Solved

HoneyD Honeypot Log parseing

Posted on 2013-12-05
5
571 Views
Last Modified: 2014-01-29
Setup a honeypot running BackTrack, it's running HoneyD and we have a decent sized log file that needs parsed.  I found this script:

#!/usr/bin/python
from cymruwhois import Client
import sys

logfile = open('/var/log/honeypot/honeyd.log', 'r')
 source = []
for line in logfile:
    source.append(line.split(' ')[3])

src_country = []
src_count = []
c=Client()

results=c.lookupmany_dict(set(source))

for res in results:
    country = results[res].cc
     try:
        pos = src_country.index( country )
        src_count[pos] += 1
    except:
        src_country.append( country )
        src_count.append( 1 )

for i in range( 0, ( len( src_country ) - 1 ) ):
     sys.stdout.write( "%s:\t%i\n" %( src_country[i], src_count[i] ) )

Open in new window

I'm need to be able to parse the log to throw it into a couple of charts and graphs, this specific script is supposed to use the cymruwhois module out of rubygem to whois the public IP address's and get a count on how many IP's from each country.

When I run the script after installing the module I get the error: ImportError: No module named cymruwhois

This is the first time I've ever dealt with python so I'm open to other languages and other suggestions for solutions to my issue.  I'm thinking I might be missing a mapping of the module library?
0
Comment
Question by:OHarrisNetworks
  • 2
  • 2
5 Comments
 
LVL 28

Expert Comment

by:pepr
Comment Utility
The cymruwhois is not a standard module. This way it is not a part of your Python installation. It must be downloaded probably from here https://pypi.python.org/pypi/cymruwhois and installed. This way the cymruwhois will be placed among the site-packages , and you will be able to import it and to use it.
0
 
LVL 29

Expert Comment

by:MikeOM_DBA
Comment Utility
On the other hand, if your issue is with the parsing part, perhaps the "tokenizer" in this Parsing algorithm will be usefull.
;)
0
 

Author Comment

by:OHarrisNetworks
Comment Utility
I will look into both.
0
 

Author Comment

by:OHarrisNetworks
Comment Utility
I've downloaded the cymruwhois egg, extracted it, within are cymruwhois.py and cymruwhois.py, I've attempted to python cymruwhois.py and it just sits.
0
 
LVL 28

Accepted Solution

by:
pepr earned 500 total points
Comment Utility
Well, my answer was rather general, related to the reported bug. I do not know cymruwhois. Peeping to the source, you probably do not need to install it -- just copy it to the same directory where your script is.

If it does not work, do not ask me :) Anyway, when following the example from here http://pythonhosted.org/cymruwhois/api.html, it fails at my computer when doing
>>> r=c.lookup(ip)
Traceback (most recent call last):
  File "<stdin>", line 1, in <module>
  File "cymruwhois.py", line 150, in lookup
    return list(self.lookupmany([ip]))[0]
  File "cymruwhois.py", line 161, in lookupmany
    for rec in self._lookupmany_raw(not_cached):
  File "cymruwhois.py", line 202, in _lookupmany_raw
    self.read_and_discard()
  File "cymruwhois.py", line 109, in read_and_discard
    self.file.read(1024)
  File "C:\Python27\lib\socket.py", line 380, in read
    data = self._sock.recv(left)
socket.error: [Errno 10035] Nonblocking operation of the socket library cannot be finished immediately (... loosely translated from Czech)

Open in new window

But I am trying it on Windows. I hope someone else have some suggestion.
0

Featured Post

What Security Threats Are You Missing?

Enhance your security with threat intelligence from the web. Get trending threat insights on hackers, exploits, and suspicious IP addresses delivered to your inbox with our free Cyber Daily.

Join & Write a Comment

Suggested Solutions

Go is an acronym of golang, is a programming language developed Google in 2007. Go is a new language that is mostly in the C family, with significant input from Pascal/Modula/Oberon family. Hence Go arisen as low-level language with fast compilation…
This is about my first experience with programming Arduino.
Learn the basics of strings in Python: declaration, operations, indices, and slicing. Strings are declared with quotations; for example: s = "string": Strings are immutable.: Strings may be concatenated or multiplied using the addition and multiplic…
In a previous video, we went over how to export a DynamoDB table into Amazon S3.  In this video, we show how to load the export from S3 into a DynamoDB table.

771 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

15 Experts available now in Live!

Get 1:1 Help Now