Monitoring STCP Sockets

# netstat_filter.pl begins here                                                 
#
# Version 1.03 09-01-22
# Version 1.10 10-11-26  Added disclaimer
# noah_davids@stratus.com
#
# See http:noahdavids.org/self_published/netstat_filter.html
# for documentation
#
#
# This software is provided on an "AS IS" basis, WITHOUT ANY WARRANTY OR ANY
# SUPPORT OF ANY KIND. The AUTHOR SPECIFICALLY DISCLAIMS ANY IMPLIED WARRANTIES
# OF MERCHANTABILITY OR FITNESS FOR ANY PARTICULAR PURPOSE.  This disclaimer
# applies, despite any verbal representations of any kind provided by the
# author or anyone else.
#
use strict;
use warnings;
use Getopt::Long;

my ($result, @filter_file, @output_file, @sleep_time,
    @quiet, @temp_file, @once);
my ($sec,$min,$hour,$mday,$mon,$year,$wday,$yday,$isdst);
my ($date_stamp, $f, $r, $x, $matched, $now, $first, $output_to_file);
my ($FILTER, $NETSTAT, $OUT);
my (@filters, @interesting, $i);
my ($PCB, $ASOUTPUT);
my ($openparen, $closeparen, $device);

$result = GetOptions ('filter=s' => \@filter_file,
                      'out=s'    => \@output_file,
                      'sleep=s'  => \@sleep_time,
                      'quiet'    => \@quiet,
                      'temp=s'   => \@temp_file,
                      'once'     => \@once);

if ($result != 1)
   {
   print "\n\nUsage:\n";
   print "perl netstat_filter.pl [-filter FILTER_FILE] " .
            "[-out OUTPUT_FILE_BASE] " .
            "[-sleep SLEEP_TIME] [-quiet] [-temp TEMP_FILE_BASE] " .
            "[-once]\n\n";
   exit;
   }
else
   {
   if (@filter_file == 0) {$filter_file [0] = "netstat_filter_list";}
   if (@output_file == 0) {$output_file [0] = "netstat_filter_out";}
   if (@sleep_time == 0)  {$sleep_time [0] = 30;}
   if (@quiet == 0)       {$quiet [0] = " ";} else {$quiet [0] = "-quiet";}
   if (@temp_file == 0)   {$temp_file [0] = "netstat_filter_temp";}
   if (@once == 0)        {$once [0] = " ";} else {$once [0] = "-once";}
   }

print "perl netstat_filter.pl -filter " . $filter_file [0] .
                            " -out " . $output_file [0] .
                            " -sleep " . $sleep_time [0] . " " .
                            $quiet [0] .
                            " -temp " . $temp_file [0] . " " .
                            $once [0] . "\n\n";

# set up temporary file names
$r = $temp_file [0];
$temp_file [0] = $r . "X";
$temp_file [1] = $r . "Y";

if ($output_file [0] =~ /STDOUT/) {$output_to_file = 0;}
    else {$output_to_file = 1;}

if ($output_to_file)
   {
   ($sec,$min,$hour,$mday,$mon,$year,$wday,$yday,$isdst)=localtime(time);
   $year = $year+1900;
   $mon = $mon+1;
   $date_stamp = $year . "-" . $mon . "-" . $mday;
   $f = $output_file [0] . "_" . $date_stamp;
# first open the file, this creates it, if it is there delete it and create it
   open ($OUT, ">".$f) || die "Can't open outfile " . $f . " [-1]";
# file is open so close it
   close $OUT;
# now call the system routine to execute the set_implicit_locking command
# to set implicit locking on the file
   $r = system ("set_implicit_locking " . $f);
# reopen file file so we can actually write to it
   open ($OUT, ">".$f) || die "Can't open outfile " . $f . " [0]";
   }

# open the filter file so we can read the filer list
open ($FILTER, '<', $filter_file [0]) || die "Can't open filter file list: "
                     . $filter_file [0];
$i = -1;
while ($r = <$FILTER>)
      {
      if (substr ($r, 0, 1) ne '#')    # skip comments
         {
         $i++;
         if (substr ($r, 0,1) eq '+')  # this means the line defines
            {                          # something interesting.
            $interesting [$i] = 1;     # set the interesting flag and trim
            $r = substr ($r, 1);       # off the leading plus character
            }
         else
            {$interesting [$i] = 0;}   # the line defines something
         $filters [$i] = $r;           # uninteresting. Either way save the
         chop ($filters [$i]);         # regular expression and chop off the
         if (length ($quiet [0]) == 1) # ending CR that got added as the
            {                          # line was read. If -quiet was NOT
            if ($output_to_file)       # specified then print the line
                                       # to either the out file or the
                                       # terminal window
               {print $OUT $interesting [$i] . "     " . $filters [$i] . "\n";}
            else {print $interesting [$i] . "     " . $filters [$i] . "\n";}
            } # (length ($quiet [0] > 1)
         } # (substr ($r, 0, 1) ne '#') # skip comments
      } # while ($r = <$FILTER>)

if ($output_to_file) {close $OUT;}     # if writing to a file, close it.
close $FILTER;                         # file remains closed unless we are
                                       # actually writing to it.
#        
# this is the main loop.
while (1)
 {

# reconstruct the output file name. This way we do not need to keep track
# of the day, when the day changes the file name automagically changes
 ($sec,$min,$hour,$mday,$mon,$year,$wday,$yday,$isdst)=localtime(time);
 $year = $year+1900;
 $mon = $mon+1;
 $date_stamp = $year . "-" . $mon . "-" . $mday;
 $f = $output_file [0] . "_" . $date_stamp;

# pretty much the same drill as above, if the file does not exist
# create the file, close it and set implicit locking.
# But this time the file is left closed.
 if ($output_to_file)
    {
    if (!(-e $f)) # if output file does not exist, create it and set
       {          # implicit locking
       open ($OUT, ">".$f) || die "Can't open outfile " . $f . " [-1]";
       close $OUT;
       $r = system ("set_implicit_locking " . $f);
       } 
    }
 $now = localtime ();          # get the current time stamp

 if (length ($quiet [0]) == 1) # -quiet was NOT an argument so always
    {                          # output time stamp at start of loop
    if ($output_to_file)
       {
       open ($OUT, ">>".$f) || die "Can't open outfile " . $f . " [1]";
       print $OUT
             "\n\n ******************** ". $now . " ********************\n";
       close $OUT;
       }
    else
       {print "\n\n ******************** ". $now . " ********************\n";}
    }

# run netstat and send the output to the first temporary file
 $r = system ("netstat -numeric -all_sockets -PCB_addr > " . $temp_file [0]);

# we only want to write the time stamp out once. The first flag is set to 1
# now and will be zeroed when the time stamp is written.
 $first = 1;

# open the temp file with the netstat output and loop through all the lines
 open ($NETSTAT, '<', $temp_file [0]) ||
         die "Could not open temp file " . $temp_file [0];
 while ($_ = <$NETSTAT>)
       {
       $matched = 0; # matched is set to 1 if the regular expression is found
       $x = 0;       # x is the index used to loop through all the filters

# loop until we reach the end or a match is found
       while (($x <= $i) && !$matched)
             {if (/$filters[$x++]/) {$matched = 1;}}

# if no match is found or we have matched a regular expression defining an
# interesting line. We need to subtract 1 from the array index because we
# have already incremented the index so the index is now 1 greater than the
# filter we just matched (if we matched a filter that is)
       if ((!$matched) || ($matched && $interesting [$x - 1]))
          {
          if ($first) # first interesting netstat line found in this loop
             {
             if (length ($quiet [0]) > 1) # -quite was an argument so no time
                {                         # stamp was written at the start of
                if ($output_to_file)      # the loop so we need to do it now
                   {                      # before first interesting netstat
                   open ($OUT, ">>".$f) ||  # line
                         die "Can't open outfile " . $f . " [2]";
                   print $OUT
                      "\n\n ***************** ". $now . " *****************";
                   close $OUT
                   }
                   else {print
                     "\n\n ***************** ". $now . " *****************";}
                } # if (length ($quiet [0]) > 1)
             $first = 0;      # time stamp was written so set first to 0 so
             } # if ($first)  # we don't do it again in this iteration

# output a couple of blank lines followed by the interesting netstat line
          if ($output_to_file)
             {
             open ($OUT, ">>".$f) ||
                      die "Can't open outfile " . $f . " [3]";
             print $OUT "\n\n", $_;
             close $OUT;
             }
          else {print "\n\n", $_;}

# the PCB addr is the first 8 characters in the line. Extract it out and
# use system to execute analyze_system to dump the TCB and related
# structures. Output goes to the second temp file.
# Note that this works even with UDP sockets - mostly. UDP sockets can be
# destroyed very quickly and no locking is done with this analyze_system
# request. The result is that request *may* fail and it can cause
# analyze_system to create a keep.
          $PCB = substr ($_, 0, 8);
          $r = system
            ("analyze_system -quit -request_line 'match dv; dump_onetcb " .
              $PCB . "' > " . $temp_file [1]);

# The analyze_system output should be 3 lines, the first 2 are header lines
# the third line will contain the line with the device name. It is possible
# that the third line will not be there in which case defined ($r) is false.
# this means that a device was not found. This can happen if the socket is
# being cleaned up or is used by OSL.
          open ($ASOUTPUT, '<', $temp_file [1]) ||
                  die "Could not open temp file " . $temp_file [1];
          $r = <$ASOUTPUT>;
          $r = <$ASOUTPUT>;
          $r = <$ASOUTPUT>;
          close $ASOUTPUT;
          if (defined ($r))    # If the line there exrtact out the
             {                 # device name which is enclosed in ()s
             $openparen = index ($r, '(') + 1;
             $closeparen = index ($r, ')');
             $device = substr ($r, $openparen, $closeparen - $openparen);

# once we have a device name execute the who_locked command.
             if ($output_to_file)
                {
                $r = system ("who_locked \\#" . $device . " >> " . $f);
                }
             else
                {
                $r = system ("who_locked \\#" . $device);
                }
             } # if (defined ($r))
          } # if ((!$matched) || ($matched && $interesting [$x - 1]))
       } # while ($_ = <$NETSTAT>)

# if -once was an argument quit otherwise sleep and do the loop again
 if (length ($once [0]) > 1) {exit;}
 sleep ($sleep_time [0])

 } # while (1)
#
# netstat_filter.pl ends here