Question

我试图提取源和目标MAC和IP地址以及从命令输出传输的数据包＆＃34; ovs dump-flows＆＃34;。该命令的输出如下

in_port(2),eth(src=00:26:55:e8:b0:43,dst=bc:30:5b:f7:07:fc),eth_type(0x0806),arp(sip=193.170.192.129,tip=193.170.192.142,op=2,sha=00:26:55:e8:b0:43,tha=bc:30:5b:f7:07:fc), packets:0, bytes:0, used:never, actions:1
in_port(2),eth(src=bc:30:5b:f6:dd:fc,dst=bc:30:5b:f7:07:fc),eth_type(0x0800),ipv4(src=193.170.192.143,dst=193.170.192.142,proto=6,tos=0,ttl=64,frag=no),tcp(src=45969,dst=5672), packets:1, bytes:87, used:4.040s, flags:P., actions:1
in_port(2),eth(src=bc:30:5b:f6:dd:fc,dst=bc:30:5b:f7:07:fc),eth_type(0x0800),ipv4(src=193.170.192.143,dst=193.170.192.142,proto=6,tos=0,ttl=64,frag=no),tcp(src=45992,dst=5672), packets:118412, bytes:21787661, used:2.168s, flags:P., actions:1
in_port(2),eth(src=00:18:6e:3a:aa:e8,dst=01:80:c2:00:00:00), packets:29131, bytes:1864384, used:1.200s, actions:drop

代码是

from pyparsing import *
import datetime,time
import os
f = os.popen('ovs-dpctl dump-flows ovs-system')
flows = f.read()
print "Flows are ", flows

LBRACE,RBRACE,COMMA,EQUAL,COLON = map(Suppress,'(),=:')
in_port = packets = proto = tos = ttl = src = dst = op = Word(nums)
ipAddress = Combine(Word(nums) + ('.' + Word(nums))*3)
twohex = Word(hexnums,exact=2)
macAddress = Combine(twohex + (':'+twohex)*5)
eth_type = Combine('0x' + Word(hexnums,exact=4))
frag = Word

flowTcp = "in_port" + LBRACE + in_port("in_port") + RBRACE + COMMA + "eth" + LBRACE + "src" + EQUAL + macAddress("src") + COMMA + "dst" + EQUAL + macAddress("dst") + RBRACE + COMMA + "eth_type" + LBRACE + eth_type("eth_type") + RBRACE + COMMA + "ipv4" + LBRACE + "src" + EQUAL + ipAddress("src") + COMMA + "dst" + EQUAL + ipAddress("dst") + COMMA + "proto" + EQUAL + proto("proto") + COMMA + "tos" + EQUAL + tos("tos") + COMMA + "ttl" + EQUAL + ttl("ttl") + COMMA + "frag" + EQUAL + frag("frag") + RBRACE + COMMA + "tcp" + LBRACE + "src" + EQUAL + src("srcPkt") + COMMA + "dst" + EQUAL + dst("dstPkt") + RBRACE + "packets" + COLON + packets("packets")

由于Mac地址的名称表示，IP地址和数据包与＆＃34; src＆＃34;相同。和＆＃34; dst＆＃34;。由于重新命名名称，我无法解析和提取所需的数据。请建议如何做到这一点。

Answer 1

首先我必须重新格式化你的代码，这样我才能更容易地看到解析器中的结构：

flowTcp = ("in_port" + LBRACE + in_port("in_port") + RBRACE + COMMA + 
            "eth" + LBRACE + "src" + EQUAL + macAddress("src") + COMMA + 
            "dst" + EQUAL + macAddress("dst") + RBRACE + COMMA + 
            "eth_type" + LBRACE + eth_type("eth_type") + RBRACE + COMMA + 
            "ipv4" + LBRACE + "src" + EQUAL + ipAddress("src") + COMMA + 
                "dst" + EQUAL + ipAddress("dst") + COMMA + 
                "proto" + EQUAL + proto("proto") + COMMA + 
                "tos" + EQUAL + tos("tos") + COMMA + 
                "ttl" + EQUAL + ttl("ttl") + COMMA + 
                "frag" + EQUAL + frag("frag") + RBRACE + COMMA + 
            "tcp" + LBRACE + 
                "src" + EQUAL + src("srcPkt") + COMMA + 
                "dst" + EQUAL + dst("dstPkt") + 
                RBRACE + 
            "packets" + COLON + packets("packets"))

然后，要解析您发布的示例，我必须将其中一些结构作为可选项，并添加缺少的“eth”和“arp”字段（并修复frag的定义）：

frag = oneOf("yes no")
flowTcp = ("in_port" + LBRACE + in_port("in_port") + RBRACE + COMMA + 
            "eth" + LBRACE + 
                "src" + EQUAL + macAddress("src") + COMMA + 
                "dst" + EQUAL + macAddress("dst") + 
                RBRACE + COMMA + 
            Optional("eth_type" + LBRACE + eth_type("eth_type") + RBRACE + COMMA) +
            Optional("arp" + LBRACE +
                "sip" + EQUAL + ipAddress("sip") + COMMA +
                "tip" + EQUAL + ipAddress("tip") + COMMA +
                "op" + EQUAL + op("op") + COMMA + 
                "sha" + EQUAL + macAddress("sha") + COMMA + 
                "tha" + EQUAL + macAddress("tha") + 
                RBRACE + COMMA) +
            Optional("ipv4" + LBRACE + 
                "src" + EQUAL + ipAddress("src") + COMMA + 
                "dst" + EQUAL + ipAddress("dst") + COMMA + 
                "proto" + EQUAL + proto("proto") + COMMA + 
                "tos" + EQUAL + tos("tos") + COMMA + 
                "ttl" + EQUAL + ttl("ttl") + COMMA + 
                "frag" + EQUAL + frag("frag") + 
                RBRACE + COMMA) +
            Optional("tcp" + LBRACE + 
                "src" + EQUAL + src("srcPkt") + COMMA + 
                "dst" + EQUAL + dst("dstPkt") + 
                RBRACE) +
            "packets" + COLON + packets("packets"))

此时，解析器“有效”，但它有你问过的问题，即你重复使用了一些结果名称，比如“src”，“dst”等等。

显然，您可以使用不同的名称，例如“eth_src”，“tcp_src”。但我建议你使用pyparsing Group类来为你的解析数据添加结构。我把每个子结构都定义为他们自己的迷你解析器：

eth = Group("eth" + LBRACE + 
                "src" + EQUAL + macAddress("src") + COMMA + 
                "dst" + EQUAL + macAddress("dst") + 
                RBRACE)
arp = Group("arp" + LBRACE +
                "sip" + EQUAL + ipAddress("sip") + COMMA +
                "tip" + EQUAL + ipAddress("tip") + COMMA +
                "op" + EQUAL + op("op") + COMMA + 
                "sha" + EQUAL + macAddress("sha") + COMMA + 
                "tha" + EQUAL + macAddress("tha") + 
                RBRACE)
ipv4 = Group("ipv4" + LBRACE + "src" + EQUAL + ipAddress("src") + COMMA + 
                "dst" + EQUAL + ipAddress("dst") + COMMA + 
                "proto" + EQUAL + proto("proto") + COMMA + 
                "tos" + EQUAL + tos("tos") + COMMA + 
                "ttl" + EQUAL + ttl("ttl") + COMMA + 
                "frag" + EQUAL + frag("frag") + 
                RBRACE)
tcp = Group("tcp" + LBRACE + 
                "src" + EQUAL + src("srcPkt") + COMMA + 
                "dst" + EQUAL + dst("dstPkt") + 
                RBRACE)

然后我将每一个添加回主解析器，并为每个组分配一个结果名称。

flowTcp = ("in_port" + LBRACE + in_port("in_port") + RBRACE + COMMA + 
            eth("eth") + COMMA + 
            Optional("eth_type" + LBRACE + eth_type("eth_type") + RBRACE + COMMA ) +
            Optional(arp("arp") + COMMA) +
            Optional(ipv4("ipv4") + COMMA) +
            Optional(tcp("tcp") + COMMA) +
            "packets" + COLON + packets("packets"))

（所以我在这里做了两件事 - 我Group编了子结构，我给了他们名字。我本可以在没有打破eth，arp等的情况下内联整个事情，但我却迷失了方向把它全部保存在所有的母语中。）

现在我解析了你的4个例子，然后抛弃了结果。 dump（）方法将在输出结果中显示结构，示例代码显示如何使用常规属性命名访问子结构（如flowTcpValues.eth.src）。

for d in data:
    print d
    flowTcpValues = flowTcp.parseString(d)
    print flowTcpValues.dump()
    print flowTcpValues.packets
    print flowTcpValues.eth.src
    print flowTcpValues.eth.dst
    print

，并提供：

Flows are  
in_port(2),eth(src=00:26:55:e8:b0:43,dst=bc:30:5b:f7:07:fc),eth_type(0x0806),arp(sip=193.170.192.129,tip=193.170.192.142,op=2,sha=00:26:55:e8:b0:43,tha=bc:30:5b:f7:07:fc), packets:0, bytes:0, used:never, actions:1
['in_port', '2', ['eth', 'src', '00:26:55:e8:b0:43', 'dst', 'bc:30:5b:f7:07:fc'], 'eth_type', '0x0806', ['arp', 'sip', '193.170.192.129', 'tip', '193.170.192.142', 'op', '2', 'sha', '00:26:55:e8:b0:43', 'tha', 'bc:30:5b:f7:07:fc'], 'packets', '0']
- arp: ['arp', 'sip', '193.170.192.129', 'tip', '193.170.192.142', 'op', '2', 'sha', '00:26:55:e8:b0:43', 'tha', 'bc:30:5b:f7:07:fc']
  - op: 2
  - sha: 00:26:55:e8:b0:43
  - sip: 193.170.192.129
  - tha: bc:30:5b:f7:07:fc
  - tip: 193.170.192.142
- eth: ['eth', 'src', '00:26:55:e8:b0:43', 'dst', 'bc:30:5b:f7:07:fc']
  - dst: bc:30:5b:f7:07:fc
  - src: 00:26:55:e8:b0:43
- eth_type: 0x0806
- in_port: 2
- packets: 0
0
00:26:55:e8:b0:43
bc:30:5b:f7:07:fc

in_port(2),eth(src=bc:30:5b:f6:dd:fc,dst=bc:30:5b:f7:07:fc),eth_type(0x0800),ipv4(src=193.170.192.143,dst=193.170.192.142,proto=6,tos=0,ttl=64,frag=no),tcp(src=45969,dst=5672), packets:1, bytes:87, used:4.040s, flags:P., actions:1
['in_port', '2', ['eth', 'src', 'bc:30:5b:f6:dd:fc', 'dst', 'bc:30:5b:f7:07:fc'], 'eth_type', '0x0800', ['ipv4', 'src', '193.170.192.143', 'dst', '193.170.192.142', 'proto', '6', 'tos', '0', 'ttl', '64', 'frag', 'no'], ['tcp', 'src', '45969', 'dst', '5672'], 'packets', '1']
- eth: ['eth', 'src', 'bc:30:5b:f6:dd:fc', 'dst', 'bc:30:5b:f7:07:fc']
  - dst: bc:30:5b:f7:07:fc
  - src: bc:30:5b:f6:dd:fc
- eth_type: 0x0800
- in_port: 2
- ipv4: ['ipv4', 'src', '193.170.192.143', 'dst', '193.170.192.142', 'proto', '6', 'tos', '0', 'ttl', '64', 'frag', 'no']
  - dst: 193.170.192.142
  - frag: no
  - proto: 6
  - src: 193.170.192.143
  - tos: 0
  - ttl: 64
- packets: 1
- tcp: ['tcp', 'src', '45969', 'dst', '5672']
  - dstPkt: 5672
  - srcPkt: 45969
1
bc:30:5b:f6:dd:fc
bc:30:5b:f7:07:fc

in_port(2),eth(src=bc:30:5b:f6:dd:fc,dst=bc:30:5b:f7:07:fc),eth_type(0x0800),ipv4(src=193.170.192.143,dst=193.170.192.142,proto=6,tos=0,ttl=64,frag=no),tcp(src=45992,dst=5672), packets:118412, bytes:21787661, used:2.168s, flags:P., actions:1
['in_port', '2', ['eth', 'src', 'bc:30:5b:f6:dd:fc', 'dst', 'bc:30:5b:f7:07:fc'], 'eth_type', '0x0800', ['ipv4', 'src', '193.170.192.143', 'dst', '193.170.192.142', 'proto', '6', 'tos', '0', 'ttl', '64', 'frag', 'no'], ['tcp', 'src', '45992', 'dst', '5672'], 'packets', '118412']
- eth: ['eth', 'src', 'bc:30:5b:f6:dd:fc', 'dst', 'bc:30:5b:f7:07:fc']
  - dst: bc:30:5b:f7:07:fc
  - src: bc:30:5b:f6:dd:fc
- eth_type: 0x0800
- in_port: 2
- ipv4: ['ipv4', 'src', '193.170.192.143', 'dst', '193.170.192.142', 'proto', '6', 'tos', '0', 'ttl', '64', 'frag', 'no']
  - dst: 193.170.192.142
  - frag: no
  - proto: 6
  - src: 193.170.192.143
  - tos: 0
  - ttl: 64
- packets: 118412
- tcp: ['tcp', 'src', '45992', 'dst', '5672']
  - dstPkt: 5672
  - srcPkt: 45992
118412
bc:30:5b:f6:dd:fc
bc:30:5b:f7:07:fc

in_port(2),eth(src=00:18:6e:3a:aa:e8,dst=01:80:c2:00:00:00), packets:29131, bytes:1864384, used:1.200s, actions:drop
['in_port', '2', ['eth', 'src', '00:18:6e:3a:aa:e8', 'dst', '01:80:c2:00:00:00'], 'packets', '29131']
- eth: ['eth', 'src', '00:18:6e:3a:aa:e8', 'dst', '01:80:c2:00:00:00']
  - dst: 01:80:c2:00:00:00
  - src: 00:18:6e:3a:aa:e8
- in_port: 2
- packets: 29131
29131
00:18:6e:3a:aa:e8
01:80:c2:00:00:00

使用pyparsing从ovs dump-flow中提取数据

1 个答案: