@@ -891,12 +891,6 @@ def scan_network():
891
891
sql_connection .commit ()
892
892
closeDB ()
893
893
894
- # Issue #370
895
- # new column for example "dev_alarm_delay" (True/False) and config parameter (2) scan counter
896
- # For devices that are in the “Current_Scan” table and for which “alarm_delay” is set to True,
897
- # “Pending_Alert” is reset if the time interval is less than the desired one.
898
- # maybe a new function like "apply_notifivation_delay()""
899
-
900
894
# Web Service Monitoring
901
895
if SCAN_WEBSERVICES :
902
896
if str (startTime )[15 ] == "0" :
@@ -909,8 +903,6 @@ def scan_network():
909
903
print ('\n Looking for Rogue DHCP Servers...' )
910
904
rogue_dhcp_detection ()
911
905
912
-
913
-
914
906
return 0
915
907
916
908
#-------------------------------------------------------------------------------
@@ -1385,31 +1377,20 @@ def read_openwrt_clients():
1385
1377
print (' Missing python package' )
1386
1378
return
1387
1379
1388
-
1389
1380
try :
1390
1381
router = OpenWrtRpc (str (OPENWRT_IP ), str (OPENWRT_USER ), str (OPENWRT_PASS ))
1391
1382
result = router .get_all_connected_devices (only_reachable = True )
1392
1383
1393
- # devices_info = []
1394
-
1395
1384
for device in result :
1396
1385
if str (device .hostname ) == 'None' :
1397
1386
hostname = '(unknown)'
1398
1387
else :
1399
1388
hostname = device .hostname
1400
1389
1401
- # device_data = {
1402
- # 'mac': device.mac,
1403
- # 'hostname': hostname,
1404
- # 'ip': device.ip
1405
- # }
1406
- # devices_info.append(device_data)
1407
-
1408
1390
sql .execute ("INSERT INTO Openwrt_Network (OWRT_MAC, OWRT_IP, UF_Name, OWRT_Vendor) " +
1409
- "VALUES (?, ?, ?, ?) " , (device .mac , device .ip , hostname , '(unknown)' ) )
1391
+ "VALUES (?, ?, ?, ?) " , (device .mac . lower () , device .ip , hostname , '(unknown)' ) )
1410
1392
1411
1393
except Exception as e :
1412
- #print(f"Es ist ein Fehler aufgetreten")
1413
1394
print (f"Error" )
1414
1395
1415
1396
#-------------------------------------------------------------------------------
@@ -1566,7 +1547,7 @@ def process_satellites(satellite_list):
1566
1547
1567
1548
for result in data ['scan_results' ]:
1568
1549
if result ['cur_ScanMethod' ] != 'Internet Check' :
1569
- sat_MAC = result ['cur_MAC' ]
1550
+ sat_MAC = result ['cur_MAC' ]. lower ()
1570
1551
sat_IP = result ['cur_IP' ]
1571
1552
sat_hostname = result ['cur_hostname' ]
1572
1553
sat_Vendor = result ['cur_Vendor' ]
@@ -1654,6 +1635,42 @@ def cleanup_satellite_scans(satellite_list):
1654
1635
if os .path .exists (WORKING_DIR + token + ".json" ):
1655
1636
os .remove (WORKING_DIR + token + ".json" )
1656
1637
1638
+ #-------------------------------------------------------------------------------
1639
+ def update_scan_validation ():
1640
+ print (' Update Scan Validation...' )
1641
+ # 1. set dev_Scan_Validation_State to 0 for devices that are in CurrentScan and have dev_Scan_Validation > 0
1642
+ sql .execute ("""
1643
+ UPDATE Devices
1644
+ SET dev_Scan_Validation_State = 0
1645
+ WHERE dev_Scan_Validation > 0
1646
+ AND dev_MAC IN (SELECT cur_MAC FROM CurrentScan)
1647
+ """ )
1648
+
1649
+ # 2. find devices to be inserted in CurrentScan and save them in a list
1650
+ sql .execute ("""
1651
+ SELECT dev_ScanCycle, dev_MAC, dev_LastIP, dev_Vendor, dev_ScanSource
1652
+ FROM Devices
1653
+ WHERE dev_Scan_Validation > 0
1654
+ AND dev_Scan_Validation_State < dev_Scan_Validation
1655
+ AND dev_MAC NOT IN (SELECT cur_MAC FROM CurrentScan)
1656
+ """ )
1657
+ devices_to_insert = sql .fetchall ()
1658
+
1659
+ # 3. Add the devices to CurrentScan
1660
+ sql .executemany ("""
1661
+ INSERT INTO CurrentScan (cur_ScanCycle, cur_MAC, cur_IP, cur_Vendor, cur_ScanMethod, cur_ScanSource)
1662
+ VALUES (?, ?, ?, ?, NULL, ?)
1663
+ """ , devices_to_insert )
1664
+
1665
+ # 4. increase dev_Scan_Validation_State by 1 for the devices saved in point 2
1666
+ mac_addresses = [device [1 ] for device in devices_to_insert ]
1667
+ if mac_addresses :
1668
+ sql .executemany ("""
1669
+ UPDATE Devices
1670
+ SET dev_Scan_Validation_State = dev_Scan_Validation_State + 1
1671
+ WHERE dev_MAC = ?
1672
+ """ , [(mac ,) for mac in mac_addresses ])
1673
+
1657
1674
#-------------------------------------------------------------------------------
1658
1675
def save_scanned_devices (p_arpscan_devices , p_cycle_interval ):
1659
1676
# Delete previous scan data
@@ -1694,6 +1711,9 @@ def save_scanned_devices(p_arpscan_devices, p_cycle_interval):
1694
1711
WHERE cur_MAC = Sat_MAC )""" ,
1695
1712
(cycle ) )
1696
1713
1714
+ # Scan Validation
1715
+ update_scan_validation ()
1716
+
1697
1717
if not OFFLINE_MODE :
1698
1718
# Check Internet connectivity
1699
1719
internet_IP = get_internet_IP ()
@@ -2537,7 +2557,6 @@ def rogue_dhcp_detection():
2537
2557
# Flush Table
2538
2558
sql .execute ("DELETE FROM Nmap_DHCP_Server" )
2539
2559
sql_connection .commit ()
2540
-
2541
2560
closeDB ()
2542
2561
2543
2562
# Execute 15 probes and insert in list
@@ -2547,7 +2566,6 @@ def rogue_dhcp_detection():
2547
2566
for _ in range (dhcp_probes ):
2548
2567
stream = os .popen ('sudo nmap --script broadcast-dhcp-discover 2>/dev/null | grep "Server Identifier" | awk \' { print $4 }\' ' )
2549
2568
output = stream .read ()
2550
- # dhcp_server_list.append(output.replace("\n", ""))
2551
2569
2552
2570
multiple_dhcp_ips = output .split ("\n " )
2553
2571
@@ -3090,12 +3108,8 @@ def icmp_monitoring():
3090
3108
3091
3109
closeDB ()
3092
3110
scantime = startTime .strftime ("%Y-%m-%d %H:%M" )
3093
-
3094
3111
icmp_scan_results = {}
3095
-
3096
3112
icmphosts_all = len (icmphosts )
3097
- icmphosts_online = 0
3098
- icmphosts_offline = 0
3099
3113
3100
3114
try :
3101
3115
ping_retries = ICMP_ONLINE_TEST
@@ -3108,18 +3122,14 @@ def icmp_monitoring():
3108
3122
while icmphosts_index < icmphosts_all :
3109
3123
host_ip = icmphosts [icmphosts_index ]
3110
3124
for i in range (ping_retries ):
3111
- # print("Host %s retry %s" % (host_ip, str(i+1)))
3112
3125
icmp_status = ping (host_ip )
3113
3126
if icmp_status == "1" :
3114
3127
break ;
3115
3128
3116
3129
if icmp_status == "1" :
3117
3130
icmp_rtt = ping_avg (host_ip )
3118
- # print("Host %s RTT %s" % (host_ip, str(icmp_rtt)))
3119
- icmphosts_online += 1
3120
3131
else :
3121
3132
icmp_rtt = "99999"
3122
- icmphosts_offline += 1
3123
3133
3124
3134
current_data = {
3125
3135
"host_ip" : host_ip ,
@@ -3133,18 +3143,20 @@ def icmp_monitoring():
3133
3143
3134
3144
icmphosts_index += 1
3135
3145
3136
- print (" Online Host(s) : " + str (icmphosts_online ))
3137
- print (" Offline Host(s) : " + str (icmphosts_offline ))
3138
-
3139
3146
openDB ()
3140
3147
# Save Scan Results
3141
3148
icmp_save_scandata (icmp_scan_results )
3142
3149
3150
+ update_icmp_validation ()
3151
+ online , offline = get_online_offline_hosts ()
3152
+ print (" Online Host(s) : " + str (online ))
3153
+ print (" Offline Host(s) : " + str (offline ))
3154
+
3143
3155
print (" Create Events..." )
3144
3156
icmp_create_events ()
3145
3157
3146
3158
print (" Calculate Activity History..." )
3147
- calc_activity_history_icmp (icmphosts_online , icmphosts_offline )
3159
+ calc_activity_history_icmp (online , offline )
3148
3160
3149
3161
sql_connection .commit ()
3150
3162
closeDB ()
@@ -3153,6 +3165,67 @@ def icmp_monitoring():
3153
3165
# openDB()
3154
3166
print (" No Hosts(s) to monitor!" )
3155
3167
3168
+
3169
+ #-------------------------------------------------------------------------------
3170
+ def get_online_offline_hosts ():
3171
+ sql .execute ("""
3172
+ SELECT COUNT(*)
3173
+ FROM ICMP_Mon_CurrentScan
3174
+ WHERE cur_Present = 1
3175
+ """ )
3176
+ icmphosts_online = sql .fetchone ()[0 ]
3177
+
3178
+ sql .execute ("""
3179
+ SELECT COUNT(*)
3180
+ FROM ICMP_Mon_CurrentScan
3181
+ WHERE cur_Present = 0
3182
+ """ )
3183
+ icmphosts_offline = sql .fetchone ()[0 ]
3184
+
3185
+ return icmphosts_online , icmphosts_offline
3186
+
3187
+ #-------------------------------------------------------------------------------
3188
+ def update_icmp_validation ():
3189
+ print (' Update ICMP Validation...' )
3190
+ # 1. Set dev_Scan_Validation_State to 0 for devices that are in Present in CurrentScan and have dev_Scan_Validation > 0
3191
+ sql .execute ("""
3192
+ UPDATE ICMP_Mon
3193
+ SET icmp_Scan_Validation_State = 0
3194
+ WHERE icmp_Scan_Validation > 0
3195
+ AND icmp_ip IN (
3196
+ SELECT cur_ip FROM ICMP_Mon_CurrentScan WHERE cur_Present = 1
3197
+ );
3198
+ """ )
3199
+ # 2. Find devices in CurrentScan that have activated Scan_Validation and are not currently active
3200
+ sql .execute ("""
3201
+ SELECT cur_ip
3202
+ FROM ICMP_Mon_CurrentScan
3203
+ WHERE cur_Present = 0
3204
+ AND cur_ip IN (
3205
+ SELECT icmp_ip
3206
+ FROM ICMP_Mon
3207
+ WHERE icmp_Scan_Validation > 0
3208
+ AND icmp_Scan_Validation_State < icmp_Scan_Validation
3209
+ )
3210
+ """ )
3211
+ host_ips = [(row [0 ],) for row in sql .fetchall ()]
3212
+ # 3. Set the relevant devices as online
3213
+ sql .executemany ("""
3214
+ UPDATE ICMP_Mon_CurrentScan
3215
+ SET cur_Present = 1, cur_PresentChanged = 0, cur_avgrrt = 999
3216
+ WHERE cur_ip = ?
3217
+ """ , host_ips )
3218
+ # 4. increase dev_Scan_Validation_State by 1 for the devices saved in point 2
3219
+ sql .executemany ("""
3220
+ UPDATE ICMP_Mon
3221
+ SET icmp_Scan_Validation_State = icmp_Scan_Validation_State + 1,
3222
+ icmp_PresentLastScan = 1,
3223
+ icmp_avgrtt = 999
3224
+ WHERE icmp_Scan_Validation > 0 AND icmp_ip = ?
3225
+ """ , host_ips )
3226
+
3227
+ sql_connection .commit ()
3228
+
3156
3229
# -----------------------------------------------------------------------------
3157
3230
def icmp_save_scandata (data ):
3158
3231
print (" Save scan results..." )
@@ -3163,7 +3236,6 @@ def icmp_save_scandata(data):
3163
3236
3164
3237
# -----------------------------------------------------------------------------
3165
3238
def icmp_create_events ():
3166
-
3167
3239
# Check new connections
3168
3240
print_log ('Events - New Connections' )
3169
3241
sql .execute ("""INSERT INTO ICMP_Mon_Connections (icmpeve_ip, icmpeve_DateTime, icmpeve_Present, icmpeve_EventType)
@@ -3646,9 +3718,6 @@ def email_reporting():
3646
3718
' <td> <a href="{}{}"> {} </a> </td><td> {} </td>' + \
3647
3719
' <td> {} </td><td> {} </td><td> {} </td></tr>\n '
3648
3720
3649
- # Issue #370
3650
- # AND eve_DateTime < datetime('now', '-{DELAY} minutes') for devices where dev_alarm_delay is true
3651
-
3652
3721
sql .execute ("""SELECT * FROM Events_Devices
3653
3722
WHERE eve_PendingAlertEmail = 1
3654
3723
AND eve_EventType = 'Device Down'
@@ -3740,19 +3809,6 @@ def email_reporting():
3740
3809
sql .execute ("""UPDATE Events SET eve_PendingAlertEmail = 0
3741
3810
WHERE eve_PendingAlertEmail = 1""" )
3742
3811
3743
- # Issue #370
3744
- # Clean Pending Alert Events
3745
- # sql.execute("""UPDATE Devices SET dev_LastNotification = ?
3746
- # WHERE dev_MAC IN (SELECT eve_MAC FROM Events
3747
- # WHERE eve_PendingAlertEmail = 1 AND eve_EventType =='Device Down'
3748
- # AND eve_DateTime < datetime('now', '-{DELAY} minutes')
3749
- # """, (datetime.datetime.now(),))
3750
- # sql.execute ("""UPDATE Events SET eve_PendingAlertEmail = 0
3751
- # WHERE eve_PendingAlertEmail = 1
3752
- # AND eve_EventType =='Device Down'
3753
- # AND eve_DateTime < datetime('now', '-{DELAY} minutes')
3754
- # """)
3755
-
3756
3812
# Set Notification Presets
3757
3813
sql .execute ("""UPDATE Devices SET dev_AlertEvents = ?, dev_AlertDeviceDown = ?
3758
3814
WHERE dev_NewDevice = 1
0 commit comments