?
Solved

HoneyD Honeypot Log parseing

Posted on 2013-12-05
5
Medium Priority
?
599 Views
Last Modified: 2014-01-29
Setup a honeypot running BackTrack, it's running HoneyD and we have a decent sized log file that needs parsed.  I found this script:

#!/usr/bin/python
from cymruwhois import Client
import sys

logfile = open('/var/log/honeypot/honeyd.log', 'r')
 source = []
for line in logfile:
    source.append(line.split(' ')[3])

src_country = []
src_count = []
c=Client()

results=c.lookupmany_dict(set(source))

for res in results:
    country = results[res].cc
     try:
        pos = src_country.index( country )
        src_count[pos] += 1
    except:
        src_country.append( country )
        src_count.append( 1 )

for i in range( 0, ( len( src_country ) - 1 ) ):
     sys.stdout.write( "%s:\t%i\n" %( src_country[i], src_count[i] ) )

Open in new window

I'm need to be able to parse the log to throw it into a couple of charts and graphs, this specific script is supposed to use the cymruwhois module out of rubygem to whois the public IP address's and get a count on how many IP's from each country.

When I run the script after installing the module I get the error: ImportError: No module named cymruwhois

This is the first time I've ever dealt with python so I'm open to other languages and other suggestions for solutions to my issue.  I'm thinking I might be missing a mapping of the module library?
0
Comment
Question by:OHarrisNetworks
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 2
  • 2
5 Comments
 
LVL 29

Expert Comment

by:pepr
ID: 39700835
The cymruwhois is not a standard module. This way it is not a part of your Python installation. It must be downloaded probably from here https://pypi.python.org/pypi/cymruwhois and installed. This way the cymruwhois will be placed among the site-packages , and you will be able to import it and to use it.
0
 
LVL 29

Expert Comment

by:MikeOM_DBA
ID: 39701037
On the other hand, if your issue is with the parsing part, perhaps the "tokenizer" in this Parsing algorithm will be usefull.
;)
0
 

Author Comment

by:OHarrisNetworks
ID: 39701099
I will look into both.
0
 

Author Comment

by:OHarrisNetworks
ID: 39701153
I've downloaded the cymruwhois egg, extracted it, within are cymruwhois.py and cymruwhois.py, I've attempted to python cymruwhois.py and it just sits.
0
 
LVL 29

Accepted Solution

by:
pepr earned 2000 total points
ID: 39701952
Well, my answer was rather general, related to the reported bug. I do not know cymruwhois. Peeping to the source, you probably do not need to install it -- just copy it to the same directory where your script is.

If it does not work, do not ask me :) Anyway, when following the example from here http://pythonhosted.org/cymruwhois/api.html, it fails at my computer when doing
>>> r=c.lookup(ip)
Traceback (most recent call last):
  File "<stdin>", line 1, in <module>
  File "cymruwhois.py", line 150, in lookup
    return list(self.lookupmany([ip]))[0]
  File "cymruwhois.py", line 161, in lookupmany
    for rec in self._lookupmany_raw(not_cached):
  File "cymruwhois.py", line 202, in _lookupmany_raw
    self.read_and_discard()
  File "cymruwhois.py", line 109, in read_and_discard
    self.file.read(1024)
  File "C:\Python27\lib\socket.py", line 380, in read
    data = self._sock.recv(left)
socket.error: [Errno 10035] Nonblocking operation of the socket library cannot be finished immediately (... loosely translated from Czech)

Open in new window

But I am trying it on Windows. I hope someone else have some suggestion.
0

Featured Post

What does it mean to be "Always On"?

Is your cloud always on? With an Always On cloud you won't have to worry about downtime for maintenance or software application code updates, ensuring that your bottom line isn't affected.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

The SignAloud Glove is capable of translating American Sign Language signs into text and audio.
This article will show how Aten was able to supply easy management and control for Artear's video walls and wide range display configurations of their newsroom.
In this seventh video of the Xpdf series, we discuss and demonstrate the PDFfonts utility, which lists all the fonts used in a PDF file. It does this via a command line interface, making it suitable for use in programs, scripts, batch files — any pl…
Simple Linear Regression
Suggested Courses

771 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question