Solved

HoneyD Honeypot Log parseing

Posted on 2013-12-05
5
579 Views
Last Modified: 2014-01-29
Setup a honeypot running BackTrack, it's running HoneyD and we have a decent sized log file that needs parsed.  I found this script:

#!/usr/bin/python
from cymruwhois import Client
import sys

logfile = open('/var/log/honeypot/honeyd.log', 'r')
 source = []
for line in logfile:
    source.append(line.split(' ')[3])

src_country = []
src_count = []
c=Client()

results=c.lookupmany_dict(set(source))

for res in results:
    country = results[res].cc
     try:
        pos = src_country.index( country )
        src_count[pos] += 1
    except:
        src_country.append( country )
        src_count.append( 1 )

for i in range( 0, ( len( src_country ) - 1 ) ):
     sys.stdout.write( "%s:\t%i\n" %( src_country[i], src_count[i] ) )

Open in new window

I'm need to be able to parse the log to throw it into a couple of charts and graphs, this specific script is supposed to use the cymruwhois module out of rubygem to whois the public IP address's and get a count on how many IP's from each country.

When I run the script after installing the module I get the error: ImportError: No module named cymruwhois

This is the first time I've ever dealt with python so I'm open to other languages and other suggestions for solutions to my issue.  I'm thinking I might be missing a mapping of the module library?
0
Comment
Question by:OHarrisNetworks
  • 2
  • 2
5 Comments
 
LVL 28

Expert Comment

by:pepr
ID: 39700835
The cymruwhois is not a standard module. This way it is not a part of your Python installation. It must be downloaded probably from here https://pypi.python.org/pypi/cymruwhois and installed. This way the cymruwhois will be placed among the site-packages , and you will be able to import it and to use it.
0
 
LVL 29

Expert Comment

by:MikeOM_DBA
ID: 39701037
On the other hand, if your issue is with the parsing part, perhaps the "tokenizer" in this Parsing algorithm will be usefull.
;)
0
 

Author Comment

by:OHarrisNetworks
ID: 39701099
I will look into both.
0
 

Author Comment

by:OHarrisNetworks
ID: 39701153
I've downloaded the cymruwhois egg, extracted it, within are cymruwhois.py and cymruwhois.py, I've attempted to python cymruwhois.py and it just sits.
0
 
LVL 28

Accepted Solution

by:
pepr earned 500 total points
ID: 39701952
Well, my answer was rather general, related to the reported bug. I do not know cymruwhois. Peeping to the source, you probably do not need to install it -- just copy it to the same directory where your script is.

If it does not work, do not ask me :) Anyway, when following the example from here http://pythonhosted.org/cymruwhois/api.html, it fails at my computer when doing
>>> r=c.lookup(ip)
Traceback (most recent call last):
  File "<stdin>", line 1, in <module>
  File "cymruwhois.py", line 150, in lookup
    return list(self.lookupmany([ip]))[0]
  File "cymruwhois.py", line 161, in lookupmany
    for rec in self._lookupmany_raw(not_cached):
  File "cymruwhois.py", line 202, in _lookupmany_raw
    self.read_and_discard()
  File "cymruwhois.py", line 109, in read_and_discard
    self.file.read(1024)
  File "C:\Python27\lib\socket.py", line 380, in read
    data = self._sock.recv(left)
socket.error: [Errno 10035] Nonblocking operation of the socket library cannot be finished immediately (... loosely translated from Czech)

Open in new window

But I am trying it on Windows. I hope someone else have some suggestion.
0

Featured Post

Master Your Team's Linux and Cloud Stack

Come see why top tech companies like Mailchimp and Media Temple use Linux Academy to build their employee training programs.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

This article is meant to give a basic understanding of how to use R Sweave as a way to merge LaTeX and R code seamlessly into one presentable document.
This article will show, step by step, how to integrate R code into a R Sweave document
In a previous video, we went over how to export a DynamoDB table into Amazon S3.  In this video, we show how to load the export from S3 into a DynamoDB table.
In this fourth video of the Xpdf series, we discuss and demonstrate the PDFinfo utility, which retrieves the contents of a PDF's Info Dictionary, as well as some other information, including the page count. We show how to isolate the page count in a…

825 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question