我似乎需要将其平均化.所以我在脚本的最后尝试了这个:

每秒字节数=(total bytes/sample_interval)

但最终的Bytes/s似乎要低得多.例如,我以1.5 MB/s的节流速率在两台主机之间生成了一个rsync,但是使用上面的平均计算,我的脚本一直计算这些主机之间的速率大约为200 KB/s ...远低于1.5 MB/s正如我所料.我可以用iftop确认1.5 MB/s实际上是这两个主机之间的速率.

我用scapy错误地总计数据包长度(请参阅traffic_monitor_callbak函数)？或者这完全是一个糟糕的解决方案:)？

from scapy.all import *
from collections import defaultdict
import socket
from pprint import pprint
from operator import itemgetter

sample_interval = 30  # how long to capture traffic, in seconds

# initialize traffic dict
traffic = defaultdict(list)

# return human readable units given bytes
def human(num):
    for x in ['bytes','KB','MB','GB','TB']:
        if num < 1024.0:
            return "%3.1f %s" % (num, x)
        num /= 1024.0

# callback function to process each packet
# get total packets for each source->destination combo
def traffic_monitor_callbak(pkt):
    if IP in pkt:
        src = pkt.sprintf("%IP.src%")
        dst = pkt.sprintf("%IP.dst%")

        size = pkt.sprintf("%IP.len%")

        # initialize
        if (src, dst) not in traffic:
            traffic[(src, dst)] = 0

        else:
            traffic[(src, dst)] += int(size)

sniff(iface="eth1", prn=traffic_monitor_callbak, store=0, timeout=sample_interval)

# sort by total bytes, descending
traffic_sorted = sorted(traffic.iteritems(), key=itemgetter(1), reverse=True)    

# print top 10 talkers
for x in range(0, 10):
    src = traffic_sorted[x][0][0]
    dst = traffic_sorted[x][0][1]
    host_total = traffic_sorted[x][3]

    # get hostname from IP
    try:
        src_hostname = socket.gethostbyaddr(src)
    except:
        src_hostname = src

    try:    
        dst_hostname = socket.gethostbyaddr(dst)
    except:
        dst_hostname = dst


    print "%s: %s (%s) -> %s (%s)" % (human(host_total), src_hostname[0], src, dst_hostname[0], dst)

我不确定这是一个编程(scapy/python)问题还是更多的一般网络问题,所以我称之为网络编程问题.

Answer 1

你好，

首先，您发布的代码中有一个错误：host_total = traffic_sorted[x][3]您可能指的是 ，而不是host_total = traffic_sorted[x][1]。

然后，你会遇到一个错误：你忘记除以host_total该sample_interval值。

由于您还想添加接收者到发送者的流量和发送者到接收者的流量，我认为最好的方法是使用“有序”元组（顺序本身在这里并不重要，字典顺序可能很好，但是您还可以使用算术顺序（因为 IP 地址是 4 个八位字节整数）作为对象的键Counter。这似乎工作得很好：

#! /usr/bin/env python

sample_interval = 10
interface="eth1"

from scapy.all import *
from collections import Counter


# Counter is a *much* better option for what you're doing here. See
# http://docs.python.org/2/library/collections.html#collections.Counter
traffic = Counter()
# You should probably use a cache for your IP resolutions
hosts = {}

def human(num):
    for x in ['', 'k', 'M', 'G', 'T']:
        if num < 1024.: return "%3.1f %sB" % (num, x)
        num /= 1024.
    # just in case!
    return  "%3.1f PB" % (num)

def traffic_monitor_callback(pkt):
    if IP in pkt:
        pkt = pkt[IP]
        # You don't want to use sprintf here, particularly as you're
        # converting .len after that!
        # Here is the first place where you're happy to use a Counter!
        # We use a tuple(sorted()) because a tuple is hashable (so it
        # can be used as a key in a Counter) and we want to sort the
        # addresses to count mix sender-to-receiver traffic together
        # with receiver-to-sender
        traffic.update({tuple(sorted(map(atol, (pkt.src, pkt.dst)))): pkt.len})

sniff(iface=interface, prn=traffic_monitor_callback, store=False,
      timeout=sample_interval)

# ... and now comes the second place where you're happy to use a
# Counter!
# Plus you can use value unpacking in your for statement.
for (h1, h2), total in traffic.most_common(10):
    # Let's factor out some code here
    h1, h2 = map(ltoa, (h1, h2))
    for host in (h1, h2):
        if host not in hosts:
            try:
                rhost = socket.gethostbyaddr(host)
                hosts[host] = rhost[0]
            except:
                hosts[host] = None
    # Get a nice output
    h1 = "%s (%s)" % (hosts[h1], h1) if hosts[h1] is not None else h1
    h2 = "%s (%s)" % (hosts[h2], h2) if hosts[h2] is not None else h2
    print "%s/s: %s - %s" % (human(float(total)/sample_interval), h1, h2)

Scapy 的速度可能不够快，无法完成这项工作。可以肯定的是，您可以使用eg将tcpdump -w流量捕获到文件几sample_interval秒钟，然后运行（顺便说一下，看看将该函数应用于数据包的方法，我认为知道如果你经常使用 Scapy）：

#! /usr/bin/env python

sample_interval = 10
filename="capture.cap"

from scapy.all import *
from collections import Counter

traffic = Counter()
hosts = {}

def human(num):
    for x in ['', 'k', 'M', 'G', 'T']:
        if num < 1024.: return "%3.1f %sB" % (num, x)
        num /= 1024.
    return  "%3.1f PB" % (num)

def traffic_monitor_callback(pkt):
    if IP in pkt:
        pkt = pkt[IP]
        traffic.update({tuple(sorted(map(atol, (pkt.src, pkt.dst)))): pkt.len})

# A trick I like: don't use rdpcap() that would waste your memory;
# iterate over a PcapReader object instead.
for p in PcapReader("capture.cap"):
    traffic_monitor_callback(p)

for (h1, h2), total in traffic.most_common(10):
    h1, h2 = map(ltoa, (h1, h2))
    for host in (h1, h2):
        if host not in hosts:
            try:
                rhost = socket.gethostbyaddr(host)
                hosts[host] = rhost[0]
            except:
                hosts[host] = None
    h1 = "%s (%s)" % (hosts[h1], h1) if hosts[h1] is not None else h1
    h2 = "%s (%s)" % (hosts[h2], h2) if hosts[h2] is not None else h2
    print "%s/s: %s - %s" % (human(float(total)/sample_interval), h1, h2)