Initial commit: Server Management Toolkit v2.0
- Complete security menu restructure (3-mode: Analysis/Actions/Live) - Intelligent cPHulk enablement with CSF whitelist import - Live network security monitoring dashboard - Multi-source threat detection and classification - 50+ organized security tools across 4-level menu hierarchy - System health diagnostics with cPanel/WHM integration - Reference database for cross-module intelligence sharing
This commit is contained in:
cschantz
+643
@@ -0,0 +1,643 @@
|
||||
#!/bin/bash
|
||||
|
||||
# Network & Bandwidth Analyzer
|
||||
# Analyzes bandwidth usage, network performance, and traffic patterns
|
||||
|
||||
# Get the script's directory
|
||||
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
|
||||
TOOLKIT_ROOT="$(cd "$SCRIPT_DIR/../.." && pwd)"
|
||||
|
||||
# Source required libraries
|
||||
source "$TOOLKIT_ROOT/lib/common-functions.sh"
|
||||
source "$TOOLKIT_ROOT/lib/system-detect.sh"
|
||||
source "$TOOLKIT_ROOT/lib/reference-db.sh"
|
||||
|
||||
# Initialize system detection
|
||||
detect_system
|
||||
|
||||
# Load system info from reference database
|
||||
if [ -f "$TOOLKIT_ROOT/.sysref" ]; then
|
||||
SYS_HOSTNAME=$(grep "^SYS|HOSTNAME|" "$TOOLKIT_ROOT/.sysref" 2>/dev/null | cut -d'|' -f3)
|
||||
SYS_PANEL=$(grep "^SYS|CONTROL_PANEL|" "$TOOLKIT_ROOT/.sysref" 2>/dev/null | cut -d'|' -f3)
|
||||
SYS_PANEL_VER=$(grep "^SYS|CONTROL_PANEL|" "$TOOLKIT_ROOT/.sysref" 2>/dev/null | cut -d'|' -f4)
|
||||
SYS_OS=$(grep "^SYS|OS|" "$TOOLKIT_ROOT/.sysref" 2>/dev/null | cut -d'|' -f3)
|
||||
SYS_OS_VER=$(grep "^SYS|OS|" "$TOOLKIT_ROOT/.sysref" 2>/dev/null | cut -d'|' -f4)
|
||||
fi
|
||||
|
||||
# Color definitions
|
||||
RED='\033[0;31m'
|
||||
GREEN='\033[0;32m'
|
||||
YELLOW='\033[1;33m'
|
||||
BLUE='\033[0;34m'
|
||||
MAGENTA='\033[0;35m'
|
||||
CYAN='\033[0;36m'
|
||||
BOLD='\033[1m'
|
||||
NC='\033[0m'
|
||||
|
||||
# Report file
|
||||
REPORT_FILE="/tmp/network_bandwidth_report_$(date +%Y%m%d_%H%M%S).txt"
|
||||
|
||||
# Analysis results storage
|
||||
declare -a FINDINGS=()
|
||||
declare -a RECOMMENDATIONS=()
|
||||
|
||||
# Function to add finding
|
||||
add_finding() {
|
||||
local severity="$1"
|
||||
local title="$2"
|
||||
local details="$3"
|
||||
local recommendation="$4"
|
||||
|
||||
# Use @@@SEP@@@ as separator to avoid conflicts with content
|
||||
FINDINGS+=("[$severity] $title@@@SEP@@@$details@@@SEP@@@$recommendation")
|
||||
}
|
||||
|
||||
# Function to check if command exists
|
||||
command_exists() {
|
||||
command -v "$1" &>/dev/null
|
||||
}
|
||||
|
||||
# Function to install vnstat if needed
|
||||
check_and_offer_vnstat() {
|
||||
if ! command_exists vnstat; then
|
||||
echo -e "${YELLOW}[INFO]${NC} vnstat is not installed. vnstat provides historical bandwidth tracking."
|
||||
echo ""
|
||||
read -p "Would you like to install vnstat now? (y/n): " install_vnstat
|
||||
if [[ "$install_vnstat" =~ ^[Yy]$ ]]; then
|
||||
echo -e "${CYAN}[INFO]${NC} Installing vnstat..."
|
||||
if command_exists yum; then
|
||||
yum install -y vnstat
|
||||
elif command_exists apt-get; then
|
||||
apt-get update && apt-get install -y vnstat
|
||||
else
|
||||
echo -e "${RED}[ERROR]${NC} Could not determine package manager"
|
||||
return 1
|
||||
fi
|
||||
|
||||
# Initialize vnstat database
|
||||
echo -e "${CYAN}[INFO]${NC} Initializing vnstat database..."
|
||||
systemctl enable vnstat --now 2>/dev/null || service vnstat start 2>/dev/null
|
||||
sleep 2
|
||||
echo -e "${GREEN}[OK]${NC} vnstat installed and started!"
|
||||
echo -e "${YELLOW}[NOTE]${NC} vnstat needs time to collect data. Initial stats will be limited."
|
||||
echo ""
|
||||
else
|
||||
echo -e "${YELLOW}[INFO]${NC} Skipping vnstat installation. Historical bandwidth data will not be available."
|
||||
return 1
|
||||
fi
|
||||
fi
|
||||
return 0
|
||||
}
|
||||
|
||||
# Function to analyze bandwidth with vnstat
|
||||
analyze_bandwidth_vnstat() {
|
||||
echo -e "${CYAN}[INFO]${NC} Analyzing historical bandwidth usage..."
|
||||
|
||||
if ! check_and_offer_vnstat; then
|
||||
add_finding "INFO" "Historical Bandwidth Tracking Not Available" \
|
||||
"vnstat is not installed - cannot show historical bandwidth data" \
|
||||
"Install vnstat for bandwidth tracking: yum install vnstat"
|
||||
return
|
||||
fi
|
||||
|
||||
# Get primary interface
|
||||
local interface=$(ip route | grep default | awk '{print $5}' | head -1)
|
||||
|
||||
if [ -z "$interface" ]; then
|
||||
add_finding "WARNING" "Cannot Determine Network Interface" \
|
||||
"Unable to detect primary network interface" \
|
||||
"Check network configuration: ip route show"
|
||||
return
|
||||
fi
|
||||
|
||||
# Check if vnstat has data for this interface
|
||||
if ! vnstat -i "$interface" &>/dev/null; then
|
||||
echo -e "${YELLOW}[INFO]${NC} Initializing vnstat for interface $interface..."
|
||||
vnstat --create -i "$interface" 2>/dev/null
|
||||
echo -e "${YELLOW}[NOTE]${NC} vnstat database created. Data collection will begin now."
|
||||
echo " Run this tool again after some time to see bandwidth statistics."
|
||||
echo ""
|
||||
add_finding "INFO" "Bandwidth Monitoring Initialized" \
|
||||
"vnstat database created for interface $interface
|
||||
Data collection started - statistics will be available after some usage" \
|
||||
"Run this analyzer again in 1+ hours to see bandwidth trends"
|
||||
return
|
||||
fi
|
||||
|
||||
# Get monthly bandwidth
|
||||
local monthly_data=$(vnstat -i "$interface" -m --json 2>/dev/null)
|
||||
|
||||
if [ -n "$monthly_data" ]; then
|
||||
# Extract current month data using basic parsing (fallback if jq not available)
|
||||
local current_month_rx=$(vnstat -i "$interface" -m | grep "$(date +%Y-%m)" | awk '{print $3, $4}' | head -1)
|
||||
local current_month_tx=$(vnstat -i "$interface" -m | grep "$(date +%Y-%m)" | awk '{print $6, $7}' | head -1)
|
||||
local current_month_total=$(vnstat -i "$interface" -m | grep "$(date +%Y-%m)" | awk '{print $9, $10}' | head -1)
|
||||
|
||||
if [ -n "$current_month_total" ]; then
|
||||
add_finding "INFO" "Monthly Bandwidth Usage ($(date +%B))" \
|
||||
"Interface: $interface
|
||||
Download: $current_month_rx
|
||||
Upload: $current_month_tx
|
||||
Total: $current_month_total" \
|
||||
"Monitor bandwidth trends daily to prevent overage"
|
||||
fi
|
||||
fi
|
||||
|
||||
# Get daily bandwidth
|
||||
local daily_summary=$(vnstat -i "$interface" -d | tail -n 15 | head -n 10)
|
||||
if [ -n "$daily_summary" ]; then
|
||||
add_finding "INFO" "Daily Bandwidth Summary (Last 7 Days)" \
|
||||
"$daily_summary" \
|
||||
"Review daily patterns to identify unusual spikes"
|
||||
fi
|
||||
|
||||
# Get hourly bandwidth for today
|
||||
local hourly_summary=$(vnstat -i "$interface" -h | tail -n 8)
|
||||
if [ -n "$hourly_summary" ]; then
|
||||
add_finding "INFO" "Hourly Bandwidth (Last 24 Hours)" \
|
||||
"$hourly_summary" \
|
||||
"Hourly view helps identify peak usage times"
|
||||
fi
|
||||
|
||||
# Check for high bandwidth usage patterns
|
||||
local today_total=$(vnstat -i "$interface" -d | grep "$(date +%Y-%m-%d)" | awk '{print $9}')
|
||||
local today_value=$(echo "$today_total" | awk '{print $1}')
|
||||
local today_unit=$(echo "$today_total" | awk '{print $2}')
|
||||
|
||||
if [ "$today_unit" = "GiB" ] && [ -n "$today_value" ]; then
|
||||
if (( $(echo "$today_value > 50" | bc -l 2>/dev/null || echo 0) )); then
|
||||
add_finding "WARNING" "High Daily Bandwidth Usage" \
|
||||
"Today's usage: $today_total
|
||||
This is significantly higher than typical usage" \
|
||||
"Investigate traffic sources:
|
||||
• Check top bandwidth consumers (see analysis below)
|
||||
• Review Apache logs for unusual traffic
|
||||
• Check for backups or updates running
|
||||
• Look for bot/crawler traffic"
|
||||
fi
|
||||
fi
|
||||
}
|
||||
|
||||
# Function to analyze Apache/web server traffic
|
||||
analyze_web_traffic() {
|
||||
echo -e "${CYAN}[INFO]${NC} Analyzing web server traffic patterns..."
|
||||
|
||||
# Find Apache log directory
|
||||
local log_dir=""
|
||||
if [ -d "/var/log/apache2/domlogs" ]; then
|
||||
log_dir="/var/log/apache2/domlogs"
|
||||
elif [ -d "/etc/apache2/logs/domlogs" ]; then
|
||||
log_dir="/etc/apache2/logs/domlogs"
|
||||
elif [ -d "/var/log/httpd" ]; then
|
||||
log_dir="/var/log/httpd"
|
||||
fi
|
||||
|
||||
if [ -z "$log_dir" ] || [ ! -d "$log_dir" ]; then
|
||||
add_finding "INFO" "Web Server Logs Not Found" \
|
||||
"Could not locate Apache/web server logs" \
|
||||
"Web traffic analysis requires Apache logs"
|
||||
return
|
||||
fi
|
||||
|
||||
# Analyze top requesting IPs
|
||||
echo -e "${CYAN}[INFO]${NC} Finding top requesting IP addresses..."
|
||||
local top_ips=$(find "$log_dir" -name "*.log" -type f -mtime -1 -exec cat {} \; 2>/dev/null | \
|
||||
awk '{print $1}' | sort | uniq -c | sort -rn | head -10 | \
|
||||
awk '{printf " • %8s requests - %s\n", $1, $2}')
|
||||
|
||||
if [ -n "$top_ips" ]; then
|
||||
add_finding "INFO" "Top Requesting IPs (Last 24 Hours)" \
|
||||
"$top_ips" \
|
||||
"Investigate high-volume IPs:
|
||||
• Check if legitimate (search engines, monitoring)
|
||||
• Look for bot patterns in User-Agent
|
||||
• Consider rate limiting if abusive
|
||||
• Use Bot Analyzer for detailed analysis"
|
||||
fi
|
||||
|
||||
# Analyze bandwidth by domain (if cPanel)
|
||||
if [ "$SYS_PANEL" = "cpanel" ]; then
|
||||
echo -e "${CYAN}[INFO]${NC} Analyzing per-domain bandwidth..."
|
||||
local domain_bandwidth=""
|
||||
|
||||
for logfile in "$log_dir"/*.log; do
|
||||
[ -f "$logfile" ] || continue
|
||||
local domain=$(basename "$logfile" .log)
|
||||
local bytes=$(awk '{sum+=$10} END {print sum}' "$logfile" 2>/dev/null || echo "0")
|
||||
|
||||
if [ "$bytes" -gt 0 ]; then
|
||||
local mb=$(echo "scale=2; $bytes / 1048576" | bc 2>/dev/null || echo "0")
|
||||
domain_bandwidth+=" • $(printf '%-40s %10.2f MB' "$domain" "$mb")"$'\n'
|
||||
fi
|
||||
done
|
||||
|
||||
if [ -n "$domain_bandwidth" ]; then
|
||||
domain_bandwidth=$(echo "$domain_bandwidth" | sort -k2 -rn | head -10)
|
||||
add_finding "INFO" "Top Bandwidth-Consuming Domains (Last 24 Hours)" \
|
||||
"$domain_bandwidth" \
|
||||
"Review high-bandwidth domains for:
|
||||
• Large file downloads
|
||||
• Media streaming
|
||||
• Bot/crawler traffic
|
||||
• Possible attacks or abuse"
|
||||
fi
|
||||
fi
|
||||
|
||||
# Analyze top requested URLs/files
|
||||
echo -e "${CYAN}[INFO]${NC} Finding most requested URLs..."
|
||||
local top_urls=$(find "$log_dir" -name "*.log" -type f -mtime -1 -exec cat {} \; 2>/dev/null | \
|
||||
awk '{print $7}' | sort | uniq -c | sort -rn | head -10 | \
|
||||
awk '{printf " • %8s requests - %s\n", $1, $2}')
|
||||
|
||||
if [ -n "$top_urls" ]; then
|
||||
add_finding "INFO" "Most Requested URLs (Last 24 Hours)" \
|
||||
"$top_urls" \
|
||||
"Check for:
|
||||
• Broken links (404s)
|
||||
• Bot crawling patterns
|
||||
• Resource-intensive endpoints
|
||||
• Potential attack vectors"
|
||||
fi
|
||||
|
||||
# Check for high bandwidth files
|
||||
echo -e "${CYAN}[INFO]${NC} Finding large bandwidth-consuming requests..."
|
||||
local large_transfers=$(find "$log_dir" -name "*.log" -type f -mtime -1 -exec cat {} \; 2>/dev/null | \
|
||||
awk '$10 > 10485760 {sum+=$10; count++} END {if (count > 0) printf " • Total large files: %d\n • Combined size: %.2f GB\n", count, sum/1073741824}')
|
||||
|
||||
if [ -n "$large_transfers" ]; then
|
||||
add_finding "INFO" "Large File Transfers (>10MB each)" \
|
||||
"$large_transfers" \
|
||||
"Large file downloads can consume significant bandwidth
|
||||
• Consider CDN for large static files
|
||||
• Implement download throttling
|
||||
• Check for legitimate vs bot downloads"
|
||||
fi
|
||||
}
|
||||
|
||||
# Function to analyze network connections
|
||||
analyze_network_connections() {
|
||||
echo -e "${CYAN}[INFO]${NC} Analyzing network connections..."
|
||||
|
||||
# Count connections by state
|
||||
local conn_states=$(netstat -an 2>/dev/null | awk '/^tcp/ {print $6}' | sort | uniq -c | sort -rn | \
|
||||
awk '{printf " • %-20s %s\n", $2, $1}')
|
||||
|
||||
if [ -n "$conn_states" ]; then
|
||||
add_finding "INFO" "TCP Connection States" \
|
||||
"$conn_states" \
|
||||
"Monitor connection states:
|
||||
• High TIME_WAIT: Normal after busy traffic
|
||||
• High CLOSE_WAIT: Possible application issues
|
||||
• High SYN_RECV: Possible SYN flood attack"
|
||||
fi
|
||||
|
||||
# Count total connections
|
||||
local total_conn=$(netstat -an 2>/dev/null | grep -c "^tcp")
|
||||
if [ "$total_conn" -gt 1000 ]; then
|
||||
add_finding "WARNING" "High Number of TCP Connections" \
|
||||
"Current TCP connections: $total_conn
|
||||
This may indicate high traffic or connection leak" \
|
||||
"Investigate connection sources:
|
||||
• netstat -an | grep ESTABLISHED | awk '{print \$5}' | cut -d: -f1 | sort | uniq -c | sort -rn
|
||||
• Check for connection pooling issues
|
||||
• Review application connection handling"
|
||||
fi
|
||||
|
||||
# Top connecting IPs
|
||||
local top_conn_ips=$(netstat -an 2>/dev/null | grep ESTABLISHED | awk '{print $5}' | cut -d: -f1 | \
|
||||
sort | uniq -c | sort -rn | head -10 | awk '{printf " • %8s connections - %s\n", $1, $2}')
|
||||
|
||||
if [ -n "$top_conn_ips" ]; then
|
||||
add_finding "INFO" "Top Connected IP Addresses" \
|
||||
"$top_conn_ips" \
|
||||
"Review connection patterns from these IPs"
|
||||
fi
|
||||
}
|
||||
|
||||
# Function to check network performance
|
||||
analyze_network_performance() {
|
||||
echo -e "${CYAN}[INFO]${NC} Analyzing network performance..."
|
||||
|
||||
# Get primary interface
|
||||
local interface=$(ip route | grep default | awk '{print $5}' | head -1)
|
||||
|
||||
if [ -z "$interface" ]; then
|
||||
add_finding "WARNING" "Cannot Determine Network Interface" \
|
||||
"Unable to detect primary network interface" \
|
||||
"Check network configuration: ip route show"
|
||||
return
|
||||
fi
|
||||
|
||||
# Get interface statistics
|
||||
local rx_errors=$(cat "/sys/class/net/$interface/statistics/rx_errors" 2>/dev/null || echo "0")
|
||||
local tx_errors=$(cat "/sys/class/net/$interface/statistics/tx_errors" 2>/dev/null || echo "0")
|
||||
local rx_dropped=$(cat "/sys/class/net/$interface/statistics/rx_dropped" 2>/dev/null || echo "0")
|
||||
local tx_dropped=$(cat "/sys/class/net/$interface/statistics/tx_dropped" 2>/dev/null || echo "0")
|
||||
|
||||
if [ "$rx_errors" -gt 100 ] || [ "$tx_errors" -gt 100 ]; then
|
||||
add_finding "WARNING" "Network Interface Errors Detected" \
|
||||
"Interface: $interface
|
||||
RX Errors: $rx_errors
|
||||
TX Errors: $tx_errors
|
||||
RX Dropped: $rx_dropped
|
||||
TX Dropped: $tx_dropped" \
|
||||
"Network errors may indicate:
|
||||
• Hardware issues (cable, NIC)
|
||||
• Driver problems
|
||||
• Network congestion
|
||||
Check: dmesg | grep -i $interface | tail -20"
|
||||
fi
|
||||
|
||||
# Get MTU
|
||||
local mtu=$(ip link show "$interface" 2>/dev/null | grep mtu | awk '{print $5}')
|
||||
if [ -n "$mtu" ]; then
|
||||
if [ "$mtu" -ne 1500 ] && [ "$mtu" -ne 9000 ]; then
|
||||
add_finding "INFO" "Non-Standard MTU Detected" \
|
||||
"Interface: $interface
|
||||
Current MTU: $mtu
|
||||
Standard MTU is typically 1500 (or 9000 for jumbo frames)" \
|
||||
"Ensure MTU matches your network infrastructure
|
||||
• Test MTU: ping -M do -s 1472 8.8.8.8
|
||||
• Set MTU: ip link set $interface mtu 1500"
|
||||
else
|
||||
add_finding "INFO" "Network Interface Configuration" \
|
||||
"Interface: $interface
|
||||
MTU: $mtu
|
||||
RX Errors: $rx_errors
|
||||
TX Errors: $tx_errors
|
||||
RX Dropped: $rx_dropped
|
||||
TX Dropped: $tx_dropped" \
|
||||
"Network interface appears healthy"
|
||||
fi
|
||||
fi
|
||||
|
||||
# Check TCP statistics
|
||||
local tcp_retrans=$(netstat -s 2>/dev/null | grep "segments retransmitted" | awk '{print $1}' || echo "0")
|
||||
local tcp_out=$(netstat -s 2>/dev/null | grep "segments sent out" | awk '{print $1}' || echo "1")
|
||||
|
||||
if [ "$tcp_out" -gt 1000000 ]; then
|
||||
local retrans_percent=$(echo "scale=2; $tcp_retrans * 100 / $tcp_out" | bc 2>/dev/null || echo "0")
|
||||
|
||||
if (( $(echo "$retrans_percent > 5" | bc -l 2>/dev/null || echo 0) )); then
|
||||
add_finding "WARNING" "High TCP Retransmission Rate" \
|
||||
"Retransmission rate: ${retrans_percent}%
|
||||
Segments retransmitted: $tcp_retrans
|
||||
Total segments sent: $tcp_out" \
|
||||
"High retransmission indicates network problems:
|
||||
• Test packet loss: ping -c 100 8.8.8.8
|
||||
• Check MTU settings
|
||||
• Review network congestion
|
||||
• Contact hosting provider if persistent"
|
||||
else
|
||||
add_finding "INFO" "TCP Retransmission Rate" \
|
||||
"Retransmission rate: ${retrans_percent}% (healthy)
|
||||
Segments retransmitted: $tcp_retrans
|
||||
Total segments sent: $tcp_out" \
|
||||
"TCP retransmission rate is within normal range"
|
||||
fi
|
||||
fi
|
||||
|
||||
# Test connectivity to common DNS
|
||||
echo -e "${CYAN}[INFO]${NC} Testing network connectivity..."
|
||||
local ping_result=$(ping -c 5 -W 2 8.8.8.8 2>/dev/null | grep "packet loss" | awk '{print $6}' | tr -d '%')
|
||||
|
||||
if [ -n "$ping_result" ]; then
|
||||
if (( $(echo "$ping_result > 5" | bc -l 2>/dev/null || echo 0) )); then
|
||||
add_finding "WARNING" "Packet Loss Detected" \
|
||||
"Packet loss to 8.8.8.8: ${ping_result}%
|
||||
This indicates network connectivity issues" \
|
||||
"Investigate packet loss:
|
||||
• Test multiple targets: ping -c 100 [your-dns-server]
|
||||
• Check for network congestion
|
||||
• Review with hosting provider
|
||||
• Check interface errors (see above)"
|
||||
else
|
||||
local avg_latency=$(ping -c 5 -W 2 8.8.8.8 2>/dev/null | grep "avg" | awk -F'/' '{print $5}')
|
||||
add_finding "INFO" "Network Connectivity Test" \
|
||||
"Packet loss: ${ping_result}% (excellent)
|
||||
Average latency: ${avg_latency}ms" \
|
||||
"Network connectivity is healthy"
|
||||
fi
|
||||
fi
|
||||
}
|
||||
|
||||
# Function to recommend monitoring tools
|
||||
recommend_monitoring_tools() {
|
||||
echo -e "${CYAN}[INFO]${NC} Checking for real-time monitoring tools..."
|
||||
|
||||
local tools_needed=()
|
||||
local tools_installed=()
|
||||
|
||||
# Check iftop
|
||||
if command_exists iftop; then
|
||||
tools_installed+=("iftop - Real-time bandwidth by connection")
|
||||
else
|
||||
tools_needed+=("iftop - Real-time bandwidth monitoring (yum install iftop)")
|
||||
fi
|
||||
|
||||
# Check nethogs
|
||||
if command_exists nethogs; then
|
||||
tools_installed+=("nethogs - Bandwidth by process")
|
||||
else
|
||||
tools_needed+=("nethogs - Per-process bandwidth monitoring (yum install nethogs)")
|
||||
fi
|
||||
|
||||
# Check nload
|
||||
if command_exists nload; then
|
||||
tools_installed+=("nload - Simple real-time traffic graph")
|
||||
else
|
||||
tools_needed+=("nload - Simple bandwidth monitor (yum install nload)")
|
||||
fi
|
||||
|
||||
# Check iperf3
|
||||
if command_exists iperf3; then
|
||||
tools_installed+=("iperf3 - Network performance testing")
|
||||
else
|
||||
tools_needed+=("iperf3 - Bandwidth testing tool (yum install iperf3)")
|
||||
fi
|
||||
|
||||
if [ ${#tools_installed[@]} -gt 0 ]; then
|
||||
local installed_list=$(printf ' • %s\n' "${tools_installed[@]}")
|
||||
add_finding "INFO" "Installed Monitoring Tools" \
|
||||
"$installed_list" \
|
||||
"Use these tools for real-time bandwidth monitoring"
|
||||
fi
|
||||
|
||||
if [ ${#tools_needed[@]} -gt 0 ]; then
|
||||
local needed_list=$(printf ' • %s\n' "${tools_needed[@]}")
|
||||
add_finding "INFO" "Recommended Monitoring Tools" \
|
||||
"Consider installing these tools for better monitoring:
|
||||
$needed_list" \
|
||||
"Install tools: yum install iftop nethogs nload iperf3
|
||||
Usage examples:
|
||||
• iftop -i $interface (real-time bandwidth by connection)
|
||||
• nethogs $interface (bandwidth by process)
|
||||
• nload $interface (simple traffic graph)
|
||||
• vnstat -l (live traffic stats)"
|
||||
fi
|
||||
}
|
||||
|
||||
# Function to generate report
|
||||
generate_report() {
|
||||
local report_content=""
|
||||
|
||||
report_content+="=============================================================================="$'\n'
|
||||
report_content+="NETWORK & BANDWIDTH ANALYSIS - $(date '+%Y-%m-%d %H:%M:%S')"$'\n'
|
||||
report_content+="=============================================================================="$'\n'
|
||||
report_content+=""$'\n'
|
||||
report_content+="System: $SYS_HOSTNAME"$'\n'
|
||||
report_content+="Control Panel: $SYS_PANEL ${SYS_PANEL_VER:-unknown}"$'\n'
|
||||
report_content+="OS: $SYS_OS ${SYS_OS_VER:-unknown}"$'\n'
|
||||
report_content+=""$'\n'
|
||||
|
||||
# Group findings by category
|
||||
local -A categories
|
||||
categories["BANDWIDTH"]=""
|
||||
categories["WEB_TRAFFIC"]=""
|
||||
categories["CONNECTIONS"]=""
|
||||
categories["PERFORMANCE"]=""
|
||||
categories["TOOLS"]=""
|
||||
categories["OTHER"]=""
|
||||
|
||||
for finding in "${FINDINGS[@]}"; do
|
||||
# Split by @@@SEP@@@ delimiter
|
||||
local severity_title="${finding%%@@@SEP@@@*}"
|
||||
local temp="${finding#*@@@SEP@@@}"
|
||||
local details="${temp%%@@@SEP@@@*}"
|
||||
local recommendation="${temp#*@@@SEP@@@}"
|
||||
|
||||
# Extract severity from [SEVERITY] Title format
|
||||
local severity=$(echo "$severity_title" | sed -n 's/^\[\([^]]*\)\].*/\1/p')
|
||||
local title=$(echo "$severity_title" | sed 's/^\[[^]]*\] //')
|
||||
|
||||
local category="OTHER"
|
||||
if [[ "$title" == *"Bandwidth"* ]] || [[ "$title" == *"Monthly"* ]] || [[ "$title" == *"Daily"* ]] || [[ "$title" == *"Hourly"* ]]; then
|
||||
category="BANDWIDTH"
|
||||
elif [[ "$title" == *"Domain"* ]] || [[ "$title" == *"URL"* ]] || [[ "$title" == *"Web"* ]] || [[ "$title" == *"IP"* ]]; then
|
||||
category="WEB_TRAFFIC"
|
||||
elif [[ "$title" == *"Connection"* ]]; then
|
||||
category="CONNECTIONS"
|
||||
elif [[ "$title" == *"Network"* ]] || [[ "$title" == *"TCP"* ]] || [[ "$title" == *"MTU"* ]] || [[ "$title" == *"Packet"* ]]; then
|
||||
category="PERFORMANCE"
|
||||
elif [[ "$title" == *"Tool"* ]] || [[ "$title" == *"Monitoring"* ]]; then
|
||||
category="TOOLS"
|
||||
fi
|
||||
|
||||
local entry=""
|
||||
entry+="[$severity] $title"$'\n'
|
||||
entry+="$details"$'\n'
|
||||
if [ -n "$recommendation" ]; then
|
||||
entry+="Recommendation:"$'\n'
|
||||
entry+="$recommendation"$'\n'
|
||||
fi
|
||||
entry+=""$'\n'
|
||||
entry+="------------------------------------------------------------------------------"$'\n'
|
||||
entry+=""$'\n'
|
||||
|
||||
categories[$category]+="$entry"
|
||||
done
|
||||
|
||||
# Output sections
|
||||
if [ -n "${categories[BANDWIDTH]}" ]; then
|
||||
report_content+="=============================================================================="$'\n'
|
||||
report_content+="BANDWIDTH USAGE"$'\n'
|
||||
report_content+="=============================================================================="$'\n'
|
||||
report_content+=""$'\n'
|
||||
report_content+="${categories[BANDWIDTH]}"
|
||||
fi
|
||||
|
||||
if [ -n "${categories[WEB_TRAFFIC]}" ]; then
|
||||
report_content+="=============================================================================="$'\n'
|
||||
report_content+="WEB TRAFFIC ANALYSIS"$'\n'
|
||||
report_content+="=============================================================================="$'\n'
|
||||
report_content+=""$'\n'
|
||||
report_content+="${categories[WEB_TRAFFIC]}"
|
||||
fi
|
||||
|
||||
if [ -n "${categories[CONNECTIONS]}" ]; then
|
||||
report_content+="=============================================================================="$'\n'
|
||||
report_content+="NETWORK CONNECTIONS"$'\n'
|
||||
report_content+="=============================================================================="$'\n'
|
||||
report_content+=""$'\n'
|
||||
report_content+="${categories[CONNECTIONS]}"
|
||||
fi
|
||||
|
||||
if [ -n "${categories[PERFORMANCE]}" ]; then
|
||||
report_content+="=============================================================================="$'\n'
|
||||
report_content+="NETWORK PERFORMANCE"$'\n'
|
||||
report_content+="=============================================================================="$'\n'
|
||||
report_content+=""$'\n'
|
||||
report_content+="${categories[PERFORMANCE]}"
|
||||
fi
|
||||
|
||||
if [ -n "${categories[TOOLS]}" ]; then
|
||||
report_content+="=============================================================================="$'\n'
|
||||
report_content+="MONITORING TOOLS"$'\n'
|
||||
report_content+="=============================================================================="$'\n'
|
||||
report_content+=""$'\n'
|
||||
report_content+="${categories[TOOLS]}"
|
||||
fi
|
||||
|
||||
if [ -n "${categories[OTHER]}" ]; then
|
||||
report_content+="=============================================================================="$'\n'
|
||||
report_content+="OTHER FINDINGS"$'\n'
|
||||
report_content+="=============================================================================="$'\n'
|
||||
report_content+=""$'\n'
|
||||
report_content+="${categories[OTHER]}"
|
||||
fi
|
||||
|
||||
report_content+="=============================================================================="$'\n'
|
||||
report_content+="NEXT STEPS"$'\n'
|
||||
report_content+="=============================================================================="$'\n'
|
||||
report_content+=""$'\n'
|
||||
report_content+="Priority Actions:"$'\n'
|
||||
report_content+=" 1. Review bandwidth usage trends for unusual patterns"$'\n'
|
||||
report_content+=" 2. Investigate high-volume IP addresses and domains"$'\n'
|
||||
report_content+=" 3. Address any network performance issues"$'\n'
|
||||
report_content+=" 4. Consider installing monitoring tools for real-time tracking"$'\n'
|
||||
report_content+=""$'\n'
|
||||
report_content+="Additional Analysis Available:"$'\n'
|
||||
report_content+=" • Bot Analyzer (Main Menu → Security) for bot/attack traffic analysis"$'\n'
|
||||
report_content+=" • System Health Check (Main Menu) for overall server health"$'\n'
|
||||
report_content+=""$'\n'
|
||||
report_content+="Report saved to: $REPORT_FILE"$'\n'
|
||||
report_content+=""$'\n'
|
||||
|
||||
echo "$report_content"
|
||||
echo "$report_content" > "$REPORT_FILE"
|
||||
}
|
||||
|
||||
# Main execution
|
||||
main() {
|
||||
show_banner
|
||||
echo -e "${BLUE}${BOLD}🌐 Network & Bandwidth Analyzer${NC}"
|
||||
echo ""
|
||||
echo ""
|
||||
|
||||
echo -e "${CYAN}[INFO]${NC} Starting network and bandwidth analysis..."
|
||||
echo ""
|
||||
|
||||
# Run analyses
|
||||
analyze_bandwidth_vnstat
|
||||
analyze_web_traffic
|
||||
analyze_network_connections
|
||||
analyze_network_performance
|
||||
recommend_monitoring_tools
|
||||
|
||||
echo ""
|
||||
echo -e "${GREEN}[OK]${NC} Analysis complete!"
|
||||
echo ""
|
||||
|
||||
# Generate and display report
|
||||
generate_report
|
||||
|
||||
echo ""
|
||||
echo -e "${GREEN}[INFO]${NC} Full report saved to: ${CYAN}$REPORT_FILE${NC}"
|
||||
echo ""
|
||||
echo ""
|
||||
|
||||
press_enter
|
||||
}
|
||||
|
||||
# Run main function
|
||||
main
|
||||
Reference in New Issue
Block a user