#!/usr/bin/perl -w
#
# Copyright (C) 2006 Rodolphe Quiedeville <rodolphe@quiedeville.org>
#
# This program is free software; you can redistribute it and/or
# modify it under the terms of the GNU General Public License
# as published by the Free Software Foundation; version 2 dated June,
# 1991.
#
# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
# GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public License
# along with this program; if not, write to the Free Software
# Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA  02111-1307, USA.
#
# If you improve this script please send your version to my email address
# with the copyright notice upgrade with your name.
#
# Plugin to monitor number of tcp ports attack detected by portsentry
#
# $Log$
# Revision 1.1  2006/03/28 21:04:01  rodo
# Created by Rodolphe Quiedeville
#
# Add following lines to etc/munin/plugin-conf.d/munin-node file
#
# [portsentry*]
#   user root
#
#%# family=network
#%# capabilities=autoconf

use strict;

my ($port,$number,$name);
my (%ports, %names);
my $a = "</var/lib/portsentry/portsentry.blocked.tcp";
my $line = undef;


if ($ARGV[0] and $ARGV[0] eq "config")
{
    print "graph_title Portsentry TCP Attacks Detected\n";
    print "graph_args --base 1000 -l 0\n";
    print "graph_category network\n";
    print "graph_vlabel attacks blocked\n";
    print "graph_total total\n";

    open(PTCP,$a) || die "cannot open $a: $!";
    while ($line = <PTCP>)
    {    
	$ports{$1}++ if $line =~ /.*Port: ([0-9]+) TCP Blocked$/;
    }
    close(PTCP);

    my @np = (keys(%ports));
    foreach my $x (@np) {
	$names{$x} = "inconnu";
	open(PETC,"grep $x/tcp /etc/services|") || die "cannot open /etc/services : $!";
	while ($line = <PETC>){
	    $names{$x} = $1 if $line =~ /^(\w*)\s*$x\/tcp.*/;
	}
	close(PETC);
    }
    
    while (($port,$number) = each(%ports))
    {
	print "port_$port.label Port $port\n";
	print "port_$port.info $names{$port}\n";
    }
    
    exit 0;
}


open(PTCP,$a) || die "cannot open $a: $!";
while ($line = <PTCP>)
{    
    $ports{$1}++ if $line =~ /.*Port: ([0-9]+) TCP Blocked$/;
}
close(PTCP);








while (($port,$number) = each(%ports))
{
    print "port_$port.value $number\n";
}



# vim:syntax=perl