from util import find_data_file from util import setup_child from util import fprint from util import run_ps from util import win32 import util import time import csv def process(data): setup_child() fprint("netstat processing") if win32: #output = data.stdout #print(output) output = data.stdout.decode().split('\r\n') # split stdout into lines #print(output) if output[0].find("The requested operation requires elevation.") >= 0: #print("test3") raise PermissionError("Unable to acquire netstat data without admin!") #print("test2") output2 = list() output2.append([util.sysid, util.userid, util.sysdom, util.time()]) # add metadata #print(output2) procname = "" """for x in range(4, len(output)): tmp = output[x].split(" ") print(tmp) tmp = [i for i in output[x] if i] print(tmp) print(len(tmp)) if len(len(tmp) == 1): procname = tmp[0] print(x) else: print(x) output2[x] = list() output2[x].append(procname) output2[x].append(output[x].split(" ")) output2[x] = [i for i in output2[x] if i] output2 = [i for i in output2 if i] print(output2)""" x = len(output) - 1 # start at the end because filename comes after connection procname = "Unknown" # if the very last connection happens to have no file (yes, it's possible), we can say unknown while x > 3: string = output[x] #print("LINE: ", string) string_split = string.split(" ") string_split = [i for i in string_split if i] if string.find("Can not obtain ownership information") >= 0: # Higher privilige than us, must be system procname = "Windows System" elif string.find("]") >= 0 and string.find("[") == 1: # generic [file.exe] procname = string[2:-1] elif len(string_split) == 5: # actual netstat line tmp = [procname,] # add executable name first tmp.extend(string.split(" ")) tmp = [i for i in tmp if i] #print(tmp) output2.append(tmp) #else: # In case of an extra line above file, or an empty line, ignore it #print("Garbage data", string) x = x - 1 #output2 = output2[2:] #print(output2) with open(find_data_file(util.datafile), "w", newline="") as f: writer = csv.writer(f) writer.writerows(output2) fprint("done creating csv") def start(): fprint("netstat started") setup_child() if win32: data = run_ps("netstat -n -o -b") fprint("data acquired") return data