Skip to content

Commit cdae130

Browse files
lucaderilucaderi
committed
Initial commit of nprobe extensions
1 parent c8b5887 commit cdae130

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

45 files changed

+4321
-1
lines changed

‎README.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -3,6 +3,6 @@ This repository contains open source components and extensions for nProbe availa
33

44
Here you can find:
55
* Add-on and extensions
6-
* Code example of applications that can interact with nProbe
6+
* Code examples of applications that can interact with nProbe
77

88
Enjoy!

‎bgp/README

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
BGP lister written in perl: your BGP-enabled router connects to it, and it injects in a local
2+
nProbe instance all the routes (initially all received routes, later all the routing updates)
3+
so that the probe can compute the AS path and put it into emitted flows.
4+
5+
You can start this script from the nProbe BGP plugin part of nProbe Pro
6+
7+
8+
NOTE that you need to configure into the source code your AS info
9+
10+
Download:
11+
- http://www.ris.ripe.net/source/libbgpdump-1.4.99.11.tar.gz
12+
- http://data.ris.ripe.net/rrc10/2010.07/
13+

‎bgp/bgp_probe_client.pl

Lines changed: 233 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,233 @@
1+
#!/usr/bin/perl
2+
3+
#use strict;
4+
5+
use Getopt::Std;
6+
7+
use Net::BGP::Process;
8+
use Net::BGP::Peer;
9+
use Net::BGP::Refresh;
10+
11+
use threads;
12+
use Thread::Queue;
13+
14+
#############
15+
16+
#
17+
# Configuration parameters
18+
#
19+
20+
# BGP
21+
my $local_ip = '192.168.48.2';
22+
my $local_as = 65498;
23+
my $remote_ip = '192.168.48.1';
24+
my $remote_as = 2597;
25+
26+
# nProbe
27+
my $nprobe_ip = '127.0.0.1';
28+
my $nprobe_port = 4096;
29+
30+
#############
31+
32+
my $max_queue_len = 32768;
33+
my $debug = 0;
34+
my $dump_file = "";
35+
36+
%options=();
37+
getopts("i:d:vh",\%options);
38+
39+
help() if defined $options{h};
40+
$debug = 1 if defined $options{v};
41+
$dump_file = $options{d} if defined $options{d};
42+
($nprobe_ip,$nprobe_port) = split(/:/, $options{i}) if defined $options{i};
43+
44+
############
45+
46+
my $bgp = Net::BGP::Process->new();
47+
my $peer = Net::BGP::Peer->new(
48+
Start => 1,
49+
ThisID => $local_ip,
50+
ThisAS => $local_as,
51+
PeerID => $remote_ip,
52+
PeerAS => $remote_as,
53+
Passive => 1,
54+
UpdateCallback => \&my_update_callback
55+
);
56+
57+
my $refresh = Net::BGP::Refresh->new(
58+
AFI => Net::BGP::AFI_IP4,
59+
SAFI => Net::BGP::SAFI_BOTH,
60+
);
61+
62+
my %as_paths = ();
63+
my $num_updates : shared = 0;
64+
my $num_dropped_updates : shared = 0;
65+
my $cmdQueue = Thread::Queue->new;
66+
67+
my $socket;
68+
69+
############################
70+
71+
sub openSocket() {
72+
$socket = IO::Socket::INET->new(PeerAddr => $nprobe_ip,
73+
PeerPort => $nprobe_port,
74+
Proto => "tcp");
75+
76+
if(defined $socket) {
77+
print "New socket open...\n";
78+
} else {
79+
print "Couldn't connect to $nprobe_host:$nprobe_port : $@\n";
80+
sleep 1;
81+
}
82+
}
83+
84+
sub processCmds {
85+
my $max_queue_len = 0;
86+
my $OUT;
87+
88+
if($dump_file ne "") {
89+
# Dump mode
90+
open OUT, '>', $dump_file or die $!;
91+
}
92+
93+
while (my $cmd = $cmdQueue->dequeue()) {
94+
my $num = $cmdQueue->pending();
95+
if($num > $max_queue_len) { $max_queue_len = $num; }
96+
if($debug) { print $cmd."\n"; }
97+
98+
if($dump_file ne "") {
99+
# Dump mode
100+
print OUT $cmd;
101+
} else {
102+
# Socket mode
103+
104+
if(not defined $socket) {
105+
openSocket();
106+
}
107+
108+
if(defined $socket) {
109+
my $bytes_sent = $socket->send($cmd);
110+
111+
if((not defined $bytes_sent) || ($bytes_sent == 0)) {
112+
print "Socket was closed by remote peer\n";
113+
close($socket);
114+
openSocket();
115+
}
116+
}
117+
}
118+
}
119+
}
120+
121+
my $i=0;
122+
my $num_threads = 1;
123+
124+
for($i=0; $i<$num_threads; $i++) {
125+
my $thr = threads->new(\&processCmds);
126+
$thr->detach; # Now we officially don't care any more
127+
}
128+
129+
############################
130+
131+
$bgp->add_peer($peer);
132+
$peer->refresh($refresh);
133+
$peer->start();
134+
$bgp->event_loop();
135+
136+
sub my_update_callback
137+
{
138+
my ($peer,$update) = @_;
139+
my %h;
140+
my $as_path;
141+
142+
#print "Update from [$peer][$update]\n";
143+
144+
################################
145+
146+
# Remove duplicates entries
147+
my @path = uniq(split(/ /, $update->{_as_path}));
148+
149+
#shift(@path); # Delete top element
150+
151+
my $target_as = $path[$#path];
152+
#pop(@path); # Delete last element from array (i.e. remove target_as)
153+
154+
if(!($target_as =~ m/^{/)) {
155+
my $old_val = $as_paths{$target_as};
156+
157+
# Format: (number of elements)@(elem 1),(elem 2)....
158+
$as_path = ($#path+1)."@".join(",", @path);
159+
160+
#print $as_path."\n";
161+
if($old_val ne $as_path) {
162+
$as_paths{$target_as} = $as_path;
163+
}
164+
165+
#if($debug) { print $as_path."\n"; } else { print "."; }
166+
} else {
167+
# Something bad happened
168+
return;
169+
}
170+
171+
########################
172+
173+
my @nlri = @{$update->nlri()};
174+
if($debug) { print "[$num_updates] [ "; }
175+
foreach (@nlri) {
176+
if($debug) { print $_." "; }
177+
my $net = $_;
178+
179+
if ($net =~ m/^(\d+)\.(\d+)\.(\d+)\.(\d+)\/(\d+)$/) {
180+
$cmd = "+".$net."=".$as_path."\n";
181+
if($debug) { print $cmd; }
182+
if($cmdQueue->pending() < $max_queue_len) {
183+
$cmdQueue->enqueue($cmd);
184+
$num_updates++;
185+
} else {
186+
$num_dropped_updates++;
187+
}
188+
}
189+
}
190+
191+
########################
192+
193+
my @withdrawn = @{$update->withdrawn()};
194+
if($debug) { print "[$num_updates] [ "; }
195+
foreach (@withdrawn) {
196+
if($debug) { print $_." "; }
197+
my $net = $_;
198+
199+
if ($net =~ m/^(\d+)\.(\d+)\.(\d+)\.(\d+)\/(\d+)$/) {
200+
$cmd = "-".$net."=".$as_path."\n";
201+
if($debug) { print $cmd; }
202+
203+
if($cmdQueue->pending() < $max_queue_len) {
204+
$cmdQueue->enqueue($cmd);
205+
$num_updates++;
206+
} else {
207+
$num_dropped_updates++;
208+
}
209+
}
210+
}
211+
212+
}
213+
214+
############
215+
216+
sub uniq {
217+
my %seen = ();
218+
my @r = ();
219+
foreach my $a (@_) {
220+
unless ($seen{$a}) {
221+
push @r, $a;
222+
$seen{$a} = 1;
223+
}
224+
}
225+
return @r;
226+
}
227+
228+
############
229+
230+
sub help {
231+
print "bgp_probe_client.pl [-i <probe host:port>] [-d <dump file>] [-v] [-h]\n";
232+
exit 0;
233+
}

‎splunk/README

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
Example of integration of nProbe with Splunk. This package is a slightly outdated and it should be updated, but it gives a good understanding how nProbe can interact with Splunk

‎splunk/create_spl.sh

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
#!/bin/bash
2+
tar -cvzf nprobe.tar.gz nprobe/
3+
mv nprobe.tar.gz nprobe.spl
4+
5+
# On Mac OS X, use gnutar rather than the default tar packaged with the OS. The default tar utility generates a series of warnings that can be problematic when packaging your app.

‎splunk/doc/Splunk App-QuickStart.zip

627 KB
Binary file not shown.

0 commit comments

Comments
 (0)