[Autogenerated] Next let's take a look at our second script
where instead of focusing on the spawning behavior of the
specific processes running on a system,
we're going to be taking a look at how these different
processes that exist on a machine are using the network and
how much traffic they are using.
And the way that this script is built is it's going to monitor for all of the
different connections that exist on a machine and it's going to list on the
screen what traffic they're sending or receiving and then keeps up a tally of
the total amount of bites in and out and a indication of what its current
upload and download speed is.
So to start, we are importing a number of different modules.
The two that I noted in the earlier introduction was the collections and
threading modules where we're only using the thread and default dictionary type
as additional ones that we haven't seen informal modules.
And we are also using the scrappy module because that
is the core of this specific script.
So the first thing that we do to sort of set some of the root
variables that we're going to use throughout,
we set a variable that contains all of the Mac
addresses that exist on the local machine.
We create a connection to P i D a p i D to traffic variable,
as well as a running and network stats variables.
So the main part of this script will start here at the
bottom where we run the main function again.
And the first thing we do is we spawn off two different threads.
The first one running the prints stats function off on its own thread.
And the second one that runs the get connections
function off of in its own thread.
So what do these two do?
Let's start with get connections.
And what this does is it watches for the network connections
as far as coming from the ps util module.
It puts them into a four loop and then it builds a dictionary of the
source and destination ports of these active connections.
So why would we want this?
What this allows us to do?
Is it links together a specific pair of source and
destination ports with a specific process I.
D.
And this allows us to do the map between a specific connection.
Any specific process.
This by itself is not provided by the PS util module.
Next we have the print stats module which is this short little thing here.
And what this is used to do is this is what actually displays
the information we're collecting onto the screen and it
throws it off into its own process.
So it doesn't affect the operation of the information
gathering that's going on continuously.
So if we go to the print P.
I.
D.
To traffic function,
you'll see what we're doing here is we're again using the
Pretty Table module to display this stuff,
we are setting the headers to these.
So process, name, upload, download, upload speed and so on.
I just happen to be using Pretty table, you can use other ones.
So what we're going to do is we're going to iterate
through this PID to traffic variable.
But what is the pit to traffic variable?
We can't really go that much further because we don't know what that's from,
but we see we're going to use the P I.
D and the traffic from that variable.
So let's go look and see where we got that from.
We go down here to the bottom,
we will see that once we pull off these two threads,
the next thing we do is we create a filter list based on the Mac
addresses that exist on the local machine.
Then here's where we're using Skopje.
We run this cappy sniff command and this little Prn process packet.
What this means is for every packet that sniffed by scrappy,
run the process packet function,
do that with the filter list that we just created and then we're not storing it.
So we're not displaying this data after the fact.
So for every packet it's going to run the process packet function.
So we need to go look at the process packet function to keep in mind that this
runs for every single packet that comes into this script.
The first thing we're doing is here's that PID to traffic variable
that we were referencing in the print function.
And what this does.
The first thing it does is it collects the source and
destination ports that exists for that packet,
if it exists, if it doesn't exist,
it's automatically going to pass through and it does that
because if this is not a UDP or TCP packet,
it's not going to have a source or destination ports
and it's going to throw an air,
so basically any traffic that's not TCP or UdP is going to pass through here
and the back is going to have no further execution on it,
assuming it is a TCP or UdP packet, then this logic follows.
And the first thing it's gonna do is it's going to
rain that connection to P I D.
Is there a entry in there for an active connection that
exists for a process on this machine?
If it does, it's going to return that process I.
D.
And then if that process IDE exists,
then it's going to take the source address of it.
In this case the source is the mac address,
not the IP address if that's mac addresses in our local MAC address So is
the source of the traffic coming from this local machine?
If it is then that means we are sending out traffic.
So what that does is it automatically adds the length of that packet to
the predict to traffic variable Into this zero Index.
So that's everything that's uploading and if the source is not in the
local max database then it's a download and in doing that it will do the
length again and we'll add it to that one.
So the zero index is for uploads and the one index is for downloads.
So in total the pit to traffic variable holds an individual list by process I.
D.
Of the traffic going up and down from this local machine.
Now we can return down to our logic here inside that.
Print to traffic function.
So we now know what the pit to traffic variable includes which is
the process site of mapping of the process I.
D.
And then a collection of the traffic both upload and download.
That comes for each one of those first thing we're going to do is we're
going to grab a process variable based on that process I.
D.
If it exists now still then we'll continue.
If not we will just jump out of the logic,
we grab the name of the process and then we move into this logic and
let's move up a little bit so we can take a look at all this and what
this part of the logic does as this will be building that pretty table
that we had referenced earlier and each one of the entries will be
based on the process I.
D.
Of one of the entries that we have in the in both the different
tables that we referenced and what we're doing here.
If P.
I.
D.
Exists in the network stats and what network stats is is network stats
is it's used for the upload and download speeds,
variables.
And net stats in this case would be what was the last entry of traffic?
So we have the amount of traffic as of right now.
And what was the traffic as of the last iteration of this loop.
And we can compare those two to figure out what the traffic
speed is for each one of the processes.
If we have values in that, that means that we have seen it before,
and we are going to be subtracting the current traffic
from the former traffic as we see here.
And in doing that, we can calculate the speed.
If we have not seen it before, then we're going to come into this else,
and we are just going to be printing out just zeros until we get started.
So until we see it before.
Once we'll just print zeroes in for the process traffic speed variables.
Now, the second part here,
this is just populating that network stats variable for the
next iteration of this specific logic.
So that feeds into this for the next loop.
And then what we do is we display this table here,
we clear the screen like we did previously in another script.
We showed we sort it by processed name, and then we display the table.
So what does all this look like whenever we all wrap it up here.
So, as of right this second,
it's it's only going to be showing processes that
it's going to see traffic from.
So if there's a connection that exists but it doesn't see any traffic from it.
Right this second,
this is going to be an empty list until it starts to see traffic from it.
What's it seen at least once.
It's going to display into this table until it sees that process drop out
of being currently run this table as it sits right now,
as based on this script is updating every second.
And in this case you'll see there are two open connections that exist for
the code executable for two different process I D s There hasn't been a
whole bunch of traffic that's gone out on them.
And currently they're not uploading or downloading anything.
So why would you want to use this from a security standpoint.
From a security standpoint.
Obviously one of the focuses of this module was focusing on
which processes are downloading unexpectedly.
And in this case we didn't only cover download.
We also covered upload.
So if you wanted to monitor for all of the different processes that are
currently sending or receiving traffic using UdP or TCP,
you could simply run this script and just monitor the display on your screen.
You can also extend on this capability instead of
simply showing it on a on a cli screen,
you can have it fire off a notification to you.
If it sees traffic from a specific process or a list of processes.
For example,
you could compile a list of all the current low bins that
you wanted to specifically monitor.
And you could say,
okay if you see any of these guys uploading downloading traffic,
especially if they are ones that aren't normally uploading and downloading
traffic automatically send an alert to you so you're aware.
And so it focuses your attention on processes that
aren't working as they should.
And with that, that finishes up our demonstration for this module.