Solved

HoneyD Honeypot Log parseing

Posted on 2013-12-05
5
575 Views
Last Modified: 2014-01-29
Setup a honeypot running BackTrack, it's running HoneyD and we have a decent sized log file that needs parsed.  I found this script:

#!/usr/bin/python
from cymruwhois import Client
import sys

logfile = open('/var/log/honeypot/honeyd.log', 'r')
 source = []
for line in logfile:
    source.append(line.split(' ')[3])

src_country = []
src_count = []
c=Client()

results=c.lookupmany_dict(set(source))

for res in results:
    country = results[res].cc
     try:
        pos = src_country.index( country )
        src_count[pos] += 1
    except:
        src_country.append( country )
        src_count.append( 1 )

for i in range( 0, ( len( src_country ) - 1 ) ):
     sys.stdout.write( "%s:\t%i\n" %( src_country[i], src_count[i] ) )

Open in new window

I'm need to be able to parse the log to throw it into a couple of charts and graphs, this specific script is supposed to use the cymruwhois module out of rubygem to whois the public IP address's and get a count on how many IP's from each country.

When I run the script after installing the module I get the error: ImportError: No module named cymruwhois

This is the first time I've ever dealt with python so I'm open to other languages and other suggestions for solutions to my issue.  I'm thinking I might be missing a mapping of the module library?
0
Comment
Question by:OHarrisNetworks
  • 2
  • 2
5 Comments
 
LVL 28

Expert Comment

by:pepr
ID: 39700835
The cymruwhois is not a standard module. This way it is not a part of your Python installation. It must be downloaded probably from here https://pypi.python.org/pypi/cymruwhois and installed. This way the cymruwhois will be placed among the site-packages , and you will be able to import it and to use it.
0
 
LVL 29

Expert Comment

by:MikeOM_DBA
ID: 39701037
On the other hand, if your issue is with the parsing part, perhaps the "tokenizer" in this Parsing algorithm will be usefull.
;)
0
 

Author Comment

by:OHarrisNetworks
ID: 39701099
I will look into both.
0
 

Author Comment

by:OHarrisNetworks
ID: 39701153
I've downloaded the cymruwhois egg, extracted it, within are cymruwhois.py and cymruwhois.py, I've attempted to python cymruwhois.py and it just sits.
0
 
LVL 28

Accepted Solution

by:
pepr earned 500 total points
ID: 39701952
Well, my answer was rather general, related to the reported bug. I do not know cymruwhois. Peeping to the source, you probably do not need to install it -- just copy it to the same directory where your script is.

If it does not work, do not ask me :) Anyway, when following the example from here http://pythonhosted.org/cymruwhois/api.html, it fails at my computer when doing
>>> r=c.lookup(ip)
Traceback (most recent call last):
  File "<stdin>", line 1, in <module>
  File "cymruwhois.py", line 150, in lookup
    return list(self.lookupmany([ip]))[0]
  File "cymruwhois.py", line 161, in lookupmany
    for rec in self._lookupmany_raw(not_cached):
  File "cymruwhois.py", line 202, in _lookupmany_raw
    self.read_and_discard()
  File "cymruwhois.py", line 109, in read_and_discard
    self.file.read(1024)
  File "C:\Python27\lib\socket.py", line 380, in read
    data = self._sock.recv(left)
socket.error: [Errno 10035] Nonblocking operation of the socket library cannot be finished immediately (... loosely translated from Czech)

Open in new window

But I am trying it on Windows. I hope someone else have some suggestion.
0

Featured Post

Is Your Active Directory as Secure as You Think?

More than 75% of all records are compromised because of the loss or theft of a privileged credential. Experts have been exploring Active Directory infrastructure to identify key threats and establish best practices for keeping data safe. Attend this month’s webinar to learn more.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

Title # Comments Views Activity
Python Regex Problem 24 123
How to clone solaris 10 machine 33 111
BASH script to modify crontab? 3 49
Rubik's Cube Code for Effective Presentation 3 40
A short article about a problem I had getting the GPS LocationListener working.
This is about my first experience with programming Arduino.
Viewers will learn how to properly install Eclipse with the necessary JDK, and will take a look at an introductory Java program. Download Eclipse installation zip file: Extract files from zip file: Download and install JDK 8: Open Eclipse and …
In this fifth video of the Xpdf series, we discuss and demonstrate the PDFdetach utility, which is able to list and, more importantly, extract attachments that are embedded in PDF files. It does this via a command line interface, making it suitable …

914 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

18 Experts available now in Live!

Get 1:1 Help Now