SAPIEN Resources

   1: Param([object]$sniff =$(throw 'USAGE: Analyze-Packet -Sniff (result of Get-Packet script) [-NoResolution]'), [switch]$NoResolution)

   2:  

   3:  

   4: #Changed by Steven Murawski 08/14/08

   5: #Refactored common code from DNS lookup for source and destination IPs

   6: function ResolveIPAddress([string]$status, [Object[]]$IPAdresses )

   7: {

   8:     #turn off errors to prevent the script from halting if an IP can't be resolved

   9:     $errorActionPreference="SilentlyContinue"

  10:     

  11:     $hosts = @()

  12:     

  13:     for ($i=0;$i -lt $IPAdresses.count;$i++) 

  14:     {     

  15:         Write-Progress -Activity $activity -status $status -currentoperation $IPAdresses[$i].IP -percentcomplete (($i/$IPAdresses.count)*100)

  16:         Write-Debug $IPAdresses[$i].IP

  17:         

  18:         $resolved = [system.Net.dns]::getHostEntry($IPAdresses[$i].IP)

  19:         

  20:         if ($resolved.HostName) 

  21:         {

  22:             $resolvedhost=$resolved.hostname

  23:         }

  24:         else 

  25:         {

  26:             $resolvedhost=$IPAdresses[$i].IP

  27:         }

  28:         

  29:         $obj=New-Object PSObject

  30:  

  31:         $obj | Add-Member -MemberType Noteproperty -name "Count" -value $IPAdresses[$i].Count

  32:         $obj | Add-Member -MemberType Noteproperty -name "IP" -value $IPAdresses[$i].IP

  33:         $obj | Add-Member -MemberType Noteproperty -name "Host" -value $resolvedhost

  34:         

  35:         $hosts+=$obj

  36:         

  37:         #reset $resolved

  38:         Remove-Variable resolved

  39:         

  40:         

  41:     }

  42:     #turn error pipeline back on. Not really necessary because of scop

  43:     #but including for consistency

  44:     

  45:     $errorActionPreference="Continue"

  46:     $hosts

  47: }

  48:  

  49: #main body of script

  50:  

  51: $activity="Analyzing network trace"

  52: Write-Progress -Activity $activity -status "Counting packets" -percentcomplete 1

  53: $count = $sniff.count

  54:  

  55: Write-Progress -Activity $activity -status "Calculating elapsed time" -percentcomplete 5

  56: $elapsed = $sniff[-1].time -$sniff[0].time

  57:  

  58: #calculate packets per second

  59: $pps = $sniff.count/(($sniff[-1].time -$sniff[0].time).totalseconds)

  60: $pps="{0:N4}" -f $pps

  61:  

  62: Write-Progress -Activity $activity -status "Calculating protocol distribution" -percentcomplete 20

  63: $protocols = $sniff | sort protocol | group protocol | sort count -descending | select Count,@{name="Protocol";Expression={$_.name}} 

  64:  

  65: Write-Progress -Activity $activity -status "Calculating source port distribution" -percentcomplete 40

  66: $sourceport = $sniff | sort sourceport | group sourceport |sort count -descending | select Count,@{name="Port";Expression={$_.name}}

  67:  

  68: Write-Progress -Activity $activity -status "Calculating destination distribution" -percentcomplete 50

  69: $destinationlist=$sniff | sort Destination | select Destination

  70:  

  71: Write-Progress -Activity $activity -status "Calculating destination port distribution" -percentcomplete 60

  72: $destinationport = $sniff | sort destport | group destport |sort count -descending | select Count,@{name="IP";Expression={$_.name}}

  73:  

  74: Write-Progress -Activity $activity -status "Building source list" -percentcomplete 30

  75: $sourcelist = $sniff | sort source | select Source

  76:  

  77: Write-Progress -Activity $activity -status "Building source IP list" -percentcomplete 35

  78: $ips = $sourcelist| group source |sort count -descending | select Count,@{Name="IP";Expression={$_.Name}} 

  79:  

  80:  

  81: $sources = $null

  82:  

  83: if ($NoResolution)

  84: {

  85:     $sources = $ips

  86: }

  87: else 

  88: {

  89:     $sources = ResolveIPAddress 'Resolving Source IP addresses' $ips

  90: }

  91:  

  92: Write-Progress -Activity $activity -status "Build destination IP list" -percentcomplete 35

  93: $ipd = $destinationlist| group destination |sort count -descending | select Count,@{Name="IP";Expression={$_.Name}} 

  94:  

  95: $destinations = $null

  96:  

  97: if ($NoResolution)

  98: {

  99:     $destinations = $ipd

 100: }

 101: else 

 102: {

 103:     $destinations = ResolveIPAddress 'Resolving Destination IP addresses' $ipd

 104: }

 105:   

 106: Write-Progress -Activity $activity -status "Presenting data" -Completed $True -percentcomplete 100

 107:  

 108: $protocols       = $protocols | Select Count,Protocol,@{Name="Percentage";Expression={"{0:P4}" -f ($_.count/$sniff.count)}} 

 109:  

 110: $destinationport = $destinationport | select Count,Port,@{Name="Percentage";Expression={"{0:P4}" -f ($_.count/$sniff.count)}} 

 111:  

 112: $sourceport      = $sourceport | Select Count,Port,@{Name="Percentage";Expression={"{0:P4}" -f ($_.count/$sniff.count)}} 

 113:  

 114: if ($NoResolution)

 115: {

 116:     $destinations    = $destinations | Select Count,IP,@{Name="Percentage";Expression={"{0:P4}" -f ($_.count/$sniff.count)}} 

 117:     $sources         = $sources | select Count,IP,@{Name="Percentage";Expression={"{0:P4}" -f ($_.count/$sniff.count)}}     

 118: }

 119: else

 120: {

 121:     $destinations    = $destinations | Select Count,IP,Host,@{Name="Percentage";Expression={"{0:P4}" -f ($_.count/$sniff.count)}} 

 122:     $sources         = $sources | Select Count,IP,Host,@{Name="Percentage";Expression={"{0:P4}" -f ($_.count/$sniff.count)}} 

 123: }

 124:     

 125: #write results to a custom object

 126: $results=New-Object PSobject

 127:  

 128: $results | Add-Member -MemberType Noteproperty -Name "TotalPackets" -Value $sniff.count

 129: $results | Add-Member -MemberType Noteproperty -Name "Elapsedtime" -Value $elapsed

 130: $results | Add-Member -MemberType Noteproperty -Name "PacketsPerSec" -Value $pps

 131: $results | Add-Member -MemberType Noteproperty -Name "Protocols" -value $protocols

 132: $results | Add-Member -MemberType Noteproperty -Name "Destinations" -value $destinations

 133: $results | Add-Member -MemberType Noteproperty -Name "DestinationPorts" -value $destinationport

 134: $results | Add-Member -MemberType Noteproperty -Name "Sources" -value $sources

 135: $results | Add-Member -MemberType Noteproperty -Name "SourcePorts" -value $sourceport 

 136:  

 137: write $results