Your IP : 216.73.216.246


Current Path : /proc/self/root/opt/sharedrads/__pycache__/
Upload File :
Current File : //proc/self/root/opt/sharedrads/__pycache__/show-conns-adv.cpython-313.pyc

�

��}j����V�SSKrSSKrSSKrSSKrSSKrSSKrSSKrSSKJr SSK	J	r	 SSK
JrJr SSK
Jr SSKJr \R""S5r1SkrS	1rS
rSrSrS
rSrSS1rSrSrSrSr1SkrSr Sr!Sr"Sr#"SS5r$"SS5r%\&S:Xa\%"5RO5 gg)�N��defaultdict)�datetime)�
ip_address�
ip_network)�PrettyTable)�color�ss>�*�::�::1�[::]�	127.0.0.1r������
�d�SYN-RECV�SYNRECV���,>�@��"� g�?))�sshd�ssh)�exim�smtp)�dovecot�imap)�pop3r$)�httpd�http)�apache2r&)�nginxr&)�	litespeedr&)�
openlitespeedr&)�cpsrvd�cpanel)�cwpsrv�	cwp_admin)z	pure-ftpd�ftp)�proftpdr/)�mysqld�mysql)�mariadbdr2)�named�dns)�pdns_serverr5c���[RRS5(ag[RRS5=(d [RRS5$)Nz/usr/local/cpanel/cpanelFz/usr/local/cwpsrvz/opt/cwprads)�os�path�isfile�isdir���!/opt/sharedrads/show-conns-adv.py�
is_cwp_serverr?7s?��	�w�w�~�~�0�1�1��
�7�7�=�=�,�-�N������~�1N�Nr=c�D�1Skn[5(aUSS1-$USS1-$)N>r/rr#r$r!r2�webmail�cwp_userr.r,�whm)r?)�servicess r>�auth_attack_servicesrE=s.��I�H�����:�{�3�3�3��x��'�'�'r=c�\�\rSrSrSrSrS\S\S\4SjrS\S\S\	4Sjr
S\S\4S	jrS
r
g)�ServiceRegistry�DzMaps services to ports.c�z�[5(aSupOSupXlX lSSS/SSS/S	S
S/S/S
QSSS/SSS/USS/USS/SSS/SS/0
S/S/S.S .Ul00S .UlURR5H9up4UR5H upVUHnUURUU'M M" M; g)!N)rBr.)r,rCr&�Pi�r#�i�r$�ni�r!)�i�iKr/��r�i�i"i#i&i'rAi/i0r2i��5�{)r5�ntp��tcp�udp)r?�
panel_user�panel_adminrD�port_to_service_name_map�items)�selfrWrX�protocol�service_to_ports_map�service_name�	port_list�port_numbers        r>�__init__�ServiceRegistry.__init__Gs���?�?�&=�#�J��&5�#�J�$��&����S�	���c�
���c�
�����B�x���D�z��T�4�L��d�D�\��D�$�<��$����4���.�
��
�13�2�(>��%�.2�m�m�.A�.A�.C�*�H�+?�+E�+E�+G�'��#,�K�%��1�1�(�;�#��$-�,H�/Dr=r`r\�returnc�Z�URRU05RUS5$)N�other�rY�get�r[r`r\s   r>�get_service_name� ServiceRegistry.get_service_namefs-���,�,�0�0��2�>�B�B���
�	
r=c�>�XRRU05;$�Nrfrhs   r>�is_tracked_port�ServiceRegistry.is_tracked_portls���;�;�?�?��"�M�M�Mr=c�h�[URRU05R55$rl)�setrYrg�keys)r[r\s  r>�
get_all_ports�ServiceRegistry.get_all_portsps)���4�0�0�4�4�X�r�B�G�G�I�J�Jr=)rXrWrYrDN)�__name__�
__module__�__qualname__�__firstlineno__�__doc__ra�int�strri�boolrmrprr�__static_attributes__r<r=r>rGrGDsX��!�%�>
�C�
�3�
�3�
�N�3�N�#�N�$�N�K�c�K�c�Kr=rGc��\rSrSrSrSr\S5rSrSr	Sr
SrS	rS
r
SrSrS
rSrSrSrSrSrSrSrSrSr\S5r\S5rSASjrSrSrSr\S5r \S5r!\S 5r"S!r#SBS"jr$SCS#jr%S$r&S%r'SDS&jr(S'r)S(r*S)r+S*r,S+r-S,r.S-r/S.r0SES/jr1\24S0jr3\S15r4S2r5S3r6SFS4jr7\S55r8SGS6jr9SGS7jr:SGS8jr;SHS9jr<S:r=S;r>S<r?\S=5r@S>rAS?rBS@rCg)I�ConnectionReporter�tzManages connection reporting.c��[5UlUR5Ul[	5[	5S.Ul[	5Ul[	5UlSUl[S5Ul
[S5Ul[S5Ul[S5Ul
0Ul/Ul[	5[	5S.Ul0UlUR%5UlUR)5 UR+5 g)NrTFc� �[[5$rl�rryr<r=r>�<lambda>�-ConnectionReporter.__init__.<locals>.<lambda>~�	��;�s�;Kr=c� �[[5$rlr�r<r=r>r�r�r�r=c� �[[5$rlr�r<r=r>r�r���	��k�#�6Fr=c� �[[5$rlr�r<r=r>r�r��r�r=)rG�service_registry�parse_command_line_arguments�command_line_argsrp�selected_ports_by_protocol�requested_tcp_ports�requested_udp_ports�use_explicit_port_filterr�tcp_connections_by_port�udp_connections_by_port�tcp_states_by_port�udp_states_by_port�processed_connection_data�#collected_client_ips_for_subnetting�discovered_service_ports�port_service_overrides�_detect_server_ips�
server_ips�#_validate_command_line_combinations� process_port_selection_from_args�r[s r>ra�ConnectionReporter.__init__ws��� /� 1���!%�!B�!B�!D���25�%���*F��'�#&�5�� �#&�5�� �(-��%�'2�3K�'L��$�'2�3K�'L��$�"-�.F�"G���"-�.F�"G���)+��&�35��0�03��c�e�(D��%�&(��#��1�1�3����0�0�2��-�-�/r=c���SS1n[R"S5nU(a�[R"USS/[R[RSSS9nUR
S	:Xa�URR5Hjn[R"S
U5nU(dM#URS5RS5S	nUR[[U555 Ml U$[R"S
5nU(a�[R"US/[R[RSSS9nUR
S	:XaEURR5H'nUR[[U555 M) U$U$![a GM+f=f![ a U$f=f![a M_f=f![ a U$f=f)z@Collect addresses assigned to this host (loopback + interfaces).rr
�ipz-o�addrTF��stdout�stderr�text�checkrz\s(inet6?)\s([^\s/]+)r�%�hostnamez-I)�shutil�which�
subprocess�run�PIPE�
returncoder��
splitlines�re�search�group�split�addrzr�
ValueError�OSError)r��ip_path�result�line�match�address�
hostname_paths       r>r��%ConnectionReporter._detect_server_ips�s���"�5�)�
��,�,�t�$���
�#����d�F�+�%�?�?�%�?�?������$�$��)� &�
�
� 8� 8� :�� "�	�	�*B�D� I��$�$�"'�+�+�a�.�"6�"6�s�";�A�">��%�&�N�N�3�z�'�/B�+C�D�
!;�<��%#�L�L��4�M���'�^�^�&��-�)���)���!�#��F��(�(�A�-�'-�}�}�':�':�'<�G�)� *���s�:�g�3F�/G� H�(=���z���/ *�%�$�%���
��(��+
��"$.�)� (�)��������sm�B'F3�#F!�.F3�A#G�6#G�G�!
F0�+F3�/F0�0F3�3
G�G�
G�G�G�G�
G#�"G#c�N�US:wagU[;agURX5S:H$)NrUFTr&)�WEB_EXTRA_PORTS�_get_service_namerhs   r>�_is_web_port�ConnectionReporter._is_web_port�s.���u����/�)���%�%�k�<��F�Fr=c���[U5nUR(d3UR(d"UR(dUR
(agXR;$![a gf=f)NFT)rr��is_loopback�
is_private�
is_link_local�is_unspecifiedr��r[�	ip_string�	ip_objects   r>�_is_internal_client�&ConnectionReporter._is_internal_client�s[��	�"�9�-�I�
�!�!��#�#��&�&��'�'���O�O�+�+���	��	�s�A � 
A-�,A-c���[U5nUR(agXR;agUR(dUR
(agg![a gf=f)N�internal�loopbackr[�private)rr�r�r�r�r�r�s   r>�_internal_client_reason�*ConnectionReporter._internal_client_reason�sW��	�"�9�-�I�� � �����'�����9�#:�#:�����	��	�s�A�
A �A c��URX#5(a-URU5(aUSURU5S3$U$)N� (�))r�r�r�)r[r�r`r\s    r>�_format_client_ip�$ConnectionReporter._format_client_ip�sI�����k�4�4��(�(��3�3��[��4�#?�#?�	�#J�"K�1�M�M��r=c��URX#5(dU$UR5VVs0sHupEURU5(aMXE_M! snn$s snnfrl)r�rZr�)r[�	ip_countsr`r\r��counts      r>�_external_ip_counts�&ConnectionReporter._external_ip_counts�s]��� � ��7�7���%.�O�O�$5�
�$5� �	��+�+�I�6�
�I��$5�
�	
��
s�A�Ac�:�SnSnURR5Hwup4URS5upV[U5nUR	Xu5(dM;USR5H%up�URU5(aX-
nM!X)-
nM' My X4$)Nr�:�ips)r�rZr�ryr�r�)
r[�internal_total�external_total�data_key�connection_datar\�port_stringr`r�r�s
          r>�_web_internal_traffic_totals�/ConnectionReporter._web_internal_traffic_totals�s�������)-�)G�)G�)M�)M�)O�%�H�$,�N�N�3�$7�!�H��k�*�K��$�$�[�;�;��$3�E�$:�$@�$@�$B� �	��+�+�I�6�6�"�+�N�"�+�N�	%C�*P��-�-r=c�0�UR5upX-nUS:XdUS:XagX-nU[:ag[UR5"SR	S555 [UR5"SUSSUSSUSS	355 [5 g)
NrzWEB STACK NOTEr�  �,z of z HTTP connections (�.0fu�%) are from loopback, private, or this server's own IPs — typical Apache/Nginx/cPanel proxy/health-check traffic, not external clients.)r�� INTERNAL_WEB_DOMINANCE_THRESHOLD�print�_warn_color�center)r[r�r��	web_total�internal_shares     r>�_print_web_internal_note�+ConnectionReporter._print_web_internal_note�s���)-�)J�)J�)L�&��"�3�	���>�^�q�0��'�3���<�<��
�d��� �!1�!8�!8��!=�>�?�
������^�A�&�d�9�Q�-�8�"�3�'�(D�D�
�	
�	�r=c��URR(aIURR(a.[S[R
S9 [R"S5 URRbJURRS:a/[S[R
S9 [R"S5 ggg)Nz+Error: --subnet cannot be used with --watch��file�z)Error: watch interval must be >= 1 second)r��watch�subnetr��sysr��exitr�s r>r��6ConnectionReporter._validate_command_line_combinationss����!�!�'�'�D�,B�,B�,I�,I��=��Z�Z�
�
�H�H�Q�K��!�!�'�'�3��%�%�+�+�a�/��A��
�
�S������0�4r=c���[S5Ul[S5Ul[S5Ul[S5Ul0Ul/Ul[5[5S.Ul0Ul	g)Nc� �[[5$rlr�r<r=r>r��<ConnectionReporter._reset_collection_state.<locals>.<lambda>r�r=c� �[[5$rlr�r<r=r>r�r�r�r=c� �[[5$rlr�r<r=r>r�r�r�r=c� �[[5$rlr�r<r=r>r�r�r�r=rT)
rr�r�r�r�r�r�rpr�r�r�s r>�_reset_collection_state�*ConnectionReporter._reset_collection_statesc��'2�3K�'L��$�'2�3K�'L��$�"-�.F�"G���"-�.F�"G���)+��&�35��0�03��c�e�(D��%�&(��#r=c��[R"SS9nURRSH)nUR	SU3SSUR5S3S9 M+ UR	S	SS
S9 UR	SSSS9 UR	S
SSS9 UR	SSSSS9 UR	SSSSS9 UR	SSSS9 UR	SSS[[SS[S3S 9 UR	S!SS"S9 UR5$)#Nz"Summarize TCP/UDP connection info.)�descriptionrUz--�
store_truez
Show only � connections)�action�helpz--tcpzShow all TCP connectionsz--udpzShow all UDP connectionsz--topu2Only show services ≥2000 connections or IPs >200z-sz--subnetz(Group connections by /24 and /16 subnetsz-pz--port�+z(Specify up to 10 ports (space-separated))�nargsr	�portsrz$Deprecated: use -p or --port insteadz-wz--watch�?�SECSz%Refresh every SECS seconds (default: z); Ctrl+C to exit)r�const�type�metavarr	z--all-portsz8Include every local TCP/UDP port with active connections)	�argparse�ArgumentParserr�rD�add_argument�upper�DEFAULT_WATCH_INTERVALry�
parse_args)r[�parserr^s   r>r��/ConnectionReporter.parse_command_line_arguments%s����(�(�<�
��!�1�1�:�:�5�A�L�����\�N�#�#�!�,�"4�"4�"6�!7�|�D�
 �
�B�	����L�/I�	�	
�	����L�/I�	�	
�	�����E�	�	
�
	������;�		�	
�	������;�		�	
�	����3�%K�	�	
�	������(���7�8N�7O�P!�!�	�	
�	�����K�	�	
�
� � �"�"r=c��SnURR(aWURRS5nURSRU5 URRU5 SnO�URRSHxn[URUS5(dM!URRSUnURSRU5 URRU5 SnMz URR(aVURRS5nURSRU5 URRU5 Sn[URR=(d /5nURURR5 U(Ga3[U5S:�a.[!S["R$S9 ["R&"S5 UH�nUR)5(dM[+U5nURSR-U5 URR-U5 URR(d<URR.(d!URR1US5(a9URSR-U5 URR-U5 SnM� U(dTURRS5nURSRU5 URRU5 URR.(a�URRS5nURSRU5 URRU5 URR(aiUR35(dTURRS5nURSRU5 URRU5 Xlg)	NFrUTrVrzError: max 10 portsr�r�)r�rUr�rrr��updater�rD�getattrrVr��list�port�extendr�lenr�r�r�r��isdigitryr��toprm�_has_explicit_tcp_selectionr�)	r[�any_port_was_selected�	tcp_portsr^r�	udp_ports�explicit_portsr�r`s	         r>r��3ConnectionReporter.process_port_selection_from_args]s_�� %���!�!�%�%��-�-�;�;�E�B�I��+�+�E�2�9�9�)�D��$�$�+�+�I�6�$(�!� $� 5� 5� >� >�u� E���4�1�1�<��G�G� �1�1�:�:�5�A�,�O�E��3�3�E�:�A�A�%�H��,�,�3�3�E�:�,0�)�!F��!�!�%�%��-�-�;�;�E�B�I��+�+�E�2�9�9�)�D��$�$�+�+�I�6�$(�!��d�4�4�9�9�?�R�@�����d�4�4�:�:�;���>�"�R�'��+�#�*�*�=������-���&�&�(�(�"%�k�"2�K��3�3�E�:�>�>�{�K��,�,�0�0��=��.�.�2�2��1�1�5�5��0�0�@�@�'�����7�7��>�B�B�'���0�0�4�4�[�A�,0�)�! .�$%��-�-�;�;�E�B�I��+�+�E�2�9�9�)�D��$�$�+�+�I�6��!�!�%�%��-�-�;�;�E�B�I��+�+�E�2�9�9�)�D��$�$�+�+�I�6��&�&�*�*��8�8�:�:� �1�1�?�?��F�	��/�/��6�=�=�i�H��(�(�/�/�	�:�(=�%r=c�&�URR(agURRSH!n[	URUS5(dM! g URR
(dURR(agg)NTrUF)r�rUr�rDrrr)r[r^s  r>r#�.ConnectionReporter._has_explicit_tcp_selection�sm���!�!�%�%�� �1�1�:�:�5�A�L��t�-�-�|�U�C�C��B��!�!�&�&�$�*@�*@�*F�*F��r=c�,�[UR5$rl)r{r�r�s r>�
_wants_tcp�ConnectionReporter._wants_tcp�����D�,�,�-�-r=c�,�[UR5$rl)r{r�r�s r>�
_wants_udp�ConnectionReporter._wants_udp�r.r=c���[5nURRSH2n[URUS5(dM!URU5 M4 URR(a(URURRS5 URR(a(URURRS5 U$)NrUFrV)	rpr�rDrr�r�rUrrV)r[�selectedr^s   r>�"_explicitly_selected_service_names�5ConnectionReporter._explicitly_selected_service_names�s����5�� �1�1�:�:�5�A�L��t�-�-�|�U�C�C����\�*�B��!�!�%�%��O�O�D�1�1�:�:�5�A�B��!�!�%�%��O�O�D�1�1�:�:�5�A�B��r=c�.�URR(agUR5nU(dgURR	5HCup#UH8nURXB5U;dMURURU5 M: ME grl)r��	all_portsr4r�rZr�r�r�)r[�selected_servicesr\rr`s     r>�-_merge_discovered_ports_for_selected_services�@ConnectionReporter._merge_discovered_ports_for_selected_services�s|���!�!�+�+�� �C�C�E�� ��#�<�<�B�B�D�O�H�$���)�)�+�@�DU�U��3�3�H�=�A�A�+�N� %� Er=c��URRX!45nU(aU$URRX5$rl)r�rgr�ri)r[r`r\�overrides    r>r��$ConnectionReporter._get_service_name�s:���.�.�2�2�H�3J�K����O��$�$�5�5�k�L�Lr=c���URR(agUR(arXRR	U[55;agXRR	U[55;a"URX5UR5;$gURRX5(agXRR	U[55;agg)NTF)r�r7r�r�rgrpr�r�r4r�rmrhs   r>�_is_connection_allowed�)ConnectionReporter._is_connection_allowed�s����!�!�+�+���(�(��=�=�A�A�(�C�E�R�R���;�;�?�?��#�%�P�P��*�*�;�A��>�>�@�A���� � �0�0��G�G���7�7�;�;�H�c�e�L�L��r=c�T�UR5n[Hup#X!;dMUs $ grl)�lower�PROCESS_SERVICE_HINTS)�
process_field�
process_lower�needler^s    r>�_service_from_process�(ConnectionReporter._service_from_process�s.��%�+�+�-�
�$9� �F��&�#�#�%:�r=c��/n[5nSH�n[RRUS5nU(dM,UR	5nU(dME[
R
US5nSnUS:Xa[U5S:�aUSnOUS:Xa[U5S:�aUSnXV4nXq;aM�URU5 URUUS	.5 M� U$)
N)�
SSH_CLIENT�SSH_CONNECTION�rrJ�rrK�)r��server_port)
rpr8�environrgr�r~�
_normalize_ipr r��append)�sessions�seen�variable�value�parts�	client_iprO�session_keys        r>�_admin_ssh_sessions�&ConnectionReporter._admin_ssh_sessions�s������u��8�H��J�J�N�N�8�R�0�E����K�K�M�E���*�8�8��q��B�I��K��<�'�C��J�!�O�#�A�h���-�-�#�e�*��/�#�A�h��$�2�K��"���H�H�[�!��O�O��*��
�#9�*�r=Nc�n�URURU5 U(aX0RX!4'ggrl)r�r�r�)r[r`r\r^s    r>�_register_discovered_port�,ConnectionReporter._register_discovered_port�s4���%�%�h�/�3�3�K�@��CO�'�'��(?�@�r=c��UR5H>nUSR5(dM[US5nURUSS5 M@ g)NrOrUr)rZr!ryr])r[�sessionr`s   r>�_apply_admin_session_ports�-ConnectionReporter._apply_admin_session_portssM���/�/�1�G��=�)�1�1�3�3���g�m�4�5�K��*�*�;��u�E�	2r=c��[R"SUR55nUSS;ag[R"SSUS5nUR	SS5upV[U5nSnURRXr5(a#URRXr5n	U	S	:waU	nU(d,Sn
S
U;aXRS
5Sn
URU
5nURXrU5 g![[4a gf=f)N�\s+r>�LISTEN�UNCONN�^::ffff:rLrMr�r�rezusers:()r�r��strip�sub�rsplitryr��
IndexErrorr�rmri�indexrGr])r[r�r\�
line_parts�
local_address�_r�r`r^�trackedrDs           r>�_parse_listen_line�%ConnectionReporter._parse_listen_lines���X�X�f�d�j�j�l�3�
��a�=� 4�4��	��F�F�;��J�q�M�B�M�*�1�1�#�q�9�N�A��k�*�K���� � �0�0��G�G��+�+�<�<���G��'�!�&����M��D� � $�Z�Z�	�%:�%;� <�
��5�5�m�D�L��&�&�{�l�K���J�'�	��	�s�:C6�6D	�D	c
�~�[5[5S.Ul0UlUR5 SHrup[R
"[U/[R[RSSS9nURR5HnURXR5 M Mt UR5 g![Ram URSS5n[R
"[U/[R[RSSS9nN�![Ra GMf=ff=f)NrT))z-tlnprU)z-ulnprVTr��prL)rpr�r�rar�r��ss_pathr��CalledProcessError�replacer�r�rqr9)r[�flagsr\�subprocess_output�fallback_flagsr�s      r>�collect_listening_ports�*ConnectionReporter.collect_listening_ports$s��03��c�e�(D��%�&(��#��'�'�)�C�O�E�
�$.�N�N��e�$�%�?�?�%�?�?���%�!�&*�0�0�;�;�=���'�'��7�>�+ D�.	
�:�:�<���0�0�
�!&���s�B�!7��	�(2��� �.�1�)���)���!�"�)�%��"�4�4�����
�s)�:B;�;&D<�":D�D8�2D<�7D8�8D<c�h�URS5(aURS5(aUSS$U$)N�[�]r����)�
startswith�endswith)r�s r>rQ� ConnectionReporter._normalize_ipAs5������$�$��);�);�C�)@�)@��Q�r�?�"��r=c���[U5nUR(d"UR(dUR(ag[	[USU3SS95$![a gf=f)N�local�/F��strictr
)rr�r�r�rzrr�)r��prefixr�s   r>�
_subnet_label� ConnectionReporter._subnet_labelGs^��
	�"�9�-�I��%�%��'�'��+�+���z�Y�K�q���"9�%�H�I�I���	��	�s�>A�A�
A&�%A&c�@�[[S[R5$)N�yellow)rr	�magentar<r=r>r��ConnectionReporter._warn_colorUs���u�h��
�
�6�6r=c��[[5nURR5H]up#UR	S5upE[U5nURUSXd5nUR5Hup�X==U	-
ss'M M_ U$)Nr�r�)rryr�rZr�r�)
r[r�r�r�r\r�r`�filtered_ipsr�r�s
          r>�_aggregate_ip_counts�'ConnectionReporter._aggregate_ip_countsYs�����$�	�)-�)G�)G�)M�)M�)O�%�H�$,�N�N�3�$7�!�H��k�*�K��3�3���&���L�%1�$6�$6�$8� �	��$��-�$�%9�
*P��r=c��[[5nUR5H*upEURXB5nUS;dMX6==U-
ss'M, U$)N>r
r�)rryrZr�)r[r�r��
subnet_countsr�r�r�s       r>�_subnet_counts�!ConnectionReporter._subnet_countsesN��#�C�(�
� )��� 1��I��'�'�	�:�F��^�+��%��.�%�!2��r=c�X�[URX5R5SS9SU$)Nc��US*$�Nr�r<��items r>r��1ConnectionReporter._top_subnets.<locals>.<lambda>ps
��d�1�g�Xr=��key)�sortedr�rZ)r[r�r��limits    r>�_top_subnets�ConnectionReporter._top_subnetsms5������	�2�8�8�:�%�
��5��	r=c�"�/nURR5GH�up#URS5upE[U5nUR	Xd5nURUSXd5nU(dMS[
UR55n	[U5n
[UR5SS9up�UR5SUSUS3n
U	(aX�-S-OSnU[:�a!URS	U
S
USUSUS
S3S.5 U	[:�aURS	U
SU	SU
S3S.5 U[5;a?U
(aX�-OSnU
[:�a(U[ ::aURSU
SU
SUSS3S.5 [UR#US5R5SSS9unnU[$:�a#US;aURSU
SUSUS3S.5 U
S:�dGM�US :dGM�U	S!:�dGM�URSU
S"U
S#US
S$3S.5 GM� U$)%Nr�r�c��US$r�r<r�s r>r��5ConnectionReporter._analyze_threats.<locals>.<lambda>�s���Q�r=r�r�r�rr�highz
: hot source z has z connections (r�z% of service traffic))�severity�messageu: volume flood — z connections from � unique IPs�mediumu : possible auth brute-force — z unique IPs averaging �.1fz	 conns/IP�c��US$r�r<r�s r>r�r��s���a�r=)rLr)r��default>rLr
r�z: /24 cluster z accounts for rrNi�u: distributed pattern — z& sources, no single IP dominates (top z%))r�rZr�ryr�r��sum�valuesr �maxr�HOT_IP_THRESHOLDrR�HOT_SERVICE_THRESHOLDrE�BRUTE_FORCE_MIN_UNIQUE_IPS�BRUTE_FORCE_MAX_AVG_PER_IPr��SUBNET_FLOOD_THRESHOLD)r[�alertsr�r�r\r�r`r^r��total�
unique_ips�top_ip�	top_count�label�	top_share�
avg_per_ip�
top_subnet�subnet_counts                  r>�_analyze_threats�#ConnectionReporter._analyze_threatsss~����)-�)G�)G�)M�)M�)O�%�H�$,�N�N�3�$7�!�H��k�*�K��1�1���L��0�0���&���I����	�(�(�*�+�E��Y��J� #�I�O�O�$5�;O� P��F�#�)�)�+�,�A�k�]�"�X�J�a�H�E�5:��*�c�1��I��,�,��
�
� &� �'��v�h�e�I�;�G(�(1�#��6K�M����-�-��
�
� &� �'�!4�U�G�;M�%�,�k�3����3�5�5�3=�U�/�1�
��"<�<�"�&@�@��M�M�$,�$�g�%E�)�l�*@�)�#�.�i�9�#��(+��#�#�I�r�2�8�8�:�(��(�$�J��� 6�6��&8�8��
�
� (� �'��
�|�>�'�.��6����S� �Y��^�����
�
� (� �'�!;�J�<�H7�7@��o�R�I���K*P�Z�
r=c���[[5nUS:XaUROURnUR	5H(nUR5HupVX%==U-
ss'M M* U$�NrU)rryr�r�r�rZ)r[r\�state_counts�states_by_port�port_states�
state_namer�s       r>�_aggregate_states�$ConnectionReporter._aggregate_states�sp��"�3�'���5� �
�#�#��(�(�	�
*�0�0�2�K�%0�%6�%6�%8�!�
��(�E�1�(�&9�3��r=c�z�U(dg[UR5SS9nSRSUSU55$)NrLc��US*US4$)Nr�rr<r�s r>r��:ConnectionReporter._format_state_summary.<locals>.<lambda>�s��T�!�W�H�d�1�g�3Fr=r��, c3�6# �UHupUSUS3v� M g7f)r�r�Nr<��.0r�r�s   r>�	<genexpr>�;ConnectionReporter._format_state_summary.<locals>.<genexpr>�s'���
�%;�!�
��l�!�E�!�9�%�%;�s�)r�rZ�join)r[r�r��ordered_statess    r>�_format_state_summary�(ConnectionReporter._format_state_summary�sH�������� �&F�
���y�y�
�%3�F�U�%;�
�
�	
r=c�l�/nUR5(a+URS5nU(aURSU45 UR5(a+URS5nU(aURSU45 U(dg[	[
R"SRS555 UGH�upE[UR55n[/SQ5n[UR5SS	9H,up�U(aX�-S-OS
n
URX�U
SS3/5 M. S
URS'SURS'SURS'[	[
R"URS555 UR!5R#5H�nSU;dSU;a~[$R&"SU5nU(a?[)UR+S55S:�a![	[
R,"U55 Ml[	UR/5"U55 M�[	[
R"U55 M� [SUR555n
U
S:�dGM�[	[
R,"SU
SS355 GM� [	5 g)NrUzTCP connection statesrVzUDP socket stateszCONNECTION STATE BREAKDOWNr)�State�Countr�c��US*$r�r<r�s r>r��EConnectionReporter.print_connection_state_breakdown.<locals>.<lambda>�s
���Q��xr=r�rr�r��lr��rr�rrz\|\s+(\d+)\s+\|r��2c3�B# �UHupU[;dMUv� M g7frl)�SUSPICIOUS_TCP_STATESr�s   r>r��FConnectionReporter.print_connection_state_breakdown.<locals>.<genexpr>�s%����)=�%�J��!6�6���)=�s��	z  ! High SYN-RECV count (r�u) — possible SYN flood)r,r�rRr0r�r	r�r�r�r�rr�rZ�add_row�align�cyan�
get_stringr�r�r�ryr��redr�)r[�sections�
tcp_states�
udp_states�titler�r��tabler�r��sharer��count_match�
suspiciouss              r>� print_connection_state_breakdown�3ConnectionReporter.print_connection_state_breakdown�s4�����?�?����/�/��6�J�����!8�*� E�F��?�?����/�/��6�J�����!4�j� A�B���
�e�m�m�8�?�?��D�E�F�#+��E���+�+�-�.�E�� 7�8�E�%+��"�"�$�*?�&�!�
�27���#�-�A���
�
�z�U�3�K�q�/�B�C�	&�
$'�E�K�K�� �#&�E�K�K�� �"�E�K�K����%�*�*�U�\�\�#�.�/�0��(�(�*�5�5�7����%��d�):�"$�)�)�,>��"E�K�"�s�;�+<�+<�Q�+?�'@�B�'F��e�i�i��o�.��d�.�.�0��6�7��%�*�*�T�*�+�8���)5�);�);�)=���J�
�R����I�I�3�J�q�>�B-�-���7$,�B	�r=c
�
�[SURR555n[SURR555nUR5n[	U5nX-n[[R"S55 [[R"S[R"5RS53RS555 [[R"SUSS	USS
USSUS3RS555 [[R"S55 [5 UR5nU(a�[[R"SRS555 UH�nUS
(aSUS
3OSnSUSSU3n	USU;a$[[R"U	S355 MO[[R"U	S35UR5"S5-[R"S5-5 M� [5 /n
SHnn[URU5HOnUR R#X�5(aM%UR%X�5n
U
R'U
SUSU35 MQ Mp U
(a�[UR5"SRS555 [UR5"SSR)U
SS5355 [	U
5S:�a/[UR5"S[	U
5S-
S355 [5 UR+5 UR-5nU(a�[UR5"SRS555 [US S!S"9HTnS#US$3n	US%S&:Xa![[R."U	55 M5[UR5"U	55 MV [5 UR15 UR3US'S(S)9nU(a�[[R4"S*RS555 [7/S+Q5nUH/unnU(aUU-S-OS,nUR9UUUS-S.3/5 M1 S/UR:S0'S1UR:S2'S1UR:S3'UR=5R?5H"n	[[R"U	55 M$ [5 gg)4Nc3�`# �UH$upURS5(dMUSv� M& g7f)�tcp:r�N�r��r�r��datas   r>r��=ConnectionReporter.print_executive_summary.<locals>.<genexpr>�+���
�C�	���~�~�f�%�
�D��M�C���.�.c3�`# �UH$upURS5(dMUSv� M& g7f)�udp:r�Nr�r�s   r>r�r�r�r�zd====================================================================================================zCONNECTION SNAPSHOT  z%Y-%m-%d %H:%M:%SrzTotal: r�z connections  |  Unique IPs: z
  |  TCP: z
  |  UDP: zYOUR SSH SESSION(S)rOzport zunknown portr�r�z connected to z (visible below)r�zchecking discovered portsr�rTr�r�zDISCOVERED LISTEN PORTSr��z  ... +z more�ALERTSc��US$)Nr�r<r�s r>r��<ConnectionReporter.print_executive_summary.<locals>.<lambda>Ws	���j�)9r=T)r��reversez  ! r�r�r�r�r)r�r�zTOP /24 SUBNETS (all services))�Subnet�Connections�
% of totalrr�r�r�rr�rr) r�r�rZr�r r�r	r�r�now�strftimer�rZr�r�r�r�rmr�rRr�r�r�r�r�r�r�rr�r�r�r�)r[�	tcp_total�	udp_totalr�r��total_connections�admin_sessionsr`�
port_labelr��extra_portsr\r`r^r��alert�top_subnets�subnet_tabler�r�r�s                     r>�print_executive_summary�*ConnectionReporter.print_executive_summary
s����
�!�;�;�A�A�C�
�
�	�
�
�!�;�;�A�A�C�
�
�	�
�-�-�/�	���^�
�%�1��
�e�j�j��#�$�
��J�J�'�����(?�(?�@S�(T�'U�V�����
�	
�	��J�J��/��2�3#�#-�a�.�1�%�a�=�
�9�Q�-�A��&��+�
�	
�	�e�j�j��#�$�
���1�1�3����%�*�*�2�9�9�#�>�?�@�)���}�-��G�M�2�3�4�'��
�G�D�M�?�.���E���4�=�I�-��%�*�*��v�-=�%>�?�@���
�
�d�V�2�;�/��*�*�,�-H�I�J��*�*�S�/�*��*�
�G���&�H�%�d�&C�&C�H�&M�N���(�(�8�8��O�O��#�5�5�k�L���"�"�l�^�1�[�M��8�*�#M�N�	 O�'���$�"�"�$�%>�%E�%E�c�%J�K�L��$�"�"�$�r�$�)�)�K���4D�*E�)F�%G�H�I��;��"�$��d�&�&�(�7�3�{�3C�b�3H�2I��)O�P�Q��G��%�%�'��&�&�(����$�"�"�$�X�_�_�S�%9�:�;���9�4����e�I�.�/�0����$��.��%�)�)�D�/�*��$�*�*�,�T�2�3��
�G��-�-�/��'�'�	�"�A�'�F����%�-�-� @� G� G�� L�M�N�&�'N�O�L�!,�
���=N��!2�2�c�9�TU���$�$�f�e��c�{�!�_�%E�F�"-�,/�L���x�(�03�L���}�-�/2�L���|�,�$�/�/�1�<�<�>���e�j�j��&�'�?��G�r=c�x�[(d/[S[RS9 [R"S5 gg)NzError: ss command not foundr�r�)rur�r�r�r�r�s r>�_require_ss�ConnectionReporter._require_ssps&���w��/�c�j�j�A��H�H�Q�K�r=c��UR5 [R"[S/[RSSS9nWRR5H nURUSUR5 M" g![R
a1 [
S[RS9 [R"S5 N�f=f)Nz-tanT�r�r�r�zError running: ss -tanr�r�rU)rr�r�rur�rvr�r�r�r�r�r��_parse_ss_output_liner��r[ryr�s   r>�collect_tcp_connections�*ConnectionReporter.collect_tcp_connectionsv�������		� *����&�!�!�����	!��&�,�,�7�7�9�D��&�&��e�T�9�9�
�:���,�,�	��*����<��H�H�Q�K�	���+A<�<AC�Cc��UR5 [R"[S/[RSSS9nWRR5H nURUSUR5 M" g![R
a1 [
S[RS9 [R"S5 N�f=f)Nz-uanTrzError running: ss -uanr�r�rV)rr�r�rur�rvr�r�r�r�r�r�rr�rs   r>�collect_udp_connections�*ConnectionReporter.collect_udp_connections�rrc�<�[R"SUR55n[U5S:d	USS;agUSn[R"SSUS5n[R"SSUS5nURS	S
5up�URS	S
5up�URU5nURU
5n
U	S:XdUS:XagU[;d
U
[;ag[U	5nURX�5(dgURR(aURRU
5 gUS:XaUR OUR"n
X�U==S
-
ss'X<U
==S
-
ss'g![a gf=f![a gf=f)
Nrdrr>r�rergrLrMrNr�r�rrU)r�r�rhr rirjr�rQ�SKIPPED_SERVER_IPS�SKIPPED_CLIENT_IPSryr?r�r�r�rRr�r�)r[r�r\�connection_storage_dictrm�connection_state�server_address_string�client_address_string�	server_ip�server_port_stringrX�client_port_stringr`�
state_storages              r>r�(ConnectionReporter._parse_ss_output_line�s����X�X�f�d�j�j�l�3�
��z�?�Q��*�Q�-�3F�"F��%�a�=��	�$&�F�F�;��J�q�M�$J�!�$&�F�F�;��J�q�M�$J�!�,A�,H�,H��a�,P�)�I�,A�,H�,H��a�,P�)�I��&�&�y�1�	��&�&�y�1�	���$�(:�c�(A���*�*�i�;M�.M��	��0�1�K��*�*�;�A�A���!�!�(�(��4�4�;�;�I�F���5� �
�#�#��(�(�	�
	�"�#3�4��9�4��,�Y�7�1�<�7��9�	��	���	��	�s%�AE>�(F�>
F�
F�
F�Fc��UR5(agURR5HIunn[UR	55U[URU5S.URSU3'MK UR5(ahURR5HIunn[UR	55U[URU5S.URSU3'MK gg)N�r�r��statesr�r�)r,r�rZr�r��dictr�r�r0r�r�)r[r`�ip_to_count_maps   r>�summarize_collected_connections�2ConnectionReporter.summarize_collected_connections�s����?�?����-�-�3�3�5����!��!7�!7�!9�:�*�"�4�#:�#:�;�#G�H�H��.�.��k�]�/C�D�6��?�?����-�-�3�3�5����!��!7�!7�!9�:�*�"�4�#:�#:�;�#G�H�H��.�.��k�]�/C�D�6�	r=c�J�UR5(a<URH,nSU3nX R;dMS00S.URU'M. UR5(a=URH,nSU3nX R;dMS00S.URU'M. gg)Nr�rr.r�)r,r�r�r0r�)r[r`r�s   r>�(ensure_all_requested_services_in_summary�;ConnectionReporter.ensure_all_requested_services_in_summary�s����?�?���#�7�7��!�+��/���#A�#A�A�!"�!�"$�@�D�2�2�8�<� 8��?�?���#�7�7��!�+��/���#A�#A�A�!"�!�"$�@�D�2�2�8�<� 8�r=c�f�[R"5R$![a Us$f=frl)r��get_terminal_size�columnsr�)r[r�s  r>�_terminal_width�"ConnectionReporter._terminal_width�s0��	��+�+�-�5�5�5���	��N�	�s�!�0�0c�p�[SUR5[-5n[S[XU55$r�)r�r:�ESTIMATED_TABLE_WIDTH�min)r[�table_count�	preferred�width_baseds    r>�_tables_per_row�"ConnectionReporter._tables_per_row�s1���!�T�1�1�3�7L�L�M���1�c�+�+�>�?�?r=c#�V# �[S[U5U5HnXX!-v� M
 g7f)Nr)�ranger )�tables_with_row_data�max_per_row�starts   r>�
_chunk_tables� ConnectionReporter._chunk_tables�s-����1�c�"6�7��E�E�&�U�-@�A�A�F�s�')c�V�USnU[:�nUR5USS3USSS3/nURSS5nUS:�aURUSS35 URS	S
5nURSS
5nU(aURSU35 U(aURS
U35 SR	U5n	U(a/[[R"U	RS555 g[[R"U	RS555 g)N�connectionsr�z connsr�r��internal_web_connectionsrz internal/web-stackr�rL�
state_summaryz	top /24: zstates: z | r)
r�rrgrRr�r�r	r�r�r�)
r[�
service_title�service_totalsr
�service_is_hot�title_parts�internal_webr�rN�title_strings
          r>�_print_service_title�'ConnectionReporter._print_service_title�s"��*�=�9��*�.C�C���"�"�$�%� ��#�6�*��l�+�A�.�k�:�
��
&�)�)�*D�a�H���!�����,�q�!1�1D�E�F�#�'�'��b�9�
�&�*�*�?�B�?�
������:�,�7�8������-��9�:��z�z�+�.����%�)�)�L�/�/��4�5�6��%�-�-�� 3� 3�C� 8�9�:r=c�^^�/n/nUH�upEpgURUR5R55 URUVV	s1sHAup�U	[:�dMTR	Xg5(aTRU5(aM?UiMC sn	n5 M� [
SU55n
UHPnU(dM[US5n[U5U
:dM+URSU-5 [U5U
:aM%MR [U
5GH,n
/n[U5H�up�X�mU
S:HnTR5RS5=(d TR5(+nU(a'UR[R"T55 MwU(a'UR[R"T55 M�[UU4SjUU55nU(a'UR[R "T55 M�URT5 M� [#SR%U55 GM/ gs sn	nf)Nc3�H# �UHo(dM[U5v� M g7frl)r )r��liness  r>r��<ConnectionReporter._print_table_row_chunk.<locals>.<genexpr>%s���
�$<�5��J�C��J�J�$<�s�
"�"r� r�r
c3�H># �UHnTRTU5v� M g7frl)�_line_contains_ip)r��hot_ipr�r[s  ��r>r�rZ>s,����&�'�F��.�.�t�V�<�<�'�s�"r�)rRr�r�r�r�r�r�r rE�	enumeraterhr�r	r�r��anyr�r�r�)r[rF�list_of_table_line_lists�list_of_high_traffic_ip_setsr��rowsr`r\r�r��
max_heightrY�table_width�irm�current_table_index�	is_header�	is_border�is_hot_liner�s`                  @r>�_print_table_row_chunk�)ConnectionReporter._print_table_row_chunks����#%� �')�$�2F�.�E��$�+�+�E�,<�,<�,>�,I�,I�,K�L�(�/�/�!%�1�!%�I�B��,�,���%�%�k�<�<��0�0��4��!%�1�
�3G��
�$<�
�
�
�.�E����e�A�h�-�K��e�*�z�)����S�;�.�/��e�*�z�)�	.��z�"�A��J�.7�(�/�*�#��x����F�	� �J�J�L�3�3�C�8�L��
�
��<L�	���%�%�e�j�j��&6�7���%�%�e�m�m�D�&9�:�"%�&�&B�/�'�&�#�K�#�"�)�)�%�)�)�D�/�:�"�)�)�$�/�+/�,
�$�)�)�J�'�(�1#��+1s�I� *I�Ic��U(dgUcE[SU55nU[UVVVs1sHupg nUHup�UiM	 M snnn5S.nUcUR[U55nURX5 [	URX$55n	[
U	5H&up�U
S:�a
[5 URU5 M( [5 gs snnnf)Nc3�N# �UHup n[SU55v� M g7f)c3�*# �UH	upUv� M g7frlr<)r�ror�s   r>r��QConnectionReporter.print_service_tables_side_by_side.<locals>.<genexpr>.<genexpr>Vs���/�$�h�a�E�$���N)r�)r�rorcs   r>r��GConnectionReporter.print_service_tables_side_by_side.<locals>.<genexpr>Us+���(�%9�M�A�Q���/�$�/�/�/�%9�s�#%)rLr�r)	r�r rBrUrrIr_r�rk)r[rOrFrPrG�displayed_connectionsrorcr��table_chunks�chunk_index�chunks            r>�!print_service_tables_side_by_side�4ConnectionReporter.print_service_tables_side_by_sideJs���$���!�$'�(�%9�(�%�!�
 5�!�.B��-A�M�A�Q��%)�E�B��%)��-A���	�N����.�.�s�3G�/H�I�K��!�!�-�@�����3�A�
��#,�L�"9��K��Q�����'�'��.�#:�	���'s�Cc�4�SUS3U;=(d	 SUS3U;$)Nz| r[�|r<)r�r�s  r>r]�$ConnectionReporter._line_contains_ipqs'���B�4�q�z�T�!�7�r�"��Q�Z�4�%7�7r=c�h�[[5n[[5nSnSnUR5H�upxXXS-
nUSR5HCup�URXr5(aUR	U	5(aXj-
nM7X9==U
-
ss'ME URS05R5Hup�XK==U
-
ss'M M� SnUR
US5n
U
(a[U
R5SS9SnUXV-
U[U5US	;aUOSURU5S
.$)Nrr�r�r/rLr�c��US$r�r<r�s r>r��4ConnectionReporter._service_totals.<locals>.<lambda>�s��T�!�Wr=r�>r
r�)rL�external_connectionsrMr�r�rN)
rryrZr�r�rgr�r�r r�)r[�
ports_datar\r�r�r
rMr`�infor�r�r�r��
subnet_totalss              r>�_service_totals�"ConnectionReporter._service_totalsus:����$�	�"�3�'����#$� �!+�!1�!1�!3��K��g��.��$(��K�$5�$5�$7� �	��%�%�k�<�<��0�0��;�;�,�5�,��(�E�1�(�%8�&*�X�X�h��%;�%A�%A�%C�!�
��(�E�1�(�&D�"4��
��+�+�I�r�:�
���]�0�0�2�8L�M�a�P�J�-�$5�$P�(@��i�.�(2�.�(H�*�b�!�7�7��E�

�	
r=c	��/nUR5H�upVUSS::aMUSn[USR5SS9SSn[UR5SU3SS	/5n	UH4up�X�-S
-nU	R	URX�U5UUSS	3/5 M6 SU	lS
U	RS'S
U	RS	'URX�XS45 M� U$)Nr�rr�c��US*$r�r<)�xs r>r��:ConnectionReporter._build_service_tables.<locals>.<lambda>�s
��a��d�Ur=r�rr�r�r�rr�r�r�)rZr�rrr�r�r�rR)
r[r^r�r\�tables_to_printr`r��
service_totalrcr�r�r�r�s
             r>�_build_service_tables�(ConnectionReporter._build_service_tables�s
����!+�!1�!1�!3��K��G�}��!�� ��M�M��$�u�+�+�+�-�?�C�C�R�H�D��#�)�)�+�,�A�k�]�;�����E�%)� �	��.�#�5���
�
��*�*�9�8�L���S�k��O���%)��E�K�#&�E�K�K�� �"�E�K�K����"�"�E��#G�H�-"4�.�r=c�^^�[SUR555nUS::ag[UU4SjUR555nTRR
(+=(d US:�=(d U$)Nc3�*# �UH	oSv� M g7f)r�Nr<)r��ds  r>r��;ConnectionReporter._should_print_service.<locals>.<genexpr>�s���H�4G�q�'�
�4G�rqrFc3�># �UH:upTRUSUT5R5Hup4US:�v� M M< g7f)r�rN)r�rZ)r�r`r�r�r�r\r[s     ��r>r�r��sS����
�%7�!��$(�$<�$<��U��[�(�%��e�g�%� �	�
�C�K�%�
�%7�s�AAr)r�r�r`rZr�r")r[r�r\r
�any_ip_over_200s` `  r>�_should_print_service�(ConnectionReporter._should_print_service�ss����H�J�4E�4E�4G�H�H����!���
�%/�%5�%5�%7�
�
���)�)�-�-�-�
���%�8��	
r=c	�|�U(a5URX%S9(a URUUURX%S9US9 ggg)N�r\)rPrG)r�rwr�)r[rOr�r�rGr\s      r>�_print_service_if_needed�+ConnectionReporter._print_service_if_needed�sY���t�9�9�� :� 
�
�2�2���#�3�3�� 4� �(�

3�
� 
�?r=c
�0�[S5nURR5HWup#URS5upE[	U5nURXd5nUSUSUR
S05S.XU4U'MY SURRURRSS	S
SSS
S/
SS/S.nSGHUnUS:XaUR5(dM!X�n	Sn
U
[U	5:a�X�nUS:Xa�US	:Xa|/SQn/n0n
UHGnUR
XN405nU
RU5 URURUUUS95 MI URSU
U[ US9 U
[U5-
n
M�UR
XG405n
U
(a"URX}US9nURUU
UUS9 U
S-
n
U
[U	5:aM�UR
US405nU(dGM2URSUUS9nURSUUUS9 GMX g)Nc��[S5$)Nc��S0S.$)Nr)r�r�r<r<r=r>r��XConnectionReporter.generate_connection_report_tables.<locals>.<lambda>.<locals>.<lambda>�s	��!�B�(?r=rr<r=r>r��FConnectionReporter.generate_connection_report_tables.<locals>.<lambda>�s
��K� ?�@r=r�r�r�r/r.r&r!r#r$rArr/r2r5rSrTrVrrU)r#r$rAr�z
MAIL SERVICES)rGr\r�re)rr�rZr�ryr�rgr�rWrXr0r rrr�r��MAIL_SERVICES_MAX_PER_ROW)r[�service_map_by_protocolr�r�r\r�r`r^�service_print_order_by_protocol�service_print_orderrf�combined_mail_servicesr�r��sub_service_name�sub_service_ports_data�other_ports_datas                 r>�!generate_connection_report_tables�4ConnectionReporter.generate_connection_report_tables�s���"-�@�#
��*.�)G�)G�)M�)M�)O�%�H�$,�N�N�3�$7�!�H��k�*�K��1�1���L�)��1�&�u�-�)�-�-�h��;�N�#�|�$<�=�k�J�
*P���%�%�0�0��%�%�1�1����������5�>�+
�'� '�H��5� ����):�):��"A�"K���A��c�-�.�.�2�5���u�$���)?�-H�*�&(�O�!#�J�,B�(�1H�1L�1L�%�8�"�2�.�#�)�)�*@�A�'�.�.� �6�6� 0� 6�)1�7���-C��1�1�'�"�'�$=�!)�2����3�4�4�A��4�8�8��,�b��
��&*�&@�&@�$�8�'A�'�O��1�1�$�"�'�!)�	2���Q���[�c�-�.�.�^ 7�:�:��7�#�R� �� ��"&�"<�"<��-��#=�#���-�-��$�#�%�	.��y'r=c	���[[5n[[5nURH�n[U5nUR(d"UR
(dUR(aMDU[[US3SS95==S-
ss'U[[US3SS95==S-
ss'M� SU4SU44GH�upVU(dM[UR5SS	9nURR(aUVs/sHo�SS
:�dM
UPM n	nOUSSn	U	(dMn[SS
/5n
XZl[!U	5VVs1sHup�USS
:�dMUiM nnnU	HnU
R#U5 M SU
R$S'SU
R$S
'U
R'5R)5n
[!U
5H{up�US;a![+[,R."U55 M,US:�a*US-
U;a![+[,R0"U55 M\[+[,R2"U55 M} [+5 GM� g![a GM;f=fs snfs snnf)Nz/24Fr�r�z/16zTop /24 SubnetszTop /16 Subnetsc��US*$r�r<)�kvs r>r��CConnectionReporter.generate_subnet_summary_tables.<locals>.<lambda>Rs
��B�q�E�6r=r�rrNrr�r�r�>r�rMr)rryr�rr�r�r�rzrr�r�rZr�r"rr�r_r�r�r�r�r�r	r�r�r�)r[�slash_24_subnet_counts�slash_16_subnet_countsr��ip_address_object�table_title_label�subnet_counts_data�all_rows_sorted�row�rows_to_displayr�rf�high_traffic_row_indicesrYr�s               r>�generate_subnet_summary_tables�1ConnectionReporter.generate_subnet_summary_tables4sX��!,�S�!1��!,�S�!1���A�A�I�
�$.�y�$9�!�%�1�1�(�3�3�(�7�7��&��
�&7�%8��#<�U�K�L�����'��
�&7�%8��#<�U�K�L�����B�&� 6�7�
� 6�7�6
�1��&��%�"�(�(�*�0A��O��%�%�)�)�#2�#�#2�C�!�f�s�l�C�?� �#��#2�#�2�"6��"����7� 3�4�E�+�K�!*�/� :�(� :�f�a�c�!�f�s�l�� :�
%�(�'���
�
�c�"�'�%(�E�K�K��!�#&�E�K�K�� ��$�$�&�1�1�3�E�$�U�+�����;��%�-�-��-�.��!�V��Q��+C� C��%�)�)�D�/�*��%�*�*�T�*�+�,�
�G�W6
���
��
��#��(s0�>I�/AI�I*�I*�I/�I/�
I'�&I'c�D�UR5 UR5 URR(a[UR	5(aUR5 UR
5(aUR5 UR5 gUR
5(aUR5 UR	5(aUR5 UR5 UR5 UR5 UR5 grl)
rr{r�r�r,rr0rr�r2r5rr�r�s r>�_run_report_once�#ConnectionReporter._run_report_oncevs��������$�$�&��!�!�(�(���� � ��,�,�.���� � ��,�,�.��/�/�1���?�?����(�(�*��?�?����(�(�*��,�,�.��5�5�7��$�$�&��.�.�0r=c�`�[RR5(a[SSS9 gg)NzrL)�end)r�r��isattyr�r<r=r>�
_clear_screen� ConnectionReporter._clear_screen�s$���:�:������/�r�*�r=c�f�URRn[[R"SUS355 UR5 UR
5 UR5 [R"U5 MH![a" [[R"S55 gf=f)NzWatch mode: refreshing every zs (Ctrl+C to exit)z
Watch mode stopped.)r�r�r�r	r�r�rr��time�sleep�KeyboardInterrupt)r[�intervals  r>�run_watch_mode�!ConnectionReporter.run_watch_mode�s����)�)�/�/��
��J�J�/��z�9K�L�
�	
�
	7���"�"�$��,�,�.��%�%�'��
�
�8�$�	��
!�	7��%�*�*�4�5�6�	7�s�A	B�)B0�/B0c�t�URRbUR5 gUR5 grl)r�r�r�r�r�s r>r��ConnectionReporter.run�s/���!�!�'�'�3����!�����r=)r�r�r�r�r�r�r�r�r�r�r�r�r�r�r�rl)r�)r�r)rN)r)NN)rUr�)Drtrurvrwrxra�staticmethodr�r�r�r�r�r�r�r�r�rr�r�r#r,r0r4r9r�r?rGrZr]rarqr{rQr�r�r�r�r�r�r�r�r�rrrrrr2r5r:�DEFAULT_MAX_TABLES_PER_ROWrBrIrUrkrwr]r�r�r�r�r�r�r�r�r�r�r|r<r=r>r~r~ts���'�0�&�,��,�\G�,���
�
.��&
�)�5#�p?>�B�.�.�	�	O�M��$��������4P�
F�L�2=�:����
�����7��7�
���O�b
�	
�0�da�F��$�$&=�R�.�*�6P�@��B��B�;�02)�p��%�N�8��8�
�@�6

� GK���"a�H@�D1�.�+��+�7�" r=r~�__main__)(rr8r�r�r�r�r��collectionsrr�	ipaddressrr�prettytabler�radsr	r�rur"r#r�r�r�r�r�r�rr�r�r=r�r�rCr?rErGr~rtr�r<r=r>�<module>r�s����	�	�
��
��#��,�#��
�,�,�t�
��<���U������������#�Y�/����������*��#&� ���*O�(�-K�-K�`s �s �l)�z�������r=