public void ShouldParseLinuxPid()
{
const string Input = @"tcp 0 0 1.2.3.4:1 4.3.2.1:1 LISTEN 1234/node
tcp 0 0 4.3.2.1:2 1.2.3.4:2 LISTEN -";
List <ListeningPortsPayload> payloads = NetstatUtils.ParseNetstatListeners(
Input,
LinuxLocalAddressColumnNumber,
LinuxRemoteAddressColumnNumber,
LinuxPidColumnNumber
);
Assert.AreEqual(2, payloads.Count);
ListeningPortsPayload payload = payloads.First();
Assert.AreEqual("tcp", payload.Protocol);
Assert.AreEqual("1.2.3.4", payload.LocalAddress);
Assert.AreEqual("4.3.2.1", payload.RemoteAddress);
Assert.AreEqual("1", payload.LocalPort);
Assert.AreEqual("1", payload.RemotePort);
Assert.AreEqual("1234", payload.ExtraDetails["Pid"]);
payload = payloads.Skip(1).First();
Assert.AreEqual("tcp", payload.Protocol);
Assert.AreEqual("4.3.2.1", payload.LocalAddress);
Assert.AreEqual("1.2.3.4", payload.RemoteAddress);
Assert.AreEqual("2", payload.LocalPort);
Assert.AreEqual("2", payload.RemotePort);
Assert.IsNull(payload.ExtraDetails);
}
public void ShouldParseWindowsPid()
{
const string Input = @" TCP 192.168.1.6:49729 40.103.33.102:443 ESTABLISHED 13324
TCP 192.168.1.6:49732 23.97.157.56:443 TIME_WAIT 0";
List <ListeningPortsPayload> payloads = NetstatUtils.ParseNetstatListeners(
Input,
WindowsLocalAddressColumnNumber,
WindowsRemoteAddressColumnNumber,
WindowsPidColumnNumber
);
Assert.AreEqual(2, payloads.Count);
ListeningPortsPayload payload = payloads.First();
Assert.AreEqual("tcp", payload.Protocol);
Assert.AreEqual("192.168.1.6", payload.LocalAddress);
Assert.AreEqual("40.103.33.102", payload.RemoteAddress);
Assert.AreEqual("49729", payload.LocalPort);
Assert.AreEqual("443", payload.RemotePort);
Assert.AreEqual("13324", payload.ExtraDetails["Pid"]);
payload = payloads.Skip(1).First();
Assert.AreEqual("tcp", payload.Protocol);
Assert.AreEqual("192.168.1.6", payload.LocalAddress);
Assert.AreEqual("23.97.157.56", payload.RemoteAddress);
Assert.AreEqual("49732", payload.LocalPort);
Assert.AreEqual("443", payload.RemotePort);
Assert.AreEqual("0", payload.ExtraDetails["Pid"]);
}
/// <summary>
/// The method receieves an output of 'netstat' command
/// It parse only the rows in "LISTEN" state
/// Returns a list of information per each "LISTEN" socket
/// Implementation remark:
/// We can't use the .NET API GetActiveTcpListeners since this API returns listeners in all TCP states except the Listen state.
/// That's why we have to parse the netstat output
/// </summary>
/// <param name="content">the output of 'netstat -nlpt' command as expected in Linux</param>
/// /// <param name="localColumn">the number of the column that contains local addresses</param>
/// /// <param name="remoteColumn">the number of the column that contains remote addresses</param>
/// <returns>A list of information per each "LISTEN" socket</returns>
public static List <ListeningPortsPayload> ParseNetstatListeners(string content, int localColumn, int remoteColumn)
{
List <ListeningPortsPayload> netstatListeners = new List <ListeningPortsPayload>();
string[] rows = content.SplitStringOnNewLine();
foreach (string row in rows)
{
string[] tokens = Regex.Split(row.Trim(), "\\s+");
string protocol = tokens[0];
if (Protocols.Contains(protocol, StringComparer.InvariantCultureIgnoreCase))
{
ListeningPortsPayload listeningPorts = new ListeningPortsPayload();
//Set protocol
listeningPorts.Protocol = tokens[0].ToLower();
//Set local address IP and port:
var local = AdressPortRegex.Match(tokens[localColumn]);
listeningPorts.LocalAddress = local.Groups[1].Value;
listeningPorts.LocalPort = local.Groups[2].Value;
//Set foreign address IP and port:
var remote = AdressPortRegex.Match(tokens[remoteColumn]);
listeningPorts.RemoteAddress = remote.Groups[1].Value;
listeningPorts.RemotePort = remote.Groups[2].Value;
netstatListeners.Add(listeningPorts);
}
}
return(netstatListeners);
}
public void ShouldNormalizeProtocolNameToLowercase()
{
const string Input = " tCp 10.166.83.25:57604 192.30.253.124:443 ESTABLISHED";
List <ListeningPortsPayload> payloads = NetstatUtils.ParseNetstatListeners(Input, WindowsLocalAddressColumnNumber, WindowsRemoteAddressColumnNumber);
Assert.AreEqual(1, payloads.Count);
ListeningPortsPayload payload = payloads.First();
Assert.AreEqual("tcp", payload.Protocol);
}
public void ShouldParseLinuxUdpIpv6Any()
{
const string Input = "udp6 0 0 :::5353 :::* ";
List <ListeningPortsPayload> payloads = NetstatUtils.ParseNetstatListeners(Input, LinuxLocalAddressColumnNumber, LinuxRemoteAddressColumnNumber);
Assert.AreEqual(1, payloads.Count);
ListeningPortsPayload payload = payloads.First();
Assert.AreEqual("udp6", payload.Protocol);
Assert.AreEqual("::", payload.LocalAddress);
Assert.AreEqual("::", payload.RemoteAddress);
Assert.AreEqual("5353", payload.LocalPort);
Assert.AreEqual("*", payload.RemotePort);
}
public void ShouldParseResponseAndReturnTheValuesInTheEventPayload()
{
IEnumerable <IEvent> events = _generator.GetEvents();
Assert.AreEqual(1, events.Count());
Assert.IsInstanceOfType(events.First(), typeof(ListeningPorts));
ListeningPorts listeningPortsEvent = (ListeningPorts)events.First();
Assert.AreEqual(1, listeningPortsEvent.Payload.Count());
ListeningPortsPayload payload = listeningPortsEvent.Payload.First();
Assert.AreEqual("80", payload.LocalPort);
Assert.AreEqual("0", payload.RemotePort);
Assert.AreEqual("tcp", payload.Protocol);
}
public void ShouldParseWindowsIpv4()
{
const string Input = " TCP 10.166.83.25:57604 192.30.253.124:443 ESTABLISHED";
List <ListeningPortsPayload> payloads = NetstatUtils.ParseNetstatListeners(Input, WindowsLocalAddressColumnNumber, WindowsRemoteAddressColumnNumber);
Assert.AreEqual(1, payloads.Count);
ListeningPortsPayload payload = payloads.First();
Assert.AreEqual("tcp", payload.Protocol);
Assert.AreEqual("10.166.83.25", payload.LocalAddress);
Assert.AreEqual("192.30.253.124", payload.RemoteAddress);
Assert.AreEqual("57604", payload.LocalPort);
Assert.AreEqual("443", payload.RemotePort);
}
public void ListeningPorts()
{
var payload = new ListeningPortsPayload
{
LocalAddress = "::ffff:c000:0280",
LocalPort = "234",
Protocol = "tcp",
RemoteAddress = "192.168.0.1",
RemotePort = "32"
};
var obj = new ListeningPorts(EventPriority.Operational, payload);
obj.ValidateSchema();
}
public void ShouldParseLinuxTcpIpv6()
{
const string Input = "tcp6 0 0 2a01:110:68:2c:745a:5970:a2f2:e0f3:22 2a02:26f0:e8:2b3::201a:* LISTEN";
List <ListeningPortsPayload> payloads = NetstatUtils.ParseNetstatListeners(Input, LinuxLocalAddressColumnNumber, LinuxRemoteAddressColumnNumber);
Assert.AreEqual(1, payloads.Count);
ListeningPortsPayload payload = payloads.First();
Assert.AreEqual("tcp6", payload.Protocol);
Assert.AreEqual("2a01:110:68:2c:745a:5970:a2f2:e0f3", payload.LocalAddress);
Assert.AreEqual("2a02:26f0:e8:2b3::201a", payload.RemoteAddress);
Assert.AreEqual("22", payload.LocalPort);
Assert.AreEqual("*", payload.RemotePort);
}
public void ShouldParseLinuxIpv4()
{
const string Input = "tcp 0 0 10.166.83.31:33872 10.166.83.16:631 TIME_WAIT";
List <ListeningPortsPayload> payloads = NetstatUtils.ParseNetstatListeners(Input, LinuxLocalAddressColumnNumber, LinuxRemoteAddressColumnNumber);
Assert.AreEqual(1, payloads.Count);
ListeningPortsPayload payload = payloads.First();
Assert.AreEqual("tcp", payload.Protocol);
Assert.AreEqual("10.166.83.31", payload.LocalAddress);
Assert.AreEqual("10.166.83.16", payload.RemoteAddress);
Assert.AreEqual("33872", payload.LocalPort);
Assert.AreEqual("631", payload.RemotePort);
}
public void ShouldParseWindowsUdp()
{
const string Input = " UDP 10.166.83.25:50049 *:*";
List <ListeningPortsPayload> payloads = NetstatUtils.ParseNetstatListeners(Input, WindowsLocalAddressColumnNumber, WindowsRemoteAddressColumnNumber);
Assert.AreEqual(1, payloads.Count);
ListeningPortsPayload payload = payloads.First();
Assert.AreEqual("udp", payload.Protocol);
Assert.AreEqual("10.166.83.25", payload.LocalAddress);
Assert.AreEqual("*", payload.RemoteAddress);
Assert.AreEqual("50049", payload.LocalPort);
Assert.AreEqual("*", payload.RemotePort);
}
public void ShouldParseWindowsIpv6()
{
const string Input = " TCP [2a01:110:68:2c:745a:5970:a2f2:e0f3]:64400 [2a02:26f0:e8:2b3::201a]:80 CLOSE_WAIT";
List <ListeningPortsPayload> payloads = NetstatUtils.ParseNetstatListeners(Input, WindowsLocalAddressColumnNumber, WindowsRemoteAddressColumnNumber);
Assert.AreEqual(1, payloads.Count);
ListeningPortsPayload payload = payloads.First();
Assert.AreEqual("tcp", payload.Protocol);
Assert.AreEqual("2a01:110:68:2c:745a:5970:a2f2:e0f3", payload.LocalAddress);
Assert.AreEqual("2a02:26f0:e8:2b3::201a", payload.RemoteAddress);
Assert.AreEqual("64400", payload.LocalPort);
Assert.AreEqual("80", payload.RemotePort);
}
public void ShouldParseWindowsIpv6Any()
{
const string Input = " TCP [::]:445 [::]:0 LISTENING";
List <ListeningPortsPayload> payloads = NetstatUtils.ParseNetstatListeners(Input, WindowsLocalAddressColumnNumber, WindowsRemoteAddressColumnNumber);
Assert.AreEqual(1, payloads.Count);
ListeningPortsPayload payload = payloads.First();
Assert.AreEqual("tcp", payload.Protocol);
Assert.AreEqual("::", payload.LocalAddress);
Assert.AreEqual("::", payload.RemoteAddress);
Assert.AreEqual("445", payload.LocalPort);
Assert.AreEqual("0", payload.RemotePort);
}
public void ShouldParseLinuxTcpIpv6Any()
{
const string Input = "tcp6 0 0 :::22 :::* LISTEN 8023/node";
List <ListeningPortsPayload> payloads = NetstatUtils.ParseNetstatListeners(
Input,
LinuxLocalAddressColumnNumber,
LinuxRemoteAddressColumnNumber,
LinuxPidColumnNumber
);
Assert.AreEqual(1, payloads.Count);
ListeningPortsPayload payload = payloads.First();
Assert.AreEqual("tcp6", payload.Protocol);
Assert.AreEqual("::", payload.LocalAddress);
Assert.AreEqual("::", payload.RemoteAddress);
Assert.AreEqual("22", payload.LocalPort);
Assert.AreEqual("*", payload.RemotePort);
Assert.AreEqual("8023", payload.ExtraDetails["Pid"]);
}
public void ShouldParseWindowsTcpUdpIpv6Ipv4Combination()
{
const string Input = @" TCP 10.166.83.25:64758 23.64.31.74:443 ESTABLISHED 1234
TCP [2001:0:2851:7871:28a9:6860:5823:3ae6]:7680 [2001:0:2851:7871:1054:f038:5823:3be2]:52540 TIME_WAIT 2345
UDP 0.0.0.0:123 *:* 3456";
List <ListeningPortsPayload> payloads = NetstatUtils.ParseNetstatListeners(
Input,
WindowsLocalAddressColumnNumber,
WindowsRemoteAddressColumnNumber,
WindowsPidColumnNumber
);
Assert.AreEqual(3, payloads.Count);
ListeningPortsPayload payload = payloads.First();
Assert.AreEqual("tcp", payload.Protocol);
Assert.AreEqual("10.166.83.25", payload.LocalAddress);
Assert.AreEqual("23.64.31.74", payload.RemoteAddress);
Assert.AreEqual("64758", payload.LocalPort);
Assert.AreEqual("443", payload.RemotePort);
Assert.AreEqual("1234", payload.ExtraDetails["Pid"]);
payload = payloads.Skip(1).First();
Assert.AreEqual("tcp", payload.Protocol);
Assert.AreEqual("2001:0:2851:7871:28a9:6860:5823:3ae6", payload.LocalAddress);
Assert.AreEqual("2001:0:2851:7871:1054:f038:5823:3be2", payload.RemoteAddress);
Assert.AreEqual("7680", payload.LocalPort);
Assert.AreEqual("52540", payload.RemotePort);
Assert.AreEqual("2345", payload.ExtraDetails["Pid"]);
payload = payloads.Skip(2).First();
Assert.AreEqual("udp", payload.Protocol);
Assert.AreEqual("0.0.0.0", payload.LocalAddress);
Assert.AreEqual("*", payload.RemoteAddress);
Assert.AreEqual("123", payload.LocalPort);
Assert.AreEqual("*", payload.RemotePort);
Assert.AreEqual("3456", payload.ExtraDetails["Pid"]);
}
public void ShouldParseLinuxPayload()
{
const string Input = @"Proto Recv-Q Send-Q Local Address Foreign Address State PID/Program name
tcp 0 0 127.0.0.53:53 0.0.0.0:* LISTEN -
tcp6 0 0 :::39565 :::* LISTEN 8023/node
tcp6 0 0 :::22 :::* LISTEN -
udp 0 0 0.0.0.0:631 0.0.0.0:* -
udp6 0 0 :::5353 :::* -
raw6 0 0 :::58 :::* 7 - ";
List <ListeningPortsPayload> payloads = NetstatUtils.ParseNetstatListeners(
Input,
LinuxLocalAddressColumnNumber,
LinuxRemoteAddressColumnNumber,
LinuxPidColumnNumber
);
Assert.AreEqual(6, payloads.Count);
ListeningPortsPayload payload = payloads.First();
Assert.AreEqual("tcp", payload.Protocol);
Assert.AreEqual("127.0.0.53", payload.LocalAddress);
Assert.AreEqual("0.0.0.0", payload.RemoteAddress);
Assert.AreEqual("53", payload.LocalPort);
Assert.AreEqual("*", payload.RemotePort);
Assert.IsNull(payload.ExtraDetails);
payload = payloads.Skip(1).First();
Assert.AreEqual("tcp6", payload.Protocol);
Assert.AreEqual("::", payload.LocalAddress);
Assert.AreEqual("::", payload.RemoteAddress);
Assert.AreEqual("39565", payload.LocalPort);
Assert.AreEqual("*", payload.RemotePort);
Assert.AreEqual("8023", payload.ExtraDetails["Pid"]);
payload = payloads.Skip(2).First();
Assert.AreEqual("tcp6", payload.Protocol);
Assert.AreEqual("::", payload.LocalAddress);
Assert.AreEqual("::", payload.RemoteAddress);
Assert.AreEqual("22", payload.LocalPort);
Assert.AreEqual("*", payload.RemotePort);
Assert.IsNull(payload.ExtraDetails);
payload = payloads.Skip(3).First();
Assert.AreEqual("udp", payload.Protocol);
Assert.AreEqual("0.0.0.0", payload.LocalAddress);
Assert.AreEqual("0.0.0.0", payload.RemoteAddress);
Assert.AreEqual("631", payload.LocalPort);
Assert.AreEqual("*", payload.RemotePort);
Assert.IsNull(payload.ExtraDetails);
payload = payloads.Skip(4).First();
Assert.AreEqual("udp6", payload.Protocol);
Assert.AreEqual("::", payload.LocalAddress);
Assert.AreEqual("::", payload.RemoteAddress);
Assert.AreEqual("5353", payload.LocalPort);
Assert.AreEqual("*", payload.RemotePort);
Assert.IsNull(payload.ExtraDetails);
payload = payloads.Skip(5).First();
Assert.AreEqual("raw6", payload.Protocol);
Assert.AreEqual("::", payload.LocalAddress);
Assert.AreEqual("::", payload.RemoteAddress);
Assert.AreEqual("58", payload.LocalPort);
Assert.AreEqual("*", payload.RemotePort);
Assert.IsNull(payload.ExtraDetails);
}
public void ShouldParseWindowsPayload()
{
const string Input = @"
Active Connections
Proto Local Address Foreign Address State PID
TCP 0.0.0.0:80 0.0.0.0:0 LISTENING 4
TCP 192.168.1.6:49750 10.166.83.164:22 SYN_SENT 25956
TCP 192.168.1.6:49752 52.114.132.21:443 TIME_WAIT 0
TCP [::]:80 [::]:0 LISTENING 4
TCP [::]:64868 [::]:0 LISTENING 1056
UDP 0.0.0.0:53 *:* 9364
UDP [::]:123 *:* 2088
UDP [::1]:53437 *:* 9060
UDP [fe80::f1f0:4b7:b5d:ff71%2]:53435 *:* 9060";
List <ListeningPortsPayload> payloads = NetstatUtils.ParseNetstatListeners(
Input,
WindowsLocalAddressColumnNumber,
WindowsRemoteAddressColumnNumber,
WindowsPidColumnNumber
);
Assert.AreEqual(9, payloads.Count);
ListeningPortsPayload payload = payloads.First();
Assert.AreEqual("tcp", payload.Protocol);
Assert.AreEqual("0.0.0.0", payload.LocalAddress);
Assert.AreEqual("0.0.0.0", payload.RemoteAddress);
Assert.AreEqual("80", payload.LocalPort);
Assert.AreEqual("0", payload.RemotePort);
Assert.AreEqual("4", payload.ExtraDetails["Pid"]);
payload = payloads.Skip(1).First();
Assert.AreEqual("tcp", payload.Protocol);
Assert.AreEqual("192.168.1.6", payload.LocalAddress);
Assert.AreEqual("10.166.83.164", payload.RemoteAddress);
Assert.AreEqual("49750", payload.LocalPort);
Assert.AreEqual("22", payload.RemotePort);
Assert.AreEqual("25956", payload.ExtraDetails["Pid"]);
payload = payloads.Skip(2).First();
Assert.AreEqual("tcp", payload.Protocol);
Assert.AreEqual("192.168.1.6", payload.LocalAddress);
Assert.AreEqual("52.114.132.21", payload.RemoteAddress);
Assert.AreEqual("49752", payload.LocalPort);
Assert.AreEqual("443", payload.RemotePort);
Assert.AreEqual("0", payload.ExtraDetails["Pid"]);
payload = payloads.Skip(3).First();
Assert.AreEqual("tcp", payload.Protocol);
Assert.AreEqual("::", payload.LocalAddress);
Assert.AreEqual("::", payload.RemoteAddress);
Assert.AreEqual("80", payload.LocalPort);
Assert.AreEqual("0", payload.RemotePort);
Assert.AreEqual("4", payload.ExtraDetails["Pid"]);
payload = payloads.Skip(4).First();
Assert.AreEqual("tcp", payload.Protocol);
Assert.AreEqual("::", payload.LocalAddress);
Assert.AreEqual("::", payload.RemoteAddress);
Assert.AreEqual("64868", payload.LocalPort);
Assert.AreEqual("0", payload.RemotePort);
Assert.AreEqual("1056", payload.ExtraDetails["Pid"]);
payload = payloads.Skip(5).First();
Assert.AreEqual("udp", payload.Protocol);
Assert.AreEqual("0.0.0.0", payload.LocalAddress);
Assert.AreEqual("*", payload.RemoteAddress);
Assert.AreEqual("53", payload.LocalPort);
Assert.AreEqual("*", payload.RemotePort);
Assert.AreEqual("9364", payload.ExtraDetails["Pid"]);
payload = payloads.Skip(6).First();
Assert.AreEqual("udp", payload.Protocol);
Assert.AreEqual("::", payload.LocalAddress);
Assert.AreEqual("*", payload.RemoteAddress);
Assert.AreEqual("123", payload.LocalPort);
Assert.AreEqual("*", payload.RemotePort);
Assert.AreEqual("2088", payload.ExtraDetails["Pid"]);
payload = payloads.Skip(7).First();
Assert.AreEqual("udp", payload.Protocol);
Assert.AreEqual("::1", payload.LocalAddress);
Assert.AreEqual("*", payload.RemoteAddress);
Assert.AreEqual("53437", payload.LocalPort);
Assert.AreEqual("*", payload.RemotePort);
Assert.AreEqual("9060", payload.ExtraDetails["Pid"]);
payload = payloads.Skip(8).First();
Assert.AreEqual("udp", payload.Protocol);
Assert.AreEqual("fe80::f1f0:4b7:b5d:ff71%2", payload.LocalAddress);
Assert.AreEqual("*", payload.RemoteAddress);
Assert.AreEqual("53435", payload.LocalPort);
Assert.AreEqual("*", payload.RemotePort);
Assert.AreEqual("9060", payload.ExtraDetails["Pid"]);
}
/// <summary>
/// The method receieves an output of 'netstat' command
/// It parse only the rows in "LISTEN" state
/// Returns a list of information per each "LISTEN" socket
/// Implementation remark:
/// We can't use the .NET API GetActiveTcpListeners since this API returns listeners in all TCP states except the Listen state.
/// That's why we have to parse the netstat output
/// </summary>
/// <param name="content">the output of 'netstat -nlpt' command as expected in Linux</param>
/// /// <param name="localColumn">the number of the column that contains local addresses</param>
/// /// <param name="remoteColumn">the number of the column that contains remote addresses</param>
/// /// <param name="pidColumnNumber">the number of the column that contains PID</param>
/// <returns>A list of information per each "LISTEN" socket</returns>
public static List <ListeningPortsPayload> ParseNetstatListeners(string content, int localColumn, int remoteColumn, int pidColumnNumber)
{
List <ListeningPortsPayload> netstatListeners = new List <ListeningPortsPayload>();
string[] rows = content.SplitStringOnNewLine();
foreach (string row in rows)
{
string[] tokens = Regex.Split(row.Trim(), "\\s+");
string token = tokens[0];
if (Protocols.Contains(token, StringComparer.InvariantCultureIgnoreCase))
{
ListeningPortsPayload listeningPorts = new ListeningPortsPayload();
//Set protocol
listeningPorts.Protocol = token.ToLower();
//Set local address IP and port:
var local = AddressPortRegex.Match(tokens[localColumn]);
listeningPorts.LocalAddress = local.Groups[1].Value;
listeningPorts.LocalPort = local.Groups[2].Value;
//Set foreign address IP and port:
var remote = AddressPortRegex.Match(tokens[remoteColumn]);
listeningPorts.RemoteAddress = remote.Groups[1].Value;
listeningPorts.RemotePort = remote.Groups[2].Value;
// ExtraDetails will include all extracted non-schema properties
var extraDetails = new Dictionary <string, string>();
int maxOffset = pidColumnNumber;
string pid;
// Extract pid
if (tokens.Length > maxOffset)
{
pid = tokens[pidColumnNumber];
}
else
{
// state is empty
pid = tokens[pidColumnNumber - 1];
}
if (!string.IsNullOrWhiteSpace(pid))
{
Match pidMatch = Regex.Match(pid, @"^\d+");
if (pidMatch.Captures.Count > 0 && !string.IsNullOrWhiteSpace(pidMatch.Value))
{
extraDetails["Pid"] = pidMatch.ToString();
}
}
if (extraDetails.Count > 0)
{
listeningPorts.ExtraDetails = extraDetails;
}
netstatListeners.Add(listeningPorts);
}
}
return(netstatListeners);
}
