add filtering by ip as second arg

1 files changed, 25 insertions, 20 deletions

diff --git a/cowrieder.py b/cowrieder.py
index 707f4a0..756f4c7 100644
--- a/cowrieder.py
+++ b/cowrieder.py
@@ -2,13 +2,13 @@ import json
 import sys
 import random
 
-if(len(sys.argv) < 2):
+if not 0 <= 1 < len(sys.argv):
   print("Provide a path to a Cowrie JSON log file")
   exit()
 filepath = sys.argv[1]
 entries = []
 sessions = []
-ips = {}
+session_ips = {}
 
 with open(filepath, "r") as logfile:
   for line in logfile:
@@ -17,23 +17,28 @@ with open(filepath, "r") as logfile:
     session = entry['session']
     if(session not in sessions):
       sessions.append(session)
-      ips.update({session: entry['src_ip']})
+      session_ips.update({session: entry['src_ip']})
+
+filter_ip = ""
+if 0 <= 2 < len(sys.argv):
+  filter_ip = sys.argv[2]
 
 for session in sessions:
-  ip = ips[session]
-  random.seed(session)
-  sr = random.randrange(50, 256)
-  sg = random.randrange(50, 256)
-  sb = random.randrange(50, 256)
-  random.seed(ip)
-  ir = random.randrange(50, 256)
-  ig = random.randrange(50, 256)
-  ib = random.randrange(50, 256)
-  print("\n--- Session \x1b[38;2;{r};{g};{b}m".format(r=sr, g=sg, b=sb) + session + "\x1b[0m from \x1b[38;2;{r};{g};{b}m".format(r=ir, g=ig, b=ib) + ips[session] + "\x1b[0m ---")
-  for entry in entries:
-    if(entry['session'] == session):
-      if(entry['message']):
-        eventid = entry['eventid']
-        print(entry["timestamp"] + " > " + eventid + (" " * (29 - len(eventid))) + ": " + entry['message'])
-      else:
-        print(entry["timestamp"] + " > " + entry['eventid'])
\ No newline at end of file
+  ip = session_ips[session]
+  if(ip == filter_ip or not filter_ip):
+    random.seed(session)
+    sr = random.randrange(50, 256)
+    sg = random.randrange(50, 256)
+    sb = random.randrange(50, 256)
+    random.seed(ip)
+    ir = random.randrange(50, 256)
+    ig = random.randrange(50, 256)
+    ib = random.randrange(50, 256)
+    print("\n--- Session \x1b[38;2;{r};{g};{b}m".format(r=sr, g=sg, b=sb) + session + "\x1b[0m from \x1b[38;2;{r};{g};{b}m".format(r=ir, g=ig, b=ib) + session_ips[session] + "\x1b[0m ---")
+    for entry in entries:
+      if(entry['session'] == session):
+        if(entry['message']):
+          eventid = entry['eventid']
+          print(entry["timestamp"] + " > " + eventid + (" " * (29 - len(eventid))) + ": " + entry['message'])
+        else:
+          print(entry["timestamp"] + " > " + entry['eventid'])
\ No newline at end of file