Subversion Repositories ALCASAR

Rev

Rev 2887 | Go to most recent revision | Only display areas with differences | Ignore whitespace | Details | Blame | Last modification | View Log

Rev 2887 Rev 2888
1 
#!/bin/bash
 1 
#!/bin/bash
2 
 
 2 
 
3 
# alcasar-iot_capture.sh
 3 
# alcasar-iot_capture.sh
4 
# by Guillaume Gellusseau, Dorian Lemoine & REXY
 4 
# by Guillaume Gellusseau, Dorian Lemoine & REXY
5 
# This script is distributed under the Gnu General Public License (GPL)
 5 
# This script is distributed under the Gnu General Public License (GPL)
6 
 
 6 
 
7 
# Ce script lance une capture de flux réseau en fonction d'une adresse IP source ($1)
7 
# Ce script lance une capture de flux réseau en fonction d'une adresse IP source ($1)
8 
# This script performs a network flow capture based on source ip address ($1)
8 
# This script performs a network flow capture based on source ip address ($1)
9 
 
 9 
 
10 
CONF_FILE="/usr/local/etc/alcasar.conf"
 10 
CONF_FILE="/usr/local/etc/alcasar.conf"
11 
INTIF=`grep ^INTIF= $CONF_FILE|cut -d"=" -f2`				# INTernal InterFace
 11 
INTIF=`grep ^INTIF= $CONF_FILE|cut -d"=" -f2`
- 
 
 12 
PRIVATE_IP=$(grep ^PRIVATE_IP= $CONF_FILE | cut -d'=' -f2 | cut -d'/' -f1)
12 
 
 13 
 
13 
function info
 14 
function info
14 
{
 15 
{
15 
	_PID=$(ps -ef | grep tcpdump | grep $1 | awk {'print $2'})
 16 
	_PID=$(ps -ef | grep tcpdump | grep $1 | awk {'print $2'})
16 
	if [[ -n $_PID ]]
 17 
	if [[ -n $_PID ]]
17 
	then
 18 
	then
18 
		echo "CaptureON"
 19 
		echo "CaptureON"
19 
	else
 20 
	else
20 
		echo "CaptureOFF"
 21 
		echo "CaptureOFF"
21 
	fi
22 
	fi
22 
}
 23 
}
23 
 
 24 
 
24 
function kill
 25 
function kill
25 
{
 26 
{
26 
	_PID=$(ps -ef | grep tcpdump | grep $1 | awk {'print $2'})
 27 
	_PID=$(ps -ef | grep tcpdump | grep $1 | awk {'print $2'})
27 
	sudo kill -2 $_PID
 28 
	sudo kill -2 $_PID
28 
}
 29 
}
29 
 
 30 
 
30 
function launch
 31 
function launch
31 
{
 32 
{
- 
 
 33 
# capture only one @MAC, on $INTIF, max filesize=10M, without flows to PRIVATE_IP except DNS
32 
	tcpdump ether host $1 -i $INTIF -n -w /var/Save/iot_captures/$1.pcap
 34 
	tcpdump "ether host $1 && (host $PRIVATE_IP && port 53) || host not $PRIVATE_IP" -i $INTIF -n -C 10 -W 1 -w /var/Save/iot_captures/$1.pcap
33 
}
 35 
}
34 
 
 36 
 
35 
function flush
 37 
function flush
36 
{
 38 
{
37 
	sudo rm /var/Save/iot_captures/$1.pcap -f
 39 
	sudo rm /var/Save/iot_captures/$1.pcap -f
38 
}
 40 
}
39 
 
 41 
 
40 
 
 42 
 
41 
while getopts "l k i f" option; do
 43 
while getopts "l k i f" option; do
42 
 
 44 
 
43 
	case "${option}" in
 45 
	case "${option}" in
44 
 
 46 
 
45 
		l)
 47 
		l)
46 
			launch $2
 48 
			launch $2
47 
			;;
 49 
			;;
48 
		k)
 50 
		k)
49 
			kill $2
 51 
			kill $2
50 
			;;
 52 
			;;
51 
		i)
 53 
		i)
52 
			info $2
 54 
			info $2
53 
			;;
 55 
			;;
54 
		f)
 56 
		f)
55 
			flush $2
 57 
			flush $2
56 
			;;
 58 
			;;
57 
	esac
 59 
	esac
58 
done
 60 
done
59 
 
 61 
 
60 
#End
 62 
#End
61 
 
 63 
 
62 
 
 64 
 
63 
Generated by GNU Enscript 1.6.6.
 65 
Generated by GNU Enscript 1.6.6.
64 
 
 66 
 
65 
 
 67 
 
66 
 
 68