analyze.py

#!/usr/bin/python -tt

# You have been asked to investigate an incident.  The business unit provided a log file (drops.csv) for your investigation.  Use the skeleton framework to:
# 1) What are the top 10 destination ports that are dropped?
# 2) Identify the top 10 source addresses that are generating drops (and the number of drops for the top 10) but do *NOT* count RFC1918 addresses
# 3) Identify the top 10 class C SUBNETS that are generating drops (and the number of drops for the top 10 subnets)


import re
from IPy import IP
from netaddr import IPNetwork, IPAddress

private_ranges = [IP('10.0.0.0/8'), IP('172.16.0.0/12'), IP('192.168.0.0/16')]

def open_file():
    f = open('drops.csv', 'r')
    return f
    f.close()

def get_count(row_count_tuple):
  """Returns the count from a dict word/count tuple  -- used for custom sort."""
  return row_count_tuple[1]


def is_private(addr):
    return any(addr in range for range in private_ranges)


def top_ports():
# What are the top 10 destination ports that are dropped?
# +++your code here+++
    mydict = {}
    f = open_file()

    for line in f:
        lines = line.split(',')
        for word in lines[2:-2]:
            if not word in mydict:
                mydict[word] = 1
            else:
                mydict[word] = mydict[word] +1
    tops = mydict
    items = sorted(tops.items(), key=get_count, reverse=True)
    print '-----------'
    print 'Top 10 Dst Ports'
    print '-----------'
    for item in items[:10]:
        print item[0]


def top_external_addresses():
# Identify the top 10 source addresses that are generating drops (and the number of drops for the top 10) but do *NOT* count RFC1918 addresses
# +++your code here+++
    mydict = {}
    f = open_file()

    for line in f:
        lines = line.split(',')
        for top_src_addr in lines[3:-1]:
            if not top_src_addr in mydict:
                mydict[top_src_addr] = 1
            else:
                mydict[top_src_addr] = mydict[top_src_addr] +1
    tops = mydict
    items = sorted(tops.items(), key=get_count, reverse=True)

    print '-----------'
    print 'Top 10 Src Addr'
    print 'Address Count'
    print '-----------'

    for item in items[:34]:
        k = is_private(item[0])
        if k != True:
            print item[0],
            print '  ',
            print item[1]


def top_subnets():
# Identify the top 10 class C SUBNETS that are generating drops (and the number of drops for the top 10 subnets)
# +++your code here+++

    mydict = {}
    f = open_file()

    for line in f:
        lines = line.split(',')
        lala = lines.remove(lines[2])

        for top_src_addr in lines[1:2]:
            if not top_src_addr in mydict:
                mydict[top_src_addr] = 1
            else:
                mydict[top_src_addr] = mydict[top_src_addr] +1
    tops = mydict
    items = sorted(tops.items(), key=get_count, reverse=True)

    print '-----------'
    print 'Top 10 class C Subnets'
    print 'Address Count'
    print '-----------'

    for item in items[:41]:
        if IPAddress(item[0]) in IPNetwork("192.168.0.0/3"):
            print item[0],
            print '  ',
            print item[1]

###
def main():
    top_ports()
    top_external_addresses()
    top_subnets()

if __name__ == '__main__':
  main()