mirror of
https://github.com/ntop/ntopng.git
synced 2026-04-28 15:09:33 +00:00
284 lines
11 KiB
C++
284 lines
11 KiB
C++
/*
|
|
*
|
|
* (C) 2013-25 - ntop.org
|
|
*
|
|
*
|
|
* This program is free software; you can redistribute it and/or modify
|
|
* it under the terms of the GNU General Public License as published by
|
|
* the Free Software Foundation; either version 3 of the License, or
|
|
* (at your option) any later version.
|
|
*
|
|
* This program is distributed in the hope that it will be useful,
|
|
* but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
|
* GNU General Public License for more details.
|
|
*
|
|
* You should have received a copy of the GNU General Public License
|
|
* along with this program; if not, write to the Free Software Foundation,
|
|
* Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
|
|
*
|
|
*/
|
|
|
|
#ifndef _HOST_STATS_H_
|
|
#define _HOST_STATS_H_
|
|
|
|
class Host;
|
|
|
|
class HostStats : public GenericTrafficElement {
|
|
protected:
|
|
Host *host;
|
|
|
|
u_int8_t client_flows_anomaly : 1, server_flows_anomaly : 1,
|
|
client_score_anomaly : 1, server_score_anomaly : 1, _notused : 4;
|
|
u_int32_t total_alerts;
|
|
u_int32_t unreachable_flows_as_client, unreachable_flows_as_server;
|
|
/* Used concurrently in view interfaces, possibly removed after
|
|
* https://github.com/ntop/ntopng/issues/4596 */
|
|
u_int32_t alerted_flows_as_client, alerted_flows_as_server;
|
|
u_int32_t host_unreachable_flows_as_client, host_unreachable_flows_as_server;
|
|
u_int32_t total_num_flows_as_client, total_num_flows_as_server;
|
|
u_int32_t num_flow_alerts;
|
|
u_int64_t udp_sent_unicast, udp_sent_non_unicast;
|
|
L4Stats l4stats;
|
|
|
|
u_int8_t consecutive_high_score;
|
|
time_t periodicUpdate, periodic_stats_update;
|
|
|
|
/* *************************************** */
|
|
/* Behavioural analysis regarding the host */
|
|
DESCounter active_flows_srv, active_flows_cli, score_cli, score_srv;
|
|
|
|
/* **************************************** */
|
|
|
|
/* Written by NetworkInterface::periodicStatsUpdate thread */
|
|
// NOTE: GenericTrafficElement inherited data is updated periodically too
|
|
u_int32_t total_activity_time /* sec */;
|
|
u_int32_t last_epoch_update; /* useful to avoid multiple updates */
|
|
|
|
#ifdef NTOPNG_PRO
|
|
HostPoolStats *quota_enforcement_stats, *quota_enforcement_stats_shadow;
|
|
#endif
|
|
|
|
/* Written by NetworkInterface::processPacket thread */
|
|
PacketStats sent_stats, recv_stats;
|
|
|
|
/* Used to store checkpoint data to build top talkers stats */
|
|
struct {
|
|
u_int64_t sent_bytes;
|
|
u_int64_t rcvd_bytes;
|
|
} checkpoints;
|
|
|
|
public:
|
|
HostStats(Host *_host);
|
|
virtual ~HostStats();
|
|
|
|
virtual void incStats(time_t when, u_int8_t l4_proto, u_int ndpi_proto,
|
|
ndpi_protocol_category_t ndpi_category,
|
|
custom_app_t custom_app, u_int64_t sent_packets,
|
|
u_int64_t sent_bytes, u_int64_t sent_goodput_bytes,
|
|
u_int64_t rcvd_packets, u_int64_t rcvd_bytes,
|
|
u_int64_t rcvd_goodput_bytes, bool peer_is_unicast);
|
|
void checkpoint(lua_State *vm);
|
|
virtual void getJSONObject(json_object *my_object,
|
|
DetailsLevel details_level);
|
|
inline void incFlagStats(bool as_client, u_int8_t flags,
|
|
bool cumulative_flags) {
|
|
if (as_client)
|
|
sent_stats.incFlagStats(flags, cumulative_flags);
|
|
else
|
|
recv_stats.incFlagStats(flags, cumulative_flags);
|
|
};
|
|
|
|
virtual void computeAnomalyIndex(time_t when){};
|
|
virtual u_int32_t getResetFlow() { return(0); };
|
|
virtual void incResetFlow() {};
|
|
inline Host *getHost() const { return (host); }
|
|
inline void incNumAlertedFlows(bool as_client) {
|
|
if (as_client)
|
|
alerted_flows_as_client++;
|
|
else
|
|
alerted_flows_as_server++;
|
|
};
|
|
inline void incNumUnreachableFlows(bool as_server) {
|
|
if (as_server)
|
|
unreachable_flows_as_server++;
|
|
else
|
|
unreachable_flows_as_client++;
|
|
}
|
|
inline void incNumHostUnreachableFlows(bool as_server) {
|
|
if (as_server)
|
|
host_unreachable_flows_as_server++;
|
|
else
|
|
host_unreachable_flows_as_client++;
|
|
};
|
|
inline void incNumFlowAlerts() { num_flow_alerts++; };
|
|
inline void incTotalAlerts() { total_alerts++; };
|
|
inline u_int32_t getTotalAlertedNumFlowsAsClient() const {
|
|
return (alerted_flows_as_client);
|
|
};
|
|
inline u_int32_t getTotalAlertedNumFlowsAsServer() const {
|
|
return (alerted_flows_as_server);
|
|
};
|
|
inline u_int32_t getTotalUnreachableNumFlowsAsClient() const {
|
|
return (unreachable_flows_as_client);
|
|
};
|
|
inline u_int32_t getTotalUnreachableNumFlowsAsServer() const {
|
|
return (unreachable_flows_as_server);
|
|
};
|
|
inline u_int32_t getTotalHostUnreachableNumFlowsAsClient() const {
|
|
return (host_unreachable_flows_as_client);
|
|
};
|
|
inline u_int32_t getTotalHostUnreachableNumFlowsAsServer() const {
|
|
return (host_unreachable_flows_as_server);
|
|
};
|
|
u_int32_t getTotalAlerts() const { return (total_alerts); };
|
|
inline u_int32_t getNumFlowAlerts() const { return (num_flow_alerts); };
|
|
void luaNdpiStats(lua_State *vm);
|
|
void luaActiveFlowsBehaviour(lua_State *vm);
|
|
void luaScoreBehaviour(lua_State *vm);
|
|
void luaStats(lua_State *vm, NetworkInterface *iface, bool host_details,
|
|
bool verbose, bool tsLua = false);
|
|
virtual u_int16_t getNumActiveContactsAsClient() { return 0; }
|
|
virtual u_int16_t getNumActiveContactsAsServer() { return 0; }
|
|
virtual void resetTopSitesData(){};
|
|
virtual void addContactedDomainName(char *domain_name) {}
|
|
virtual u_int32_t getDomainNamesCardinality() { return (u_int32_t)-1; }
|
|
virtual void resetDomainNamesCardinality() {}
|
|
|
|
inline void incSentStats(u_int num_pkts, u_int pkt_len) {
|
|
sent_stats.incStats(num_pkts, pkt_len);
|
|
};
|
|
inline void incRecvStats(u_int num_pkts, u_int pkt_len) {
|
|
recv_stats.incStats(num_pkts, pkt_len);
|
|
};
|
|
inline void incnDPIFlows(u_int16_t l7_protocol) {
|
|
if (ndpiStats) ndpiStats->incFlowsStats(l7_protocol);
|
|
};
|
|
inline void incrConsecutiveHighScore() { consecutive_high_score++; };
|
|
inline void resetConsecutiveHighScore() { consecutive_high_score = 0; };
|
|
inline u_int8_t getConsecutiveHighScore() {
|
|
return (consecutive_high_score);
|
|
};
|
|
inline u_int32_t getTotalNumFlowsAsClient() const {
|
|
return (total_num_flows_as_client);
|
|
};
|
|
inline u_int32_t getTotalNumFlowsAsServer() const {
|
|
return (total_num_flows_as_server);
|
|
};
|
|
inline u_int32_t getTotalActivityTime() const {
|
|
return (total_activity_time);
|
|
};
|
|
virtual void incNumFlows(bool as_client) {
|
|
if (as_client)
|
|
total_num_flows_as_client++;
|
|
else
|
|
total_num_flows_as_server++;
|
|
};
|
|
|
|
virtual bool hasAnomalies(time_t when) { return false; };
|
|
virtual void luaAnomalies(lua_State *vm, time_t when){};
|
|
virtual void luaPeers(lua_State *vm){};
|
|
virtual void lua(lua_State *vm, bool mask_host, DetailsLevel details_level);
|
|
void updateStats(const struct timeval *tv);
|
|
virtual void luaHostBehaviour(lua_State *vm);
|
|
#ifdef NTOPNG_PRO
|
|
inline void incQuotaEnforcementStats(time_t when, u_int16_t ndpi_proto,
|
|
u_int64_t sent_packets,
|
|
u_int64_t sent_bytes,
|
|
u_int64_t rcvd_packets,
|
|
u_int64_t rcvd_bytes) {
|
|
if (quota_enforcement_stats)
|
|
quota_enforcement_stats->incStats(when, ndpi_proto, sent_packets,
|
|
sent_bytes, rcvd_packets, rcvd_bytes);
|
|
};
|
|
inline void incQuotaEnforcementCategoryStats(
|
|
time_t when, ndpi_protocol_category_t category_id, u_int64_t sent_bytes,
|
|
u_int64_t rcvd_bytes) {
|
|
if (quota_enforcement_stats)
|
|
quota_enforcement_stats->incCategoryStats(when, category_id, sent_bytes,
|
|
rcvd_bytes);
|
|
}
|
|
inline void resetQuotaStats() {
|
|
if (quota_enforcement_stats) quota_enforcement_stats->resetStats();
|
|
};
|
|
|
|
void allocateQuotaEnforcementStats();
|
|
void deleteQuotaEnforcementStats();
|
|
inline HostPoolStats *getQuotaEnforcementStats() {
|
|
return (quota_enforcement_stats);
|
|
}
|
|
#endif
|
|
|
|
virtual void luaHTTP(lua_State *vm) {}
|
|
virtual void luaDNS(lua_State *vm, bool verbose) {}
|
|
virtual void luaICMP(lua_State *vm, bool isV4, bool verbose) {}
|
|
virtual void incrVisitedWebSite(char *hostname) {}
|
|
virtual HTTPstats *getHTTPstats() { return (NULL); }
|
|
virtual DnsStats *getDNSstats() { return (NULL); }
|
|
virtual ICMPstats *getICMPstats() { return (NULL); }
|
|
|
|
virtual void incCliContactedPorts(u_int16_t port) { ; }
|
|
virtual void incSrvPortsContacts(u_int16_t port) { ; }
|
|
virtual void incContactedService(char *name) { ; }
|
|
virtual void incCliContactedHosts(IpAddress *peer) { ; }
|
|
virtual void incSrvHostContacts(IpAddress *peer) { ; }
|
|
virtual void incContactedHosts(char *hostname) { ; }
|
|
virtual void incCountriesContacts(char *country) { ; }
|
|
|
|
virtual void resetCountriesContacts() { ; }
|
|
virtual void resetContactedHosts() { ; }
|
|
|
|
virtual u_int16_t getCountriesContactsCardinality() {
|
|
return ((u_int16_t)-1);
|
|
}
|
|
virtual u_int16_t getContactedHostsCardinality() { return ((u_int16_t)-1); }
|
|
|
|
virtual u_int32_t getNTPContactCardinality() { return ((u_int32_t)-1); }
|
|
virtual u_int32_t getDNSContactCardinality() { return ((u_int32_t)-1); }
|
|
virtual u_int32_t getSMTPContactCardinality() { return ((u_int32_t)-1); }
|
|
virtual u_int32_t getIMAPContactCardinality() { return ((u_int32_t)-1); }
|
|
virtual u_int32_t getPOPContactCardinality() { return ((u_int32_t)-1); }
|
|
|
|
virtual bool incNTPContactCardinality(Host *h) { return (false); }
|
|
virtual bool incDNSContactCardinality(Host *h) { return (false); }
|
|
virtual bool incSMTPContactCardinality(Host *h) { return (false); }
|
|
virtual bool incIMAPContactCardinality(Host *h) { return (false); }
|
|
virtual bool incPOPContactCardinality(Host *h) { return (false); }
|
|
|
|
inline bool has_flows_anomaly(bool as_client) {
|
|
return (as_client ? client_flows_anomaly : server_flows_anomaly);
|
|
}
|
|
inline u_int64_t value_flows_anomaly(bool as_client) {
|
|
return (as_client ? active_flows_cli.getLastValue()
|
|
: active_flows_srv.getLastValue());
|
|
}
|
|
inline u_int64_t lower_bound_flows_anomaly(bool as_client) {
|
|
return (as_client ? active_flows_cli.getLastLowerBound()
|
|
: active_flows_srv.getLastLowerBound());
|
|
}
|
|
inline u_int64_t upper_bound_flows_anomaly(bool as_client) {
|
|
return (as_client ? active_flows_cli.getLastUpperBound()
|
|
: active_flows_srv.getLastUpperBound());
|
|
}
|
|
|
|
inline bool has_score_anomaly(bool as_client) {
|
|
return (as_client ? client_score_anomaly : server_score_anomaly);
|
|
}
|
|
inline u_int64_t lower_bound_score_anomaly(bool as_client) {
|
|
return (as_client ? score_cli.getLastLowerBound()
|
|
: score_srv.getLastLowerBound());
|
|
}
|
|
inline u_int64_t upper_bound_score_anomaly(bool as_client) {
|
|
return (as_client ? score_cli.getLastUpperBound()
|
|
: score_srv.getLastUpperBound());
|
|
}
|
|
|
|
inline PacketStats *getSentStats() { return (&sent_stats); }
|
|
inline PacketStats *getRecvStats() { return (&recv_stats); }
|
|
inline L4Stats *getL4Stats() { return (&l4stats); }
|
|
inline bool isReceiveOnly() {
|
|
return ((getNumPktsSent() > 0) ? false : true);
|
|
}
|
|
};
|
|
|
|
#endif
|