4 commits

Author	SHA1	Message	Date
Dominik Pataky	61439ec6ef	Improve analyzer (handling of pairs, dropping noise) ... Previously, the analyzer assumed that two consecutive flows would be a pair. This proved unreliable, therefore a new comparison algorithm is ussed. It utilizes the IP addresses and the 'first_switched' parameter to identify two flows of the same connection. More improvements can be done, especially filtering and in the identification of the initiating peer. Tests still fail, have to be adapted to the new dicts and gzip.	2019-11-03 15:58:40 +01:00
Dominik Pataky	1646a52f17	Store IP addresses (v4 + v6) as strings rather than ints ... As mentioned by @pR0Ps in 6b9d20c8a6/analyze_json.py (L83) IP addresses, especially in IPv6, should better be stored as parsed strings instead of their raw integer values. Implemented.	2019-11-03 13:35:32 +01:00
Carey Metcalfe	96817f1f8d	Add support for v1 and v5 NetFlow packets ... Thanks to @alieissa for the initial v1 and v5 code	2019-10-16 23:46:32 -04:00
Carey Metcalfe	ef151f8d28	Improve collector script and restructure code ... - Moved the netflow library out of the src directory - The UDP listener was restructured so that multiple threads can receive packets and push them into a queue. The main thread then pulls the packets off the queue one at a time and processes them. This means that the collector will never drop a packet because it was blocked on processing the previous one. - Adds a property to the ExportPacket class to expose if any new templates are contained in it. - The collector will now only retry parsing past packets when a new template is found. Also refactored the retry logic a bit to remove duplicate code (retrying just pushes the packets back into the main queue to be processed again like all the other packets). - The collector no longer continually reads and writes to/from the disk. It just caches the data in memory until it exits instead.	2019-10-16 23:31:39 -04:00

Renamed from src/netflow/collector_v9.py (Browse further)