D4
/
analyzer-d4-passivedns
mirror of https://github.com/D4-project/analyzer-d4-passivedns
2
0
Fork 0
Code Issues Releases Wiki Activity

chg: [pdns] expiration of specific record type added

pull/3/head
Alexandre Dulaunoy 2019-04-01 20:31:40 +02:00
parent 4a0b2c81c5
commit 94042a198e
No known key found for this signature in database
GPG Key ID: 09E2CD4944E6CBCD
1 changed files with 18 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

21
bin/pdns-ingestion.py
View File

@ -105,31 +105,46 @@ while (True):
if rdns['q'] and rdns['type']:
for y in expirations:
if y[0] == rdns['type']:
expiration=y[1]
else:
expiration=None
expiration=y[1]
if rdns['type'] == '16':
rdns['v'] = rdns['v'].replace("\"", "", 1)
query = "r:{}:{}".format(rdns['q'],rdns['type'])
logger.debug('redis sadd: {} -> {}'.format(query,rdns['v']))
r.sadd(query, rdns['v'])
if expiration:
logger.debug("Expiration {} {}".format(expiration, query))
r.expire(query, expiration)
res = "v:{}:{}".format(rdns['v'], rdns['type'])
logger.debug('redis sadd: {} -> {}'.format(res,rdns['q']))
r.sadd(res, rdns['q'])
if expiration:
logger.debug("Expiration {} {}".format(expiration, query))
r.expire(res, expiration)
firstseen = "s:{}:{}:{}".format(rdns['q'], rdns['v'], rdns['type'])
if not r.exists(firstseen):
r.set(firstseen, rdns['timestamp'])
logger.debug('redis set: {} -> {}'.format(firstseen, rdns['timestamp']))
if expiration:
logger.debug("Expiration {} {}".format(expiration, query))
r.expire(firstseen, expiration)
lastseen = "l:{}:{}:{}".format(rdns['q'], rdns['v'], rdns['type'])
last = r.get(lastseen)
if last is None or int(last) < int(rdns['timestamp']):
r.set(lastseen, rdns['timestamp'])
logger.debug('redis set: {} -> {}'.format(lastseen, rdns['timestamp']))
if expiration:
logger.debug("Expiration {} {}".format(expiration, query))
r.expire(query, expiration)
occ = "o:{}:{}:{}".format(rdns['q'], rdns['v'], rdns['type'])
r.incr(occ, amount=1)
if expiration:
logger.debug("Expiration {} {}".format(expiration, query))
r.expire(occ, expiration)
# TTL, Class, DNS Type distribution stats