Difference between revisions of "Useful Functions"
From Observer GigaFlow Support | VIAVI Solutions Inc.
Kevin Wilkie (Talk | contribs) |
Kevin Wilkie (Talk | contribs) |
||
Line 201: | Line 201: | ||
//actions.sendMail('emailaddress@emailaddress.here', 'Potential new devices' ,message); | //actions.sendMail('emailaddress@emailaddress.here', 'Potential new devices' ,message); | ||
function isAlive(ip){ | function isAlive(ip){ | ||
− | + | var results=new jsonarray(true); | |
− | + | utils.tcpPortTest(results,ip,portsToTest,100,10); | |
− | + | for (var j=0;j<results.length();j++){ | |
− | + | var entry =results.getJSONObject(j); | |
− | + | if (entry.getInt("response")>-1){ | |
log.warn(entry); | log.warn(entry); | ||
return true; | return true; |
Revision as of 13:48, 29 June 2018
Sleep
function sleep(delay) { var start = new Date().getTime(); while (new Date().getTime() < start + delay); }
Adding Attributes, automaticaly creating the category if it doesn't exists
actions.addIPAttribute("172.21.40.14","State","New York"); //Add "New York" Attribute to "State" category for this ip actions.addMACAttribute("a4:ba:db:ff:18:bc","State","Washington"); //Add "Washington" Attribute to "State" category for this mac actions.addMACAttribute("a4:ba:db:ff:18:bc","City","Colorado");
JSON access to data
var utils = Java.type('ros.CROSUtils'); var json = utils.getJSONFromString(data.get("fields").get(0)); log.warn(json.getString('field_1')); log.warn(json.getString('field_2'));
Base64 encoding and decoding
var utils = Java.type('ros.CROSUtils'); var user='Kevin' var password = '!£$%^&*()1234kevin' var encodeduser=utils.base64EncodeString(user); var encodedpass=utils.base64EncodeString(password); var decodeduser=utils.base64DecodeString(encodeduser); var decodedpass=utils.base64DecodeString(encodedpass); log.warn("user:"+user+" password:"+password+" encodeduser:"+encodeduser+" encodedpass:"+encodedpass) log.warn("user:"+user+" password:"+password+" decodeduser:"+decodeduser+" decodedpass:"+decodedpass) //Output= user:Kevin password:!£$%^&*()1234kevin encodeduser:S2V2aW4= encodedpass:IcKjJCVeJiooKTEyMzRrZXZpbg== //Output= user:Kevin password:!£$%^&*()1234kevin decodeduser:Kevin decodedpass:!£$%^&*()1234kevin
Http Post with attributes
var utils = Java.type('ros.CROSUtils'); var thisurl = 'https://jsonplaceholder.typicode.com/posts/1'; var user='Kevin' var password = '!£$%^&*()1234kevin' var encodeduser=utils.base64EncodeString(user); var encodedpass=utils.base64EncodeString(password); var decodeduser=utils.base64DecodeString(encodeduser); var decodedpass=utils.base64DecodeString(encodedpass); log.warn("user:"+user+" password:"+password+" encodeduser:"+encodeduser+" encodedpass:"+encodedpass) log.warn("user:"+user+" password:"+password+" decodeduser:"+decodeduser+" decodedpass:"+decodedpass) //log.warn(utils.HTTPSClientGet(thisurl)) log.warn(utils.HTTPSClientPost("http://jsonplaceholder.typicode.com/posts",[["title","fook"],["body","bark"],["userId","1"]]));
Live DNS lookups
var InetSocketAddress = Java.type('java.net.InetSocketAddress'); var hostname = new InetSocketAddress("172.21.40.14",0).getAddress().getCanonicalHostName(); log.warn(hostname);
Cached DNS lookups
var hostname = actions.dnsCache.resolve("172.21.40.14").name; log.warn(hostname);
See if an ip address is within a range using isIPInRange function
var utils = Java.type('ros.CROSUtils'); log.warn("new arp "+ data.get("display")+" "+data.get("ifdisplay")+" "+data.get("ip")+" "+data.get("macAddress")+" "+data.get("seenIPAddress")+ " "+utils.isIPInRange(data.get("seenIPAddress"),"172.21.40.0","172.21.40.254"));
Sending Syslog Messages
actions.ros.getSyslogSender().send("test");
Searching for IP addresses seen
var utils = Java.type('ros.CROSUtils'); log.warn(actions.allIPs.size()) for (var i=0;i<255;i++){ checkAddress("172.21.40."+i); } function checkAddress(address){ if (actions.allIPs.containsKey(utils.inet_atob(address))){ log.warn("seen "+address+" "+actions.allIPs.get(utils.inet_atob(address))) }else{ log.warn("didnt see "+address); } }
Resolve DNS
function getDNS(ip){ log.warn("getDNS:"+actions.dnsCache.cache.size()); log.warn("getDNS:\""+ip+"\""); var ret = actions.dnsCache.resolve(ip); log.warn(ret); log.warn(ret.name); log.warn(ret.ip); log.warn(ret.resolved); if (ret==null||typeof ret==='undefined'){ return ""; } if (ret.name!==ip){ log.warn(ret); return "Hostname:"+ret.name; } return ""; }
Clear empty tables
var query = "SELECT nspname || '.' || relname AS \"relation\", pg_size_pretty(pg_relation_size(C.oid)) AS \"size\" FROM pg_class C LEFT JOIN pg_namespace N ON (N.oid = C.relnamespace) " +"WHERE nspname NOT IN ('pg_catalog', 'information_schema') " +"and relname like 'netflow________%' " +"and pg_relation_size(C.oid)=0 " +"ORDER BY pg_relation_size(C.oid) asc;" var cuttofftime = (new Date().getTime())-(1000*60*60*24*4); var cuttoffwindow=1000*60*60*24; log.warn(cuttofftime+" "+cuttoffwindow); log.warn("Clean empty tables, start"); var rows = actions.getDatabaseManager().getVectorFromDBprepared(query,[]) log.warn("Clean empty tables, rows:"+rows.size()); var countremove=0; var countskipped=0; for (var i=0;i<rows.length;i++){ var fields=rows[i][0].split("_"); if ((((parseInt(fields[4])+parseInt(fields[5]))<cuttofftime))){ var rowcount=actions.getDatabaseManager().getLongFromDB("select count(*) from "+rows[i][0],0) if (rowcount==0){ countremove++; log.warn("Clean empty tables, removing:" +rows[i][0]+" 0:"+fields[0]+" 1:"+fields[1]+" 2:"+fields[2]+" 3:"+fields[3]+" 4:"+fields[4]+" 5:"+fields[5]); actions.getDatabaseManager().executePrepared("drop table "+rows[i][0],[]) }else{ log.warn("Clean empty tables, not removing unempty taable:" +rows[i][0]+" 0:"+fields[0]+" 1:"+fields[1]+" 2:"+fields[2]+" 3:"+fields[3]+" 4:"+fields[4]+" 5:"+fields[5]+" rowcount"+rowcount); } }else{ countskipped++; log.warn("Clean empty tables, skipping: "+rows[i][0]+" 0:"+fields[0]+" 1:"+fields[1]+" 2:"+fields[2]+" 3:"+fields[3]+" 4:"+fields[4]+" 5:"+fields[5]+" time:" +(parseInt(fields[4])<cuttofftime)+" window:"+(parseInt(fields[5])<cuttoffwindow)+" "+(parseInt(fields[4])+parseInt(fields[5]))+" "+(((parseInt(fields[4])+parseInt(fields[5]))<cuttofftime))); } } log.warn("Clean empty tables, removed:"+countremove+" skipped:"+countskipped); log.warn("Clean empty tables, vacuuming:pg_catalog.pg_inherits"); actions.getDatabaseManager().executePrepared("vacuum full pg_catalog.pg_inherits;",[]) log.warn("Clean empty tables, vacuuming:pg_catalog.pg_constraint"); actions.getDatabaseManager().executePrepared("vacuum full pg_catalog.pg_constraint;",[]) log.warn("Clean empty tables, vacuuming:pg_catalog.pg_depend"); actions.getDatabaseManager().executePrepared("vacuum full pg_catalog.pg_depend;",[]) log.warn("Clean empty tables, Done");
Disable autovacuum,
var query = "SELECT nspname || '.' || relname AS \"relation\" FROM pg_class C LEFT JOIN pg_namespace N ON (N.oid = C.relnamespace) " +"WHERE nspname NOT IN ('pg_catalog', 'information_schema') " +"and relname like 'netflow________%';" var rows = actions.getDatabaseManager().getVectorFromDBprepared(query,[]) log.warn("Setting tables, rows:"+rows.size()); var count=0; for (var i=0;i<rows.length;i++){ count++; log.warn("Setting tables :"+count+" "+rows[i][0]); actions.getDatabaseManager().executePrepared("alter table "+rows[i][0]+" set (autovacuum_enabled = false, toast.autovacuum_enabled = false)",[]) } log.warn("Setting tables, donw:"+count);
SNMP To A Device
var BigInteger = Java.type("java.math.BigInteger"); var rosutils = Java.type('ros.CROSUtils'); var PrintWriter = Java.type('java.io.PrintWriter'); var writer = new PrintWriter("./resources/webapps/static/softwareversions.html", "UTF-8"); writer.println("<html>"); writer.println("<head>"); writer.println("<link href='/static/css/jquery.dataTables.css' rel='stylesheet'>");writer.println("<link href='/static/css/dashboard.css' rel='stylesheet'>"); writer.println("</head>");writer.println("<body>
IP | Name | OID | Version | Description |
---|---|---|---|---|
"+thisDevice.getIP()+" | "+thisDevice.getName()+" | "+thisDevice.getSysOID()+" | "+actions.querySNMPText(thisDevice, '.1.3.6.1.4.1.9.6.1.101.2.16.1.1.5.1', -1)+" | "+thisDevice.getSysDescr()+" |
writer.close();
Processing synner data
//This script should be set to run every minute //It will find the syn sources matching the required thresholds so that additional actions are performed var utils = Java.type('ros.CROSUtils'); //load utility classes var upperPortCountThreshold=15; //set upper boundary, only synners who probe less than this number are eligible var lowerPortCountThreshold=1; // set lower boundary, only synners who probe more than this number are eligible var ipCount=1; //Set unique IP destination count to match for for (var synner in actions.ros.synMonitor.synners){ //process all source synners. Sinner field contains this synners ip. var synEntry=actions.ros.synMonitor.synners.get(synner); //get sinner object for current synner ip if (!synEntry.ipAlerted){ //if this entry hasn’t been alerted on already if (synEntry.getIps()==ipCount&&synEntry.getDstports()>lowerPortCountThreshold&&synEntry.getDstports()<upperPortCountThreshold){ //check the thresholds log.warn("Synner:"+utils.inet_btoa(synner)+" synCount:"+synEntry.getSyncount()+" Unique IPs:"+synEntry.getIps()+" UniquePorts:"+synEntry.getDstports()); //log out ematching details //Preform actions synEntry.ipAlerted=true; //set this sinner as if it has alerted already so we don’t reprocess it. } } }
Find Un-managed Devices
var utils = Java.type('ros.CROSUtils'); var BigDecimal=Java.type("java.math.BigDecimal") var BigInteger=Java.type("java.math.BigInteger") var Integer = Java.type("java.lang.Long") var Integer = Java.type("java.lang.Integer") var jsonarray = Java.type('org.json.JSONArray'); var portsToTest=[22,80,21] var message="Unmanaged devices"; addSubnet("172.21.21.20/24"); addSubnet("172.21.50.0/24"); //addSubnet("1.0.0.0/29"); //addSubnet("192.168.1.0/24"); log.warn(message); //actions.sendMail('emailaddress@emailaddress.here', 'Potential new devices' ,message); function isAlive(ip){ var results=new jsonarray(true); utils.tcpPortTest(results,ip,portsToTest,100,10); for (var j=0;j<results.length();j++){ var entry =results.getJSONObject(j); if (entry.getInt("response")>-1){ log.warn(entry); return true; }
}
return false; } function addSubnet(subnet){ var d = utils.getIPRange(subnet.split("/"))
//log.warn(utils.inet_btoa(d[0])+" - "+utils.inet_btoa(d[1]));
for (var i=d[0];i.compareTo(d[1])<1;i=i.add(BigInteger.ONE)){ if (actions.getDevice(utils.inet_btoa(i))!==null){ //log.warn(utils.inet_btoa(i)+" is already managed") }else{ if (isAlive(utils.inet_btoa(i))){ message+=utils.inet_btoa(i)+" is on the network and unmanaged
" log.warn(utils.inet_btoa(i)+" "+isAlive(utils.inet_btoa(i))) } } } log.warn(d); }