diff --git a/openwitness/pcap/urls.py b/openwitness/pcap/urls.py index 6f86933..18c2a65 100644 --- a/openwitness/pcap/urls.py +++ b/openwitness/pcap/urls.py @@ -8,6 +8,7 @@ url(r'^summary/$', view=summary, name='summary_pcap'), url(r'^summary/(?P\w+)/$', view=file_pcap_summary, name='file_pcap_summary'), url(r'^(?P\w+)/visualize/(?P\w+)/(?P\w+)/$', view=visualize, name='visualize_app_layer'), + url(r'^(?P\w+)/visualize/$', view=create_parallel_coordinates, name='parallel_coordinates'), url(r'^flow/(?P\w+)/$', view=flow_details, name='flow_details'), url(r'^get_pcap_url/(?P\w+)/$', view=get_pcap_url, name='get_pcap_url'), url(r'^info/(?P\w+)/$', view=get_packet_info, name='packet_info'), diff --git a/openwitness/pcap/views.py b/openwitness/pcap/views.py index 423c692..21288ce 100644 --- a/openwitness/pcap/views.py +++ b/openwitness/pcap/views.py @@ -6,7 +6,7 @@ import os import datetime import cgi -#import random +import random from django.http import Http404, HttpResponse from django.utils import simplejson as json from django.shortcuts import render_to_response @@ -941,4 +941,48 @@ def file_pcap_summary(request, hash_value): except Exception, ex: log.message(ex) - raise Http404 \ No newline at end of file + raise Http404 + +def create_parallel_coordinates(request, flow_pcap_md5): + parent_flow = Flow.objects.get(hash_value=flow_pcap_md5) + flows = FlowDetails.objects.filter(parent_hash_value=flow_pcap_md5) + # name group source_port destination_port protocol + # 192.168.1.1:80-192.168.1.2:81,http,80,81 + result = [] + color_label = dict() + for flow in flows: + src_id = ":".join([flow.src_ip, str(flow.sport)]) + dst_id = ":".join([flow.dst_ip, str(flow.dport)]) + id = "-".join([src_id, dst_id]) + value = ",".join([id, flow.protocol, str(flow.sport), str(flow.dport)]) + result.append(value) + + #create the colors + if not color_label.has_key(flow.protocol): + color_value = [random.randrange(255), random.randrange(255), random.randrange(255)] + color_label[flow.protocol] = color_value + + color_dict = json.dumps(color_label) + csv_dir = os.path.join(settings.PROJECT_ROOT, "csv_files") + csv_file = tempfile.NamedTemporaryFile(mode="w", dir=csv_dir, delete=False) + csv_file.write("\"name\",\"group\",\"src_port\",\"dst_port\"") + csv_file.write("\n") + + file_name = os.path.basename(csv_file.name) + content = "\n".join(result) + csv_file.write(content) + csv_file.close() + context = dict() + context['flow'] = parent_flow + context['hash_value'] = flow_pcap_md5 + context['csv_file_url'] = os.path.join(settings.ALTERNATE_BASE_URL, "csv_media", file_name) + context['pcap_operation'] = "parallel_coordinates" + context['colors'] = color_dict + + return render_to_response("pcap/file_parallel_coordinates.html", + context_instance=RequestContext(request, context)) + + + + + diff --git a/openwitness/templates/base/base.html b/openwitness/templates/base/base.html index 035989e..5251db9 100644 --- a/openwitness/templates/base/base.html +++ b/openwitness/templates/base/base.html @@ -132,6 +132,12 @@ {% endifequal %} + {% ifequal pcap_operation "parallel_coordinates" %} + + + + {% endifequal %} + @@ -462,6 +468,735 @@ + +{% endifequal %} + +{% ifequal pcap_operation "parallel_coordinates" %} + {% endifequal %} diff --git a/openwitness/templates/pcap/file_details.html b/openwitness/templates/pcap/file_details.html index 50560e3..07bb909 100644 --- a/openwitness/templates/pcap/file_details.html +++ b/openwitness/templates/pcap/file_details.html @@ -16,7 +16,7 @@ Summary
  • - Visualize + Visualize
    • diff --git a/openwitness/templates/pcap/file_parallel_coordinates.html b/openwitness/templates/pcap/file_parallel_coordinates.html new file mode 100644 index 0000000..bde714b --- /dev/null +++ b/openwitness/templates/pcap/file_parallel_coordinates.html @@ -0,0 +1,71 @@ +{% extends "base/layout-summary.html" %} + + +{% block content %} +
    + + {% include "pcap/__file_details_prefix.html" %} + +
    +
    + +
    +
    + +
    +
    + +
    + + + + +
    +
    +
    + +
    +
    + + + +

    Protocol Groups

    +

    +

    +
    +
    +

    Sample of 25 entries

    +

    +

    +
    +
    + + +
    + +{% endblock %} diff --git a/openwitness/templates/pcap/file_summary.html b/openwitness/templates/pcap/file_summary.html index e37b29f..89bc499 100644 --- a/openwitness/templates/pcap/file_summary.html +++ b/openwitness/templates/pcap/file_summary.html @@ -16,7 +16,7 @@ Summary
  • - Visualize + Visualize
    • diff --git a/openwitness/urls.py b/openwitness/urls.py index 80eaab3..9a249b1 100644 --- a/openwitness/urls.py +++ b/openwitness/urls.py @@ -54,6 +54,8 @@ {'document_root': settings.MEDIA_ROOT, 'show_indexes': True}), (r'^json_media/(?P.*)$', 'django.views.static.serve', {'document_root': settings.JSON_ROOT, 'show_indexes': True}), + (r'^csv_media/(?P.*)$', 'django.views.static.serve', + {'document_root': settings.CSV_ROOT, 'show_indexes': True}), (r'^uploads/(?P.*)$', 'django.views.static.serve', {'document_root': settings.UPLOAD_ROOT, 'show_indexes': True}), )