tyler.durden
/
pandorafms
mirror of https://github.com/pandorafms/pandorafms.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Implement new netflow item

This commit is contained in:
alejandro.campos@artica.es 2022-02-21 11:44:31 +01:00
parent 91797c7112
commit 659408ee44
8 changed files with 360 additions and 37 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

11
pandora_console/godmode/reporting/reporting_builder.item_editor.php
View File

@ -867,6 +867,7 @@ switch ($action) {
case 'netflow_area':
case 'netflow_data':
case 'netflow_summary':
case 'netflow_top_N':
$netflow_filter = $item['text'];
// Filter.
$period = $item['period'];
@ -6579,6 +6580,16 @@ function chooseType() {
$("#row_historical_db_check").hide();
break;
case 'netflow_top_N':
$("#row_netflow_filter").show();
$("#row_description").show();
$("#row_period").show();
$("#row_max_values").show();
$("#row_resolution").show();
$("#row_servers").show();
$("#row_historical_db_check").hide();
break;
case 'IPAM_network':
$("#row_network_filter").show();
$("#row_alive_ip").show();

2
pandora_console/godmode/reporting/reporting_builder.php
View File

@ -1773,6 +1773,7 @@ switch ($action) {
case 'netflow_area':
case 'netflow_data':
case 'netflow_summary':
case 'netflow_top_N':
$values['text'] = get_parameter(
'netflow_filter'
);
@ -2572,6 +2573,7 @@ switch ($action) {
case 'netflow_area':
case 'netflow_data':
case 'netflow_summary':
case 'netflow_top_N':
$values['text'] = get_parameter(
'netflow_filter'
);

30
pandora_console/include/functions_api.php
View File

@ -13762,7 +13762,7 @@ function api_get_netflow_get_stats($discard_1, $discard_2, $params)
return;
}
// Parse function parameters
// Parse function parameters.
$start_date = $params['data'][0];
$end_date = $params['data'][1];
$filter = json_decode(base64_decode($params['data'][2]), true);
@ -13779,6 +13779,34 @@ function api_get_netflow_get_stats($discard_1, $discard_2, $params)
}
/**
*
* @param $trash1 Don't use.
* @param $trash2 Don't use.
* @param array $params Call parameters.
* @return void
*/
function api_get_netflow_get_top_N($trash1, $trash2, $params)
{
if (is_metaconsole() === true) {
return;
}
// Parse function parameters.
$start_date = $params['data'][0];
$end_date = $params['data'][1];
$filter = json_decode(base64_decode($params['data'][2]), true);
$max = $params['data'][3];
// Get netflow data.
$data = netflow_get_top_N($start_date, $end_date, $filter, $max, '');
returnData('json', $data);
return;
}
// http://localhost/pandora_console/include/api.php?op=get&op2=netflow_get_summary&other=1348562410|1348648810|_base64_encode(json_encode($filter))&other_mode=url_encode_separator_|&apipass=pandora&user=pandora&pass=pandora'
function api_get_netflow_get_summary($discard_1, $discard_2, $params)
{

222
pandora_console/include/functions_netflow.php
View File

@ -321,6 +321,72 @@ function netflow_data_table($data, $start_date, $end_date, $aggregate)
}
/**
* Show a table with netflow top N data.
*
* @param array $data Netflow data.
* @param integer $total_bytes Total bytes count to calculate percent data.
*
* @return string HTML data table.
*/
function netflow_top_n_table(array $data, int $total_bytes)
{
global $nfdump_date_format;
$values = [];
$table = new stdClass();
$table->class = 'w100p';
$table->cellspacing = 0;
$table->data = [];
$table->head = [];
$table->head[0] = '<b>'.__('Source IP').'</b>';
$table->head[1] = '<b>'.__('Destination IP').'</b>';
$table->head[2] = '<b>'.__('Bytes').'</b>';
$table->head[3] = '<b>'.__('% Traffic').'</b>';
$table->head[4] = '<b>'.__('Avg. Throughput').'</b>';
$table->style[0] = 'padding: 4px';
$i = 0;
foreach ($data as $value) {
$table->data[$i][0] = $value['ip_src'];
$table->data[$i][1] = $value['ip_dst'];
$table->data[$i][2] = network_format_bytes($value['bytes']);
$traffic = '-';
if ($total_bytes > 0) {
$traffic = sprintf(
'%.2f',
(($value['bytes'] / $total_bytes) * 100)
);
}
$table->data[$i][3] = $traffic.' %';
$units = [
'bps',
'Kbps',
'Mbps',
'Gbps',
'Tbps',
];
$pow = floor((($value['bps'] > 0) ? log($value['bps']) : 0) / log(1024));
$pow = min($pow, (count($units) - 1));
$value['bps'] /= pow(1024, $pow);
$table->data[$i][4] = round($value['bps'], 2).' '.$units[$pow];
$i++;
}
return html_print_table($table, true);
}
/**
* Show a table with a traffic summary.
*
@ -395,6 +461,73 @@ function netflow_is_net($address)
}
/**
* Returns netflow data for the given period in an array.
*
* @param string $start_date Period start date.
* @param string $end_date Period end date.
* @param array $filter Netflow filter.
* @param integer $max Maximum number of aggregates.
* @param string $connection_name Node name when data is get in meta.
*
* @return array An array with netflow stats.
*/
function netflow_get_top_N(
string $start_date,
string $end_date,
array $filter,
int $max,
string $connection_name=''
) {
global $nfdump_date_format;
// Requesting remote data.
if (is_metaconsole() === true && empty($connection_name) === false) {
$data = metaconsole_call_remote_api(
$connection_name,
'netflow_get_top_N',
$start_date.'|'.$end_date.'|'.base64_encode(json_encode($filter)).'|'.$max
);
return json_decode($data, true);
}
$options = '-o csv -q -n '.$max.' -s record/bps -t '.date($nfdump_date_format, $start_date).'-'.date($nfdump_date_format, $end_date);
$options_bps = '-o csv -q -n '.$max.' -s dstip/bps -t '.date($nfdump_date_format, $start_date).'-'.date($nfdump_date_format, $end_date);
$command = netflow_get_command($options, $filter);
$command_bps = netflow_get_command($options_bps, $filter);
// Execute nfdump.
exec($command, $lines);
exec($command_bps, $lines_bps);
if (is_array($lines) === false || is_array($lines_bps) === false) {
return [];
}
$values = [];
$i = 0;
// Remove first line.
array_shift($lines_bps);
foreach ($lines as $line) {
$parsed_line = explode(',', $line);
$parsed_line_bps = explode(',', $lines_bps[$i]);
$values[$i]['ip_src'] = $parsed_line[3];
$values[$i]['ip_dst'] = $parsed_line[4];
$values[$i]['bytes'] = $parsed_line[12];
$values[$i]['bps'] = $parsed_line_bps[12];
$i++;
}
return $values;
}
/**
* Returns netflow data for the given period in an array.
*
@ -1051,6 +1184,7 @@ function netflow_get_chart_types()
'netflow_area' => __('Area graph'),
'netflow_summary' => __('Summary'),
'netflow_data' => __('Data table'),
'netflow_top_N' => __('Top-N connections'),
'netflow_mesh' => __('Circular mesh'),
'netflow_host_treemap' => __('Host detailed traffic'),
];
@ -1218,6 +1352,54 @@ function netflow_draw_item(
}
break;
case 'netflow_top_N':
$data_summary = netflow_get_summary(
$start_date,
$end_date,
$filter,
$connection_name
);
if (empty($data_summary) === true) {
break;
}
$data_top_n = netflow_get_top_N(
$start_date,
$end_date,
$filter,
$max_aggregates,
$connection_name
);
if (empty($data_top_n) === true) {
break;
}
if ($output === 'HTML' || $output === 'PDF') {
$html = '<table class="w100p">';
$html .= '<tr>';
$html .= "<td class='w50p'>";
$html .= netflow_summary_table($data_summary);
$html .= '</td>';
$html .= '</tr>';
$html .= '<tr>';
$html .= "<td class='w100p'>";
$html .= netflow_top_n_table($data_top_n, $data_summary['totalbytes']);
$html .= '</td>';
$html .= '</tr>';
$html .= '</table>';
return $html;
} else if ($output === 'XML') {
$xml = '<aggregate>'.$aggregate."</aggregate>\n";
$xml .= '<resolution>'.$interval_length."</resolution>\n";
// Same as netflow_aggregate_area_xml.
$xml .= netflow_aggregate_area_xml($data_top_n);
return $xml;
}
break;
case 'netflow_mesh':
$data = netflow_get_relationships_raw_data(
$start_date,
@ -1304,6 +1486,46 @@ function netflow_draw_item(
}
/**
* Get data of a netflow report item.
*
* @param string $start_date Period start date.
* @param string $end_date Period end date.
* @param array $filter Netflow filter.
* @param integer $max_aggregates Maximum number of aggregates.
* @param string $connection_name Node name when data is get in meta.
*
* @return array Netflow item data (summary and top N data).
*/
function netflow_get_item_data(
string $start_date,
string $end_date,
array $filter,
int $max_aggregates,
string $connection_name
) {
$data_summary = netflow_get_summary(
$start_date,
$end_date,
$filter,
$connection_name
);
$data_top_n = netflow_get_top_N(
$start_date,
$end_date,
$filter,
$max_aggregates,
$connection_name
);
return [
'summary' => $data_summary,
'top_n' => $data_top_n,
];
}
/**
* Render an aggregated area chart as an XML.
*

57
pandora_console/include/functions_reporting.php
View File

@ -612,6 +612,18 @@ function reporting_make_reporting_data(
);
break;
case 'netflow_top_N':
$report['contents'][] = reporting_netflow(
$report,
$content,
$type,
$force_width_chart,
$force_height_chart,
'netflow_top_N',
$pdf
);
break;
case 'monitor_report':
$report['contents'][] = reporting_monitor_report(
$report,
@ -1483,7 +1495,7 @@ function reporting_event_top_n(
$return['type'] = 'top_n';
if (empty($content['name'])) {
$content['name'] = __('Top N');
$content['name'] = __('Top-N connections');
}
$return['title'] = $content['name'];
@ -5401,6 +5413,10 @@ function reporting_netflow(
$return['type'] = 'netflow_summary';
break;
case 'netflow_top_N':
$return['type'] = 'netflow_top_N';
break;
default:
$return['type'] = 'unknown';
break;
@ -5420,6 +5436,10 @@ function reporting_netflow(
$content['name'] = __('Netflow Data');
break;
case 'netflow_top_N':
$content['name'] = __('Netflow Top N');
break;
default:
$content['name'] = __('Unknown report');
break;
@ -5459,6 +5479,40 @@ function reporting_netflow(
true
);
if ($type_netflow === 'netflow_top_N') {
// Always aggregate by destination port.
$filter['aggregate'] = 'dstport';
switch ($type) {
case 'dinamic':
case 'static':
$return['chart'] = netflow_draw_item(
($report['datetime'] - $content['period']),
$report['datetime'],
$content['top_n'],
$type_netflow,
$filter,
$content['top_n_value'],
$content['server_name'],
(($pdf === true) ? 'PDF' : 'HTML')
);
break;
case 'data':
$return['data'] = netflow_get_item_data(
($report['datetime'] - $content['period']),
$report['datetime'],
$filter,
$content['top_n_value'],
$content['server_name']
);
break;
default:
// Nothing to do.
break;
}
} else {
switch ($type) {
case 'dinamic':
case 'static':
@ -5480,6 +5534,7 @@ function reporting_netflow(
// Nothing to do.
break;
}
}
$return['subtitle'] = netflow_generate_subtitle_report(
$filter['aggregate'],

1
pandora_console/include/functions_reporting_html.php
View File

@ -326,6 +326,7 @@ function reporting_html_print_report($report, $mini=false, $report_info=1)
case 'netflow_area':
case 'netflow_data':
case 'netflow_summary':
case 'netflow_top_N':
reporting_html_graph($table, $item);
break;

4
pandora_console/include/functions_reports.php
View File

@ -901,6 +901,10 @@ function reports_get_report_types($template=false, $not_editor=false)
'optgroup' => __('Netflow'),
'name' => __('Netflow summary table'),
];
$types['netflow_top_N'] = [
'optgroup' => __('Netflow'),
'name' => __('Netflow top-N connections'),
];
}
if ($config['enterprise_installed'] && $template === false && !is_metaconsole()) {

2
pandora_server/util/pandora_db.pl
View File

@ -318,7 +318,7 @@ sub pandora_purgedb ($$) {
} else {
my @blacklist_types = ("'SLA_services'", "'custom_graph'", "'sql_graph_vbar'", "'sql_graph_hbar'",
"'sql_graph_pie'", "'database_serialized'", "'sql'", "'inventory'", "'inventory_changes'",
"'netflow_area'", "'netflow_data'", "'netflow_summary'");
"'netflow_area'", "'netflow_data'", "'netflow_summary'", "'netflow_top_N'");
my $blacklist_types_str = join(',', @blacklist_types);
# Deleted modules