FlyInk13 · April 28, 2019 22:43 · FlyInk13 · Apr 28, 2019 · FlyInk13 · Apr 28, 2019
diff --git a/tcpdump-top.js b/tcpdump-top.js
 const { spawn } = require('child_process');
 const https = require('https');
 const info = {
    lastPending: false,
    lastDataDate: 0,
    lastLineDate: 0,
    lastPushDate: 0,
    cpErrors: '\n',
    buffer: '',
    ipInfo: [],
    ipError: [],
    lastIp: {},
 };

 const HistoryLog = {
    history: [],
    counters: {},
    limit: 10e3,
    minuteLimit: 1,
    push: (data) => {
        HistoryLog.clean();
        data = { id: data.id, time: Date.now(), count: data.count };
        HistoryLog.history.push(data);
        HistoryLog.countIncr(data.id, data.count);
    },
    clean: () => {
        var array = HistoryLog.history;
        var count = array.length - 1;
        var death = Date.now() - HistoryLog.minuteLimit + 60e3;
        var item;

        while (count-- > 0) {
            item = array[count];
            if (item.time < death) {
                HistoryLog.countIncr(array[count], -item.count);
                array.splice(count, 1);
            }
        }

        if (array.length > HistoryLog.limit) {
            var spliced = array.splice(0, array.length - HistoryLog.limit);
            HistoryLog.countIncrList(spliced);
        }
    },
    countGet: (data) => {
        var count = HistoryLog.countIncr(data, 0);
        return count;
    },
    countIncrList: (list, value) => {
        var count = list.length;
        var item;
        while (count--) {
            item = list[count];
            HistoryLog.countIncr(item.id, -item.count);
        }
    },
    countIncr: (key, value) => {
        if (!HistoryLog.counters[key]) {
            HistoryLog.counters[key] = 0;
        }

        HistoryLog.counters[key] += value;

        if (!HistoryLog.counters[key]) {
            delete HistoryLog.counters[key];
        }

        return HistoryLog.counters[key] || 0;
    },
 };

 // ip info
 function matchIp(ip) {
    if (/^[\d.]+$/.test(ip)) {
        return ip.split('.').splice(0, 4).join('.');
    } else if (/^[\w\d:.]+$/.test(ip)) {
        return ip.split('.').splice(0, 1).join('.');
    }

    return ip;
 }

 function toLong(ip) {
    var ipl = 0;

    ip.split('.').forEach((octet) => {
        ipl <<= 8;
        ipl += parseInt(octet);
    });

    return (ipl >>> 0);
 };

 function fromLong(ipl) {
    return (
        (ipl >>> 24      ) + '.' +
        (ipl >>  16 & 255) + '.' +
        (ipl >>   8 & 255) + '.' +
        (ipl        & 255)
    );
 };

 function fillRange(first, last, description) {
    if (!/^[\d.]+$/.test(first)) return;
    if (!/^[\d.]+$/.test(last)) return;
    if (first !== fromLong(toLong(first))) return console.log('overflow', first, fromLong(toLong(first)));
    if (last !== fromLong(toLong(last))) return console.log('overflow', last, fromLong(toLong(last)));
    if (toLong(last) <= toLong(first)) return console.log('bad range');
    var min = toLong(first);
    var max = toLong(last);
    var ip = '';
    while (max > min) {
        ip = fromLong(max--);
        info.ipInfo[ip] = ip  + ' (' + description + ')';
    }
 }

 function whoIsApi(ip) {
    if (info.lastPending) return;
    info.lastPending = true;

    return new Promise((resolve, reject) => {
        https.get('https://api.iptoasn.com/v1/as/ip/' + ip, (res) => {
            var buffer = '';
            res.on('data', (c) => buffer += c);
            res.on('end', () => resolve(buffer));
        }).on('error', reject);
    }).then((res) => {
        try {
            return JSON.parse(res);
        } catch (e) {
            throw { code: 'ECONNRESET' };
        }
    }).then((r) => {
        if (!r.as_description) {
            throw r;
        }

        info.lastIp = r;
        if (r.first_ip && r.last_ip) {
            fillRange(r.first_ip, r.last_ip, r.as_description);
        }

        return ip  + ' (' + r.as_description + ')';
    }).catch((e) => {
        if (e.code == 'ECONNRESET') return whoIsApi(ip);
        throw e;
    }).then((ipName) => {
        info.lastPending = false;
        info.ipInfo[ip] = ipName;
    }).catch((e) => {
        info.lastPending = false;
        info.ipInfo[ip] = -1;
        info.ipError[ip] = e;
        console.log(e);
    });
 }

 function getInfo(ip) {
    if (!info.ipInfo[ip]) {
        info.ipInfo[ip] = -1;
        return ip;
    } else if (info.ipInfo[ip] == -1) {
        return ip;
    } else {
        return info.ipInfo[ip];
    }
 }

 // tcpdump
 function onTcpData(data) {
    info.buffer += data;
    let index = info.buffer.indexOf('\n');
    let line, match;
    info.lastDataDate = new Date();
    while (index > -1) {
        info.lastLineDate = new Date();
        line = info.buffer.substr(0, index);
        match = line.match(/.+ IP6? (.+) > .+? length (\d+)/);
        if (match) {
            var [, id, count] = match;
            id = matchIp(id);
            HistoryLog.push({ id, count: parseInt(count) });
        }
        info.buffer = info.buffer.substr(index + 1);
        index = info.buffer.indexOf('\n');
        info.lastPushDate = new Date();
    }
 }

 function tcpdumpStart() {
    const tcpdump = spawn('tcpdump', ['-n', '-nn', 'inbound', 'and', 'greater 10']);
    tcpdump.stdout.on('data', onTcpData);
    tcpdump.stderr.on('data', (data) => info.cpErrors += data);
    tcpdump.on('close', (code) => info.cpErrors += '\nEXIT: ' + code);
 }

 // tick
 function onTick() {
    var ip = Object.entries(info.ipInfo)
        .sort((a, b) => HistoryLog.counters[b[0]] - HistoryLog.counters[a[0]])
        .find((ip, i) => i < 30 && ip[1] === -1);
    if (ip) whoIsApi(ip[0]);

    var top = Object.entries(HistoryLog.counters)
        .sort((a, b) => b[1] - a[1])
        .map((i) => i[1] + ' - ' + getInfo(i[0]))
        .splice(0, 30)
        .join('\n');

    process.stdout.write('\u001bc');
    console.log(top);
    console.log('\n\nInfo:');
    Object.entries(info).forEach(([name, data]) => {
        if (name == 'ipInfo') return;
        if (!/last/.test(name)) console.log();
        console.log(name + ':', data);
    });
    console.log('\nLast log:', HistoryLog.history[HistoryLog.history.length - 1]);
 }

 // init
 tcpdumpStart();
 setInterval(onTick, 1000);
	const { spawn } = require('child_process');
	const https = require('https');
	const info = {
	lastPending: false,
	lastDataDate: 0,
	lastLineDate: 0,
	lastPushDate: 0,
	cpErrors: '\n',
	buffer: '',
	ipInfo: [],
	ipError: [],
	lastIp: {},
	};

	const HistoryLog = {
	history: [],
	counters: {},
	limit: 10e3,
	minuteLimit: 1,
	push: (data) => {
	HistoryLog.clean();
	data = { id: data.id, time: Date.now(), count: data.count };
	HistoryLog.history.push(data);
	HistoryLog.countIncr(data.id, data.count);
	},
	clean: () => {
	var array = HistoryLog.history;
	var count = array.length - 1;
	var death = Date.now() - HistoryLog.minuteLimit + 60e3;
	var item;

	while (count-- > 0) {
	item = array[count];
	if (item.time < death) {
	HistoryLog.countIncr(array[count], -item.count);
	array.splice(count, 1);
	}
	}

	if (array.length > HistoryLog.limit) {
	var spliced = array.splice(0, array.length - HistoryLog.limit);
	HistoryLog.countIncrList(spliced);
	}
	},
	countGet: (data) => {
	var count = HistoryLog.countIncr(data, 0);
	return count;
	},
	countIncrList: (list, value) => {
	var count = list.length;
	var item;
	while (count--) {
	item = list[count];
	HistoryLog.countIncr(item.id, -item.count);
	}
	},
	countIncr: (key, value) => {
	if (!HistoryLog.counters[key]) {
	HistoryLog.counters[key] = 0;
	}

	HistoryLog.counters[key] += value;

	if (!HistoryLog.counters[key]) {
	delete HistoryLog.counters[key];
	}

	return HistoryLog.counters[key] \|\| 0;
	},
	};

	// ip info
	function matchIp(ip) {
	if (/^[\d.]+$/.test(ip)) {
	return ip.split('.').splice(0, 4).join('.');
	} else if (/^[\w\d:.]+$/.test(ip)) {
	return ip.split('.').splice(0, 1).join('.');
	}

	return ip;
	}

	function toLong(ip) {
	var ipl = 0;

	ip.split('.').forEach((octet) => {
	ipl <<= 8;
	ipl += parseInt(octet);
	});

	return (ipl >>> 0);
	};

	function fromLong(ipl) {
	return (
	(ipl >>> 24 ) + '.' +
	(ipl >> 16 & 255) + '.' +
	(ipl >> 8 & 255) + '.' +
	(ipl & 255)
	);
	};

	function fillRange(first, last, description) {
	if (!/^[\d.]+$/.test(first)) return;
	if (!/^[\d.]+$/.test(last)) return;
	if (first !== fromLong(toLong(first))) return console.log('overflow', first, fromLong(toLong(first)));
	if (last !== fromLong(toLong(last))) return console.log('overflow', last, fromLong(toLong(last)));
	if (toLong(last) <= toLong(first)) return console.log('bad range');
	var min = toLong(first);
	var max = toLong(last);
	var ip = '';
	while (max > min) {
	ip = fromLong(max--);
	info.ipInfo[ip] = ip + ' (' + description + ')';
	}
	}

	function whoIsApi(ip) {
	if (info.lastPending) return;
	info.lastPending = true;

	return new Promise((resolve, reject) => {
	https.get('https://api.iptoasn.com/v1/as/ip/' + ip, (res) => {
	var buffer = '';
	res.on('data', (c) => buffer += c);
	res.on('end', () => resolve(buffer));
	}).on('error', reject);
	}).then((res) => {
	try {
	return JSON.parse(res);
	} catch (e) {
	throw { code: 'ECONNRESET' };
	}
	}).then((r) => {
	if (!r.as_description) {
	throw r;
	}

	info.lastIp = r;
	if (r.first_ip && r.last_ip) {
	fillRange(r.first_ip, r.last_ip, r.as_description);
	}

	return ip + ' (' + r.as_description + ')';
	}).catch((e) => {
	if (e.code == 'ECONNRESET') return whoIsApi(ip);
	throw e;
	}).then((ipName) => {
	info.lastPending = false;
	info.ipInfo[ip] = ipName;
	}).catch((e) => {
	info.lastPending = false;
	info.ipInfo[ip] = -1;
	info.ipError[ip] = e;
	console.log(e);
	});
	}

	function getInfo(ip) {
	if (!info.ipInfo[ip]) {
	info.ipInfo[ip] = -1;
	return ip;
	} else if (info.ipInfo[ip] == -1) {
	return ip;
	} else {
	return info.ipInfo[ip];
	}
	}

	// tcpdump
	function onTcpData(data) {
	info.buffer += data;
	let index = info.buffer.indexOf('\n');
	let line, match;
	info.lastDataDate = new Date();
	while (index > -1) {
	info.lastLineDate = new Date();
	line = info.buffer.substr(0, index);
	match = line.match(/.+ IP6? (.+) > .+? length (\d+)/);
	if (match) {
	var [, id, count] = match;
	id = matchIp(id);
	HistoryLog.push({ id, count: parseInt(count) });
	}
	info.buffer = info.buffer.substr(index + 1);
	index = info.buffer.indexOf('\n');
	info.lastPushDate = new Date();
	}
	}

	function tcpdumpStart() {
	const tcpdump = spawn('tcpdump', ['-n', '-nn', 'inbound', 'and', 'greater 10']);
	tcpdump.stdout.on('data', onTcpData);
	tcpdump.stderr.on('data', (data) => info.cpErrors += data);
	tcpdump.on('close', (code) => info.cpErrors += '\nEXIT: ' + code);
	}

	// tick
	function onTick() {
	var ip = Object.entries(info.ipInfo)
	.sort((a, b) => HistoryLog.counters[b[0]] - HistoryLog.counters[a[0]])
	.find((ip, i) => i < 30 && ip[1] === -1);
	if (ip) whoIsApi(ip[0]);

	var top = Object.entries(HistoryLog.counters)
	.sort((a, b) => b[1] - a[1])
	.map((i) => i[1] + ' - ' + getInfo(i[0]))
	.splice(0, 30)
	.join('\n');

	process.stdout.write('\u001bc');
	console.log(top);
	console.log('\n\nInfo:');
	Object.entries(info).forEach(([name, data]) => {
	if (name == 'ipInfo') return;
	if (!/last/.test(name)) console.log();
	console.log(name + ':', data);
	});
	console.log('\nLast log:', HistoryLog.history[HistoryLog.history.length - 1]);
	}

	// init
	tcpdumpStart();
	setInterval(onTick, 1000);