Pyscanlogger - Python Port scan detector (Python recipe) by Anand

ActiveState Code (http://code.activestate.com/recipes/576690/)

#!/usr/bin/env python
"""
pyscanlogger: Simple port scan detector/logger tool, inspired
by scanlogd {http://www.openwall.com/scanlogd}


"""

import sys, os
import dpkt, pcap
import struct
import socket
import time
import threading
import optparse


# UDP - in progress...

SCAN_TIMEOUT = 5
WEIGHT_THRESHOLD = 25
PIDFILE="/var/run/pyscanlogger.pid"

# TCP flag constants
TH_URG=dpkt.tcp.TH_URG
TH_ACK=dpkt.tcp.TH_ACK
TH_PSH=dpkt.tcp.TH_PUSH
TH_RST=dpkt.tcp.TH_RST
TH_SYN=dpkt.tcp.TH_SYN
TH_FIN=dpkt.tcp.TH_FIN

# Protocols
TCP=dpkt.tcp.TCP
UDP=dpkt.udp.UDP

get_timestamp = lambda : time.strftime('%Y-%m-%d %H:%M:%S', time.localtime())

class ScanEntry(object):
    """ Port scan entry """
    
    def __init__(self, hash):
        self.src = 0
        self.dst = 0
        self.timestamp = 0
        self.logged = False
        self.type = ''
        self.tcpflags_or = 0
        self.weight = 0
        self.ports = []
        self.next = None
        self.hash = hash

class EntryLog(dict):
    """ Modified dictionary class with fixed size, which
    automatically removes oldest items """

    # This will work only if the value is an object storing
    # its key in the 'hash' attribute and links to other
    # objects usin the 'next' attribute.
    def __init__(self, maxsz):
        self.oldest = None
        self.last = None
        self.maxsz = maxsz
        super(EntryLog, self).__init__()

    def __setitem__(self, key, value):
        if not self.__contains__(key) and len(self)==self.maxsz:
            # Remove oldest
            if self.oldest:
                self.__delitem__(self.oldest.hash)
                self.oldest = self.oldest.next
        
        super(EntryLog, self).__setitem__(key,value)

        if self.last:
            self.last.next = value
            self.last = value
        else:
            self.last = value
            self.oldest = self.last

    
class TimerList(list):
    """ List class of fixed size with entries that time out automatically """

    def __getattribute__(self, name):
        if name in ('insert','pop','extend'):
            raise NotImplementedError
        else:
            return super(TimerList, self).__getattribute__(name)
        
    def __init__(self, maxsz, ttl):
        # Maximum size
        self.maxsz = maxsz
        # Time to live for every entry
        self.ttl = ttl

    def append(self, item):
        """ Append an item to end """

        if len(self)<self.maxsz:
            # We append the time-stamp with the item
            super(TimerList, self).append((time.time(), item))
        else:
            n=self.collect()
            if n:
                # Some items removed, so append
                super(TimerList, self).append((time.time(), item))
            else:
                raise ValueError,'could not append item'
            
    def collect(self):
        """ Collect and remove aged items """
        
        t=time.time()
        old = []
        for item in self:
            if (t-item[0])>self.ttl:
                old.append(item)

        
        for item in old:
            self.remove(item)

        return len(old)

    # Access functions
    def __getitem__(self, index):
        item = super(TimerList, self).__getitem__(index)
        return item[1]

    def __setitem__(self,  index, item):
        # Allow only tuples with time-stamps >= current time-stamp as 1st member
        if type(item) == tuple and len(item) == 2  and type(item[0]) == float and item[0]>=time.time():
            super(TimerList, self).__setitem__(index, item)
        else:
            raise TypeError, 'invalid entry'

    def __contains__(self, item):

        items = [rest for (tstamp,rest) in self]
        return item in items
    
class ScanLogger(object):
    """ Port scan detector/logger """
    
    # TCP flags to scan type mapping
    scan_types = {0: 'TCP null',
                  TH_FIN: 'TCP fin',
                  TH_SYN: 'TCP syn', TH_SYN|TH_RST: 'TCP syn',
                  TH_ACK: 'TCP ack',
                  TH_URG|TH_PSH|TH_FIN: 'TCP x-mas', TH_URG|TH_PSH|TH_FIN|TH_ACK: 'TCP x-mas',
                  TH_SYN|TH_FIN: 'TCP syn/fin',
                  TH_FIN|TH_ACK: 'TCP fin/ack',
                  TH_SYN|TH_ACK|TH_RST: 'TCP full-connect',
                  TH_URG|TH_PSH|TH_ACK|TH_RST|TH_SYN|TH_FIN: 'TCP all-flags' } 
                  
    def __init__(self, timeout, threshold, maxsize, daemon=True, logfile='/var/log/scanlog'):
        self.scans = EntryLog(maxsize)
        # Port scan weight threshold
        self.threshold = threshold
        # Timeout for scan entries
        self.timeout = timeout
        # Daemonize ?
        self.daemon = daemon
        # Log file
        try:
            self.scanlog = open(logfile,'a')
        except (IOError, OSError), (errno, strerror):
            print "Error opening scan log file %s => %s" % (logfile, strerror)
            self.scanlog = None
            
        # Recent scans - this list allows to keep scan information
        # upto last 'n' seconds, so as to not call duplicate scans
        # in the same time-period. 'n' is 60 sec by default.

        # Since entries time out in 60 seconds, max size is equal
        # to maximum such entries possible in 60 sec - assuming
        # a scan occurs at most every 5 seconds, this would be 12.
        self.recent_scans = TimerList(12, 60.0)
        
    def hash_func(self, addr):
        """ Hash a host address """
        
        value = addr
        h = 0
    
        while value:
            # print value
            h ^= value
            value = value >> 9
        
        return h & (8192-1)

    def host_hash(self, src, dst):
        """ Hash mix two host addresses """

        return self.hash_func(src)^self.hash_func(dst)

    def log_scan(self, scan, continuation=False):
        """ Log the scan to file and/or console """

        srcip, dstip = socket.inet_ntoa(struct.pack('I',scan.src)), socket.inet_ntoa(struct.pack('I',scan.dst))
        ports = ','.join([str(port) for port in scan.ports])
        
        if not continuation:
            line = '[%s]: %s scan (flags:%d) from %s to %s (ports:%s)' % (get_timestamp(),
                                                                          scan.type,
                                                                          scan.tcpflags_or,
                                                                          srcip,
                                                                          dstip,
                                                                          ports)
        else:
            line = '[%s]: Continuation of %s scan from %s to %s (ports:%s)' % (get_timestamp(),
                                                                               scan.type,
                                                                               srcip,
                                                                               dstip,
                                                                               ports)
                                                                             
        if self.scanlog:
            self.scanlog.write(line + '\n')
            self.scanlog.flush()

        if not self.daemon:
            print line
                  
    def process(self, pkt):

        if not hasattr(pkt, 'ip'):
            return

        ip = pkt.ip
        # Ignore non-tcp, non-udp packets
        if type(ip.data) not in (TCP, UDP):
            return

        pload = ip.data
        src,dst,dport,flags = int(struct.unpack('I',ip.src)[0]),int(struct.unpack('I', ip.dst)[0]),int(pload.dport),0
        proto = type(pload)
        
        if proto == TCP: flags = pload.flags
        key = self.host_hash(src,dst)

        curr=time.time()

        # Keep dropping old entries
        self.recent_scans.collect()
        
        if key in self.scans:
            scan = self.scans[key]

            if scan.src != src:
                # Skip packets in reverse direction or invalid protocol
                return
                
            # Update only if not too old, else skip and remove entry
            if curr - scan.timestamp > self.timeout:
                del self.scans[key]
                return

            if scan.logged: return
            
            # Update TCP flags if existing port
            if dport in scan.ports:
                # Same port, update flags
                scan.tcpflags_or |= flags
                return
                
            scan.timestamp = curr
            scan.tcpflags_or |= flags
            scan.ports.append(dport)

            # Add weight for port
            if dport < 1024:
                scan.weight += 3
            else:
                scan.weight += 1
            
            if scan.weight>=self.threshold:
                scan.logged = True
                if proto==TCP:
                    scan.type = self.scan_types.get(scan.tcpflags_or,'unknown')
                elif proto==UDP:
                    scan.type = 'UDP'
                    # Reset flags for UDP scan
                    scan.tcpflags_or = 0
                    
                # See if this was logged recently
                scanentry = (key, scan.type, scan.tcpflags_or)
                
                if scanentry not in self.recent_scans:
                    self.log_scan(scan)
                    self.recent_scans.append(scanentry)
                else:
                    self.log_scan(scan, True)
                        
        else:
            # Add new entry
            scan = ScanEntry(key)
            scan.src = src
            scan.dst = dst
            scan.timestamp = curr
            scan.tcpflags_or |= flags
            scan.ports.append(dport)
            self.scans[key] = scan
            
    def log(self):
        
        pc = pcap.pcap()
        decode = { pcap.DLT_LOOP:dpkt.loopback.Loopback,
                   pcap.DLT_NULL:dpkt.loopback.Loopback,
                   pcap.DLT_EN10MB:dpkt.ethernet.Ethernet } [pc.datalink()]

        try:
            print 'listening on %s: %s' % (pc.name, pc.filter)
            for ts, pkt in pc:
                self.process(decode(pkt))
        except KeyboardInterrupt:
            if not self.daemon:
                nrecv, ndrop, nifdrop = pc.stats()
                print '\n%d packets received by filter' % nrecv
                print '%d packets dropped by kernel' % ndrop

    def run_daemon(self):
        # Disconnect from tty
        try:
            pid = os.fork()
            if pid>0:
                sys.exit(0)
        except OSError, e:
            print >>sys.stderr, "fork #1 failed", e
            sys.exit(1)

        os.setsid()
        os.umask(0)

        # Second fork
        try:
            pid = os.fork()
            if pid>0:
                open(PIDFILE,'w').write(str(pid))
                sys.exit(0)
        except OSError, e:
            print >>sys.stderr, "fork #2 failed", e
            sys.exit(1)
            
        self.log()
        
    def run(self):
        # If dameon, then create a new thread and wait for it
        if self.daemon:
            print 'Daemonizing...'
            self.run_daemon()
        else:
            # Run in foreground
            self.log()

def main():
    
    if os.geteuid() != 0:
        sys.exit("You must be super-user to run this program")
        
    o=optparse.OptionParser()
    o.add_option("-d", "--daemonize", dest="daemon", help="Daemonize",
                 action="store_true", default=False)
    o.add_option("-f", "--logfile", dest="logfile", help="File to save logs to",
                 default="/var/log/scanlog")
    
    options, args = o.parse_args()
    s=ScanLogger(SCAN_TIMEOUT, WEIGHT_THRESHOLD, 8192, options.daemon, options.logfile)
    s.run()
    
if __name__ == '__main__':
    main()