gnuplotsql.py

Development of new features for Dionaea has been fairly impressive of late, and I’ve been lax in keeping up to date. When Markus asked if I’d tested the graph utility that he created and wrote about here, it served as a kick to stop putting off some of the jobs I’ve got on the growing to-do list.
I won’t go into too much detail about running the script as Markus has already done a better job than I could. However I will point out that if you run your Dionaea installation on Debian stable, then your out of luck; the standard packages for sqlite are too old to take the script. Best advice is to copy your logsql.sqlite database to a Ubuntu machine and work from there (oh, and in case you didn’t guess from the script name, make sure you’ve actually installed gnuplot…).
A powerful machine is recommended, the only Ubuntu system I had to hand whilst testing was my AA1 netbook, which took 85 minutes to crunch through the script and my database.
I have immediately found the graphs produced useful as they’ve highlighted a couple of obvious spikes (see below) in activity that I would have (and did) miss if solely relying on log files and databases. This really shows the power and importance of visualising security and log information.

dionaea-overview
dionaea-overview - from gnuplotsql.py

If you’re interested the output for the InfoSanity’s installation is now online here. I’m looking to expand the statistics from the InfoSanity honeypot environment that are publicly available, this makes a nice start. As always, big thanks to Markus and carnivore.it team for the effort.
— Andrew Waite

Join the conversation

14 Comments

    1. Dear Markus
      I faced a wired problem, My Dionaea is working correctly over VPS now and it’s collecting the attack information in the log files, and Sandboxes are informing me about binary attacks, but my logsql.sqlite file is almost empty, some important tables such as “Connection” table is completely empty, but “dcerpcserviceops” table have some data.
      Have you faced a problem like this, or do you have any experience about this issue.
      Regards,
      Shahrooz

  1. can you give me detailed explanation on how to analyze the gnuplot sql graph please

  2. actually what i meant is can u explain me what is a offer,download and uniq from the legend please

  3. What should I do to generate some graphics? I installed dionaea end it’s working well. I exported my logsql.sqlite to another computer to work and donĀ“t have any problem, but I can’t create this graphics. Can you help me?

      1. I installed gnuplot in my ubuntu 11.04, but when try to execute this comand gnuplot home/usr/riboldi/Downloads/logsql.sqlite
        the system returns this error mensage
        root@redes15-Digitron:~# gnuplot /home/usr/riboldi/Downloads/logsql.sqlite
        SQLite format 3
        ^
        “/home/usr/riboldi/Downloads/logsql.sqlite”, line 1: invalid command

        1. Looks like you’re just calling gnuplot direct, not the gnuplotsql.py script. Assuming the script is in your current directory, command should be:
          #./gnuplotsql.py /path/to/logsql.sqlite

    1. Hi Dear Ivan
      I faced a wired problem, My Dionaea is working correctly over VPS now and it’s collecting the attack information in the log files, and Sandboxes are informing me about binary attacks, but my logsql.sqlite file is almost empty, some important tables such as “Connection” table is completely empty, but “dcerpcserviceops” table have some data.
      Have you faced a problem like this, or do you have any experience about this issue.
      Regards,
      Shahrooz

    1. Few points:
      Those install instructions aren’t mine; whilst repository package installs can be easier, Dionaea is actively developed. I’d always recommend installing from source, official documentation is very comprehensive.
      From the error, you’re either not in the same directory as gnuplotsql.py as I’d assumed (cd to right directory) or the script doesn’t have execute permissions (chmod +x gnuplotsql.py).

Leave a comment

Leave a Reply to Andrew Waite Cancel reply

Your email address will not be published. Required fields are marked *