cschantz
a51d968185
- Complete security menu restructure (3-mode: Analysis/Actions/Live) - Intelligent cPHulk enablement with CSF whitelist import - Live network security monitoring dashboard - Multi-source threat detection and classification - 50+ organized security tools across 4-level menu hierarchy - System health diagnostics with cPanel/WHM integration - Reference database for cross-module intelligence sharing
644 lines
25 KiB
Bash
Executable File
644 lines
25 KiB
Bash
Executable File
#!/bin/bash
|
|
|
|
# Network & Bandwidth Analyzer
|
|
# Analyzes bandwidth usage, network performance, and traffic patterns
|
|
|
|
# Get the script's directory
|
|
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
|
|
TOOLKIT_ROOT="$(cd "$SCRIPT_DIR/../.." && pwd)"
|
|
|
|
# Source required libraries
|
|
source "$TOOLKIT_ROOT/lib/common-functions.sh"
|
|
source "$TOOLKIT_ROOT/lib/system-detect.sh"
|
|
source "$TOOLKIT_ROOT/lib/reference-db.sh"
|
|
|
|
# Initialize system detection
|
|
detect_system
|
|
|
|
# Load system info from reference database
|
|
if [ -f "$TOOLKIT_ROOT/.sysref" ]; then
|
|
SYS_HOSTNAME=$(grep "^SYS|HOSTNAME|" "$TOOLKIT_ROOT/.sysref" 2>/dev/null | cut -d'|' -f3)
|
|
SYS_PANEL=$(grep "^SYS|CONTROL_PANEL|" "$TOOLKIT_ROOT/.sysref" 2>/dev/null | cut -d'|' -f3)
|
|
SYS_PANEL_VER=$(grep "^SYS|CONTROL_PANEL|" "$TOOLKIT_ROOT/.sysref" 2>/dev/null | cut -d'|' -f4)
|
|
SYS_OS=$(grep "^SYS|OS|" "$TOOLKIT_ROOT/.sysref" 2>/dev/null | cut -d'|' -f3)
|
|
SYS_OS_VER=$(grep "^SYS|OS|" "$TOOLKIT_ROOT/.sysref" 2>/dev/null | cut -d'|' -f4)
|
|
fi
|
|
|
|
# Color definitions
|
|
RED='\033[0;31m'
|
|
GREEN='\033[0;32m'
|
|
YELLOW='\033[1;33m'
|
|
BLUE='\033[0;34m'
|
|
MAGENTA='\033[0;35m'
|
|
CYAN='\033[0;36m'
|
|
BOLD='\033[1m'
|
|
NC='\033[0m'
|
|
|
|
# Report file
|
|
REPORT_FILE="/tmp/network_bandwidth_report_$(date +%Y%m%d_%H%M%S).txt"
|
|
|
|
# Analysis results storage
|
|
declare -a FINDINGS=()
|
|
declare -a RECOMMENDATIONS=()
|
|
|
|
# Function to add finding
|
|
add_finding() {
|
|
local severity="$1"
|
|
local title="$2"
|
|
local details="$3"
|
|
local recommendation="$4"
|
|
|
|
# Use @@@SEP@@@ as separator to avoid conflicts with content
|
|
FINDINGS+=("[$severity] $title@@@SEP@@@$details@@@SEP@@@$recommendation")
|
|
}
|
|
|
|
# Function to check if command exists
|
|
command_exists() {
|
|
command -v "$1" &>/dev/null
|
|
}
|
|
|
|
# Function to install vnstat if needed
|
|
check_and_offer_vnstat() {
|
|
if ! command_exists vnstat; then
|
|
echo -e "${YELLOW}[INFO]${NC} vnstat is not installed. vnstat provides historical bandwidth tracking."
|
|
echo ""
|
|
read -p "Would you like to install vnstat now? (y/n): " install_vnstat
|
|
if [[ "$install_vnstat" =~ ^[Yy]$ ]]; then
|
|
echo -e "${CYAN}[INFO]${NC} Installing vnstat..."
|
|
if command_exists yum; then
|
|
yum install -y vnstat
|
|
elif command_exists apt-get; then
|
|
apt-get update && apt-get install -y vnstat
|
|
else
|
|
echo -e "${RED}[ERROR]${NC} Could not determine package manager"
|
|
return 1
|
|
fi
|
|
|
|
# Initialize vnstat database
|
|
echo -e "${CYAN}[INFO]${NC} Initializing vnstat database..."
|
|
systemctl enable vnstat --now 2>/dev/null || service vnstat start 2>/dev/null
|
|
sleep 2
|
|
echo -e "${GREEN}[OK]${NC} vnstat installed and started!"
|
|
echo -e "${YELLOW}[NOTE]${NC} vnstat needs time to collect data. Initial stats will be limited."
|
|
echo ""
|
|
else
|
|
echo -e "${YELLOW}[INFO]${NC} Skipping vnstat installation. Historical bandwidth data will not be available."
|
|
return 1
|
|
fi
|
|
fi
|
|
return 0
|
|
}
|
|
|
|
# Function to analyze bandwidth with vnstat
|
|
analyze_bandwidth_vnstat() {
|
|
echo -e "${CYAN}[INFO]${NC} Analyzing historical bandwidth usage..."
|
|
|
|
if ! check_and_offer_vnstat; then
|
|
add_finding "INFO" "Historical Bandwidth Tracking Not Available" \
|
|
"vnstat is not installed - cannot show historical bandwidth data" \
|
|
"Install vnstat for bandwidth tracking: yum install vnstat"
|
|
return
|
|
fi
|
|
|
|
# Get primary interface
|
|
local interface=$(ip route | grep default | awk '{print $5}' | head -1)
|
|
|
|
if [ -z "$interface" ]; then
|
|
add_finding "WARNING" "Cannot Determine Network Interface" \
|
|
"Unable to detect primary network interface" \
|
|
"Check network configuration: ip route show"
|
|
return
|
|
fi
|
|
|
|
# Check if vnstat has data for this interface
|
|
if ! vnstat -i "$interface" &>/dev/null; then
|
|
echo -e "${YELLOW}[INFO]${NC} Initializing vnstat for interface $interface..."
|
|
vnstat --create -i "$interface" 2>/dev/null
|
|
echo -e "${YELLOW}[NOTE]${NC} vnstat database created. Data collection will begin now."
|
|
echo " Run this tool again after some time to see bandwidth statistics."
|
|
echo ""
|
|
add_finding "INFO" "Bandwidth Monitoring Initialized" \
|
|
"vnstat database created for interface $interface
|
|
Data collection started - statistics will be available after some usage" \
|
|
"Run this analyzer again in 1+ hours to see bandwidth trends"
|
|
return
|
|
fi
|
|
|
|
# Get monthly bandwidth
|
|
local monthly_data=$(vnstat -i "$interface" -m --json 2>/dev/null)
|
|
|
|
if [ -n "$monthly_data" ]; then
|
|
# Extract current month data using basic parsing (fallback if jq not available)
|
|
local current_month_rx=$(vnstat -i "$interface" -m | grep "$(date +%Y-%m)" | awk '{print $3, $4}' | head -1)
|
|
local current_month_tx=$(vnstat -i "$interface" -m | grep "$(date +%Y-%m)" | awk '{print $6, $7}' | head -1)
|
|
local current_month_total=$(vnstat -i "$interface" -m | grep "$(date +%Y-%m)" | awk '{print $9, $10}' | head -1)
|
|
|
|
if [ -n "$current_month_total" ]; then
|
|
add_finding "INFO" "Monthly Bandwidth Usage ($(date +%B))" \
|
|
"Interface: $interface
|
|
Download: $current_month_rx
|
|
Upload: $current_month_tx
|
|
Total: $current_month_total" \
|
|
"Monitor bandwidth trends daily to prevent overage"
|
|
fi
|
|
fi
|
|
|
|
# Get daily bandwidth
|
|
local daily_summary=$(vnstat -i "$interface" -d | tail -n 15 | head -n 10)
|
|
if [ -n "$daily_summary" ]; then
|
|
add_finding "INFO" "Daily Bandwidth Summary (Last 7 Days)" \
|
|
"$daily_summary" \
|
|
"Review daily patterns to identify unusual spikes"
|
|
fi
|
|
|
|
# Get hourly bandwidth for today
|
|
local hourly_summary=$(vnstat -i "$interface" -h | tail -n 8)
|
|
if [ -n "$hourly_summary" ]; then
|
|
add_finding "INFO" "Hourly Bandwidth (Last 24 Hours)" \
|
|
"$hourly_summary" \
|
|
"Hourly view helps identify peak usage times"
|
|
fi
|
|
|
|
# Check for high bandwidth usage patterns
|
|
local today_total=$(vnstat -i "$interface" -d | grep "$(date +%Y-%m-%d)" | awk '{print $9}')
|
|
local today_value=$(echo "$today_total" | awk '{print $1}')
|
|
local today_unit=$(echo "$today_total" | awk '{print $2}')
|
|
|
|
if [ "$today_unit" = "GiB" ] && [ -n "$today_value" ]; then
|
|
if (( $(echo "$today_value > 50" | bc -l 2>/dev/null || echo 0) )); then
|
|
add_finding "WARNING" "High Daily Bandwidth Usage" \
|
|
"Today's usage: $today_total
|
|
This is significantly higher than typical usage" \
|
|
"Investigate traffic sources:
|
|
• Check top bandwidth consumers (see analysis below)
|
|
• Review Apache logs for unusual traffic
|
|
• Check for backups or updates running
|
|
• Look for bot/crawler traffic"
|
|
fi
|
|
fi
|
|
}
|
|
|
|
# Function to analyze Apache/web server traffic
|
|
analyze_web_traffic() {
|
|
echo -e "${CYAN}[INFO]${NC} Analyzing web server traffic patterns..."
|
|
|
|
# Find Apache log directory
|
|
local log_dir=""
|
|
if [ -d "/var/log/apache2/domlogs" ]; then
|
|
log_dir="/var/log/apache2/domlogs"
|
|
elif [ -d "/etc/apache2/logs/domlogs" ]; then
|
|
log_dir="/etc/apache2/logs/domlogs"
|
|
elif [ -d "/var/log/httpd" ]; then
|
|
log_dir="/var/log/httpd"
|
|
fi
|
|
|
|
if [ -z "$log_dir" ] || [ ! -d "$log_dir" ]; then
|
|
add_finding "INFO" "Web Server Logs Not Found" \
|
|
"Could not locate Apache/web server logs" \
|
|
"Web traffic analysis requires Apache logs"
|
|
return
|
|
fi
|
|
|
|
# Analyze top requesting IPs
|
|
echo -e "${CYAN}[INFO]${NC} Finding top requesting IP addresses..."
|
|
local top_ips=$(find "$log_dir" -name "*.log" -type f -mtime -1 -exec cat {} \; 2>/dev/null | \
|
|
awk '{print $1}' | sort | uniq -c | sort -rn | head -10 | \
|
|
awk '{printf " • %8s requests - %s\n", $1, $2}')
|
|
|
|
if [ -n "$top_ips" ]; then
|
|
add_finding "INFO" "Top Requesting IPs (Last 24 Hours)" \
|
|
"$top_ips" \
|
|
"Investigate high-volume IPs:
|
|
• Check if legitimate (search engines, monitoring)
|
|
• Look for bot patterns in User-Agent
|
|
• Consider rate limiting if abusive
|
|
• Use Bot Analyzer for detailed analysis"
|
|
fi
|
|
|
|
# Analyze bandwidth by domain (if cPanel)
|
|
if [ "$SYS_PANEL" = "cpanel" ]; then
|
|
echo -e "${CYAN}[INFO]${NC} Analyzing per-domain bandwidth..."
|
|
local domain_bandwidth=""
|
|
|
|
for logfile in "$log_dir"/*.log; do
|
|
[ -f "$logfile" ] || continue
|
|
local domain=$(basename "$logfile" .log)
|
|
local bytes=$(awk '{sum+=$10} END {print sum}' "$logfile" 2>/dev/null || echo "0")
|
|
|
|
if [ "$bytes" -gt 0 ]; then
|
|
local mb=$(echo "scale=2; $bytes / 1048576" | bc 2>/dev/null || echo "0")
|
|
domain_bandwidth+=" • $(printf '%-40s %10.2f MB' "$domain" "$mb")"$'\n'
|
|
fi
|
|
done
|
|
|
|
if [ -n "$domain_bandwidth" ]; then
|
|
domain_bandwidth=$(echo "$domain_bandwidth" | sort -k2 -rn | head -10)
|
|
add_finding "INFO" "Top Bandwidth-Consuming Domains (Last 24 Hours)" \
|
|
"$domain_bandwidth" \
|
|
"Review high-bandwidth domains for:
|
|
• Large file downloads
|
|
• Media streaming
|
|
• Bot/crawler traffic
|
|
• Possible attacks or abuse"
|
|
fi
|
|
fi
|
|
|
|
# Analyze top requested URLs/files
|
|
echo -e "${CYAN}[INFO]${NC} Finding most requested URLs..."
|
|
local top_urls=$(find "$log_dir" -name "*.log" -type f -mtime -1 -exec cat {} \; 2>/dev/null | \
|
|
awk '{print $7}' | sort | uniq -c | sort -rn | head -10 | \
|
|
awk '{printf " • %8s requests - %s\n", $1, $2}')
|
|
|
|
if [ -n "$top_urls" ]; then
|
|
add_finding "INFO" "Most Requested URLs (Last 24 Hours)" \
|
|
"$top_urls" \
|
|
"Check for:
|
|
• Broken links (404s)
|
|
• Bot crawling patterns
|
|
• Resource-intensive endpoints
|
|
• Potential attack vectors"
|
|
fi
|
|
|
|
# Check for high bandwidth files
|
|
echo -e "${CYAN}[INFO]${NC} Finding large bandwidth-consuming requests..."
|
|
local large_transfers=$(find "$log_dir" -name "*.log" -type f -mtime -1 -exec cat {} \; 2>/dev/null | \
|
|
awk '$10 > 10485760 {sum+=$10; count++} END {if (count > 0) printf " • Total large files: %d\n • Combined size: %.2f GB\n", count, sum/1073741824}')
|
|
|
|
if [ -n "$large_transfers" ]; then
|
|
add_finding "INFO" "Large File Transfers (>10MB each)" \
|
|
"$large_transfers" \
|
|
"Large file downloads can consume significant bandwidth
|
|
• Consider CDN for large static files
|
|
• Implement download throttling
|
|
• Check for legitimate vs bot downloads"
|
|
fi
|
|
}
|
|
|
|
# Function to analyze network connections
|
|
analyze_network_connections() {
|
|
echo -e "${CYAN}[INFO]${NC} Analyzing network connections..."
|
|
|
|
# Count connections by state
|
|
local conn_states=$(netstat -an 2>/dev/null | awk '/^tcp/ {print $6}' | sort | uniq -c | sort -rn | \
|
|
awk '{printf " • %-20s %s\n", $2, $1}')
|
|
|
|
if [ -n "$conn_states" ]; then
|
|
add_finding "INFO" "TCP Connection States" \
|
|
"$conn_states" \
|
|
"Monitor connection states:
|
|
• High TIME_WAIT: Normal after busy traffic
|
|
• High CLOSE_WAIT: Possible application issues
|
|
• High SYN_RECV: Possible SYN flood attack"
|
|
fi
|
|
|
|
# Count total connections
|
|
local total_conn=$(netstat -an 2>/dev/null | grep -c "^tcp")
|
|
if [ "$total_conn" -gt 1000 ]; then
|
|
add_finding "WARNING" "High Number of TCP Connections" \
|
|
"Current TCP connections: $total_conn
|
|
This may indicate high traffic or connection leak" \
|
|
"Investigate connection sources:
|
|
• netstat -an | grep ESTABLISHED | awk '{print \$5}' | cut -d: -f1 | sort | uniq -c | sort -rn
|
|
• Check for connection pooling issues
|
|
• Review application connection handling"
|
|
fi
|
|
|
|
# Top connecting IPs
|
|
local top_conn_ips=$(netstat -an 2>/dev/null | grep ESTABLISHED | awk '{print $5}' | cut -d: -f1 | \
|
|
sort | uniq -c | sort -rn | head -10 | awk '{printf " • %8s connections - %s\n", $1, $2}')
|
|
|
|
if [ -n "$top_conn_ips" ]; then
|
|
add_finding "INFO" "Top Connected IP Addresses" \
|
|
"$top_conn_ips" \
|
|
"Review connection patterns from these IPs"
|
|
fi
|
|
}
|
|
|
|
# Function to check network performance
|
|
analyze_network_performance() {
|
|
echo -e "${CYAN}[INFO]${NC} Analyzing network performance..."
|
|
|
|
# Get primary interface
|
|
local interface=$(ip route | grep default | awk '{print $5}' | head -1)
|
|
|
|
if [ -z "$interface" ]; then
|
|
add_finding "WARNING" "Cannot Determine Network Interface" \
|
|
"Unable to detect primary network interface" \
|
|
"Check network configuration: ip route show"
|
|
return
|
|
fi
|
|
|
|
# Get interface statistics
|
|
local rx_errors=$(cat "/sys/class/net/$interface/statistics/rx_errors" 2>/dev/null || echo "0")
|
|
local tx_errors=$(cat "/sys/class/net/$interface/statistics/tx_errors" 2>/dev/null || echo "0")
|
|
local rx_dropped=$(cat "/sys/class/net/$interface/statistics/rx_dropped" 2>/dev/null || echo "0")
|
|
local tx_dropped=$(cat "/sys/class/net/$interface/statistics/tx_dropped" 2>/dev/null || echo "0")
|
|
|
|
if [ "$rx_errors" -gt 100 ] || [ "$tx_errors" -gt 100 ]; then
|
|
add_finding "WARNING" "Network Interface Errors Detected" \
|
|
"Interface: $interface
|
|
RX Errors: $rx_errors
|
|
TX Errors: $tx_errors
|
|
RX Dropped: $rx_dropped
|
|
TX Dropped: $tx_dropped" \
|
|
"Network errors may indicate:
|
|
• Hardware issues (cable, NIC)
|
|
• Driver problems
|
|
• Network congestion
|
|
Check: dmesg | grep -i $interface | tail -20"
|
|
fi
|
|
|
|
# Get MTU
|
|
local mtu=$(ip link show "$interface" 2>/dev/null | grep mtu | awk '{print $5}')
|
|
if [ -n "$mtu" ]; then
|
|
if [ "$mtu" -ne 1500 ] && [ "$mtu" -ne 9000 ]; then
|
|
add_finding "INFO" "Non-Standard MTU Detected" \
|
|
"Interface: $interface
|
|
Current MTU: $mtu
|
|
Standard MTU is typically 1500 (or 9000 for jumbo frames)" \
|
|
"Ensure MTU matches your network infrastructure
|
|
• Test MTU: ping -M do -s 1472 8.8.8.8
|
|
• Set MTU: ip link set $interface mtu 1500"
|
|
else
|
|
add_finding "INFO" "Network Interface Configuration" \
|
|
"Interface: $interface
|
|
MTU: $mtu
|
|
RX Errors: $rx_errors
|
|
TX Errors: $tx_errors
|
|
RX Dropped: $rx_dropped
|
|
TX Dropped: $tx_dropped" \
|
|
"Network interface appears healthy"
|
|
fi
|
|
fi
|
|
|
|
# Check TCP statistics
|
|
local tcp_retrans=$(netstat -s 2>/dev/null | grep "segments retransmitted" | awk '{print $1}' || echo "0")
|
|
local tcp_out=$(netstat -s 2>/dev/null | grep "segments sent out" | awk '{print $1}' || echo "1")
|
|
|
|
if [ "$tcp_out" -gt 1000000 ]; then
|
|
local retrans_percent=$(echo "scale=2; $tcp_retrans * 100 / $tcp_out" | bc 2>/dev/null || echo "0")
|
|
|
|
if (( $(echo "$retrans_percent > 5" | bc -l 2>/dev/null || echo 0) )); then
|
|
add_finding "WARNING" "High TCP Retransmission Rate" \
|
|
"Retransmission rate: ${retrans_percent}%
|
|
Segments retransmitted: $tcp_retrans
|
|
Total segments sent: $tcp_out" \
|
|
"High retransmission indicates network problems:
|
|
• Test packet loss: ping -c 100 8.8.8.8
|
|
• Check MTU settings
|
|
• Review network congestion
|
|
• Contact hosting provider if persistent"
|
|
else
|
|
add_finding "INFO" "TCP Retransmission Rate" \
|
|
"Retransmission rate: ${retrans_percent}% (healthy)
|
|
Segments retransmitted: $tcp_retrans
|
|
Total segments sent: $tcp_out" \
|
|
"TCP retransmission rate is within normal range"
|
|
fi
|
|
fi
|
|
|
|
# Test connectivity to common DNS
|
|
echo -e "${CYAN}[INFO]${NC} Testing network connectivity..."
|
|
local ping_result=$(ping -c 5 -W 2 8.8.8.8 2>/dev/null | grep "packet loss" | awk '{print $6}' | tr -d '%')
|
|
|
|
if [ -n "$ping_result" ]; then
|
|
if (( $(echo "$ping_result > 5" | bc -l 2>/dev/null || echo 0) )); then
|
|
add_finding "WARNING" "Packet Loss Detected" \
|
|
"Packet loss to 8.8.8.8: ${ping_result}%
|
|
This indicates network connectivity issues" \
|
|
"Investigate packet loss:
|
|
• Test multiple targets: ping -c 100 [your-dns-server]
|
|
• Check for network congestion
|
|
• Review with hosting provider
|
|
• Check interface errors (see above)"
|
|
else
|
|
local avg_latency=$(ping -c 5 -W 2 8.8.8.8 2>/dev/null | grep "avg" | awk -F'/' '{print $5}')
|
|
add_finding "INFO" "Network Connectivity Test" \
|
|
"Packet loss: ${ping_result}% (excellent)
|
|
Average latency: ${avg_latency}ms" \
|
|
"Network connectivity is healthy"
|
|
fi
|
|
fi
|
|
}
|
|
|
|
# Function to recommend monitoring tools
|
|
recommend_monitoring_tools() {
|
|
echo -e "${CYAN}[INFO]${NC} Checking for real-time monitoring tools..."
|
|
|
|
local tools_needed=()
|
|
local tools_installed=()
|
|
|
|
# Check iftop
|
|
if command_exists iftop; then
|
|
tools_installed+=("iftop - Real-time bandwidth by connection")
|
|
else
|
|
tools_needed+=("iftop - Real-time bandwidth monitoring (yum install iftop)")
|
|
fi
|
|
|
|
# Check nethogs
|
|
if command_exists nethogs; then
|
|
tools_installed+=("nethogs - Bandwidth by process")
|
|
else
|
|
tools_needed+=("nethogs - Per-process bandwidth monitoring (yum install nethogs)")
|
|
fi
|
|
|
|
# Check nload
|
|
if command_exists nload; then
|
|
tools_installed+=("nload - Simple real-time traffic graph")
|
|
else
|
|
tools_needed+=("nload - Simple bandwidth monitor (yum install nload)")
|
|
fi
|
|
|
|
# Check iperf3
|
|
if command_exists iperf3; then
|
|
tools_installed+=("iperf3 - Network performance testing")
|
|
else
|
|
tools_needed+=("iperf3 - Bandwidth testing tool (yum install iperf3)")
|
|
fi
|
|
|
|
if [ ${#tools_installed[@]} -gt 0 ]; then
|
|
local installed_list=$(printf ' • %s\n' "${tools_installed[@]}")
|
|
add_finding "INFO" "Installed Monitoring Tools" \
|
|
"$installed_list" \
|
|
"Use these tools for real-time bandwidth monitoring"
|
|
fi
|
|
|
|
if [ ${#tools_needed[@]} -gt 0 ]; then
|
|
local needed_list=$(printf ' • %s\n' "${tools_needed[@]}")
|
|
add_finding "INFO" "Recommended Monitoring Tools" \
|
|
"Consider installing these tools for better monitoring:
|
|
$needed_list" \
|
|
"Install tools: yum install iftop nethogs nload iperf3
|
|
Usage examples:
|
|
• iftop -i $interface (real-time bandwidth by connection)
|
|
• nethogs $interface (bandwidth by process)
|
|
• nload $interface (simple traffic graph)
|
|
• vnstat -l (live traffic stats)"
|
|
fi
|
|
}
|
|
|
|
# Function to generate report
|
|
generate_report() {
|
|
local report_content=""
|
|
|
|
report_content+="=============================================================================="$'\n'
|
|
report_content+="NETWORK & BANDWIDTH ANALYSIS - $(date '+%Y-%m-%d %H:%M:%S')"$'\n'
|
|
report_content+="=============================================================================="$'\n'
|
|
report_content+=""$'\n'
|
|
report_content+="System: $SYS_HOSTNAME"$'\n'
|
|
report_content+="Control Panel: $SYS_PANEL ${SYS_PANEL_VER:-unknown}"$'\n'
|
|
report_content+="OS: $SYS_OS ${SYS_OS_VER:-unknown}"$'\n'
|
|
report_content+=""$'\n'
|
|
|
|
# Group findings by category
|
|
local -A categories
|
|
categories["BANDWIDTH"]=""
|
|
categories["WEB_TRAFFIC"]=""
|
|
categories["CONNECTIONS"]=""
|
|
categories["PERFORMANCE"]=""
|
|
categories["TOOLS"]=""
|
|
categories["OTHER"]=""
|
|
|
|
for finding in "${FINDINGS[@]}"; do
|
|
# Split by @@@SEP@@@ delimiter
|
|
local severity_title="${finding%%@@@SEP@@@*}"
|
|
local temp="${finding#*@@@SEP@@@}"
|
|
local details="${temp%%@@@SEP@@@*}"
|
|
local recommendation="${temp#*@@@SEP@@@}"
|
|
|
|
# Extract severity from [SEVERITY] Title format
|
|
local severity=$(echo "$severity_title" | sed -n 's/^\[\([^]]*\)\].*/\1/p')
|
|
local title=$(echo "$severity_title" | sed 's/^\[[^]]*\] //')
|
|
|
|
local category="OTHER"
|
|
if [[ "$title" == *"Bandwidth"* ]] || [[ "$title" == *"Monthly"* ]] || [[ "$title" == *"Daily"* ]] || [[ "$title" == *"Hourly"* ]]; then
|
|
category="BANDWIDTH"
|
|
elif [[ "$title" == *"Domain"* ]] || [[ "$title" == *"URL"* ]] || [[ "$title" == *"Web"* ]] || [[ "$title" == *"IP"* ]]; then
|
|
category="WEB_TRAFFIC"
|
|
elif [[ "$title" == *"Connection"* ]]; then
|
|
category="CONNECTIONS"
|
|
elif [[ "$title" == *"Network"* ]] || [[ "$title" == *"TCP"* ]] || [[ "$title" == *"MTU"* ]] || [[ "$title" == *"Packet"* ]]; then
|
|
category="PERFORMANCE"
|
|
elif [[ "$title" == *"Tool"* ]] || [[ "$title" == *"Monitoring"* ]]; then
|
|
category="TOOLS"
|
|
fi
|
|
|
|
local entry=""
|
|
entry+="[$severity] $title"$'\n'
|
|
entry+="$details"$'\n'
|
|
if [ -n "$recommendation" ]; then
|
|
entry+="Recommendation:"$'\n'
|
|
entry+="$recommendation"$'\n'
|
|
fi
|
|
entry+=""$'\n'
|
|
entry+="------------------------------------------------------------------------------"$'\n'
|
|
entry+=""$'\n'
|
|
|
|
categories[$category]+="$entry"
|
|
done
|
|
|
|
# Output sections
|
|
if [ -n "${categories[BANDWIDTH]}" ]; then
|
|
report_content+="=============================================================================="$'\n'
|
|
report_content+="BANDWIDTH USAGE"$'\n'
|
|
report_content+="=============================================================================="$'\n'
|
|
report_content+=""$'\n'
|
|
report_content+="${categories[BANDWIDTH]}"
|
|
fi
|
|
|
|
if [ -n "${categories[WEB_TRAFFIC]}" ]; then
|
|
report_content+="=============================================================================="$'\n'
|
|
report_content+="WEB TRAFFIC ANALYSIS"$'\n'
|
|
report_content+="=============================================================================="$'\n'
|
|
report_content+=""$'\n'
|
|
report_content+="${categories[WEB_TRAFFIC]}"
|
|
fi
|
|
|
|
if [ -n "${categories[CONNECTIONS]}" ]; then
|
|
report_content+="=============================================================================="$'\n'
|
|
report_content+="NETWORK CONNECTIONS"$'\n'
|
|
report_content+="=============================================================================="$'\n'
|
|
report_content+=""$'\n'
|
|
report_content+="${categories[CONNECTIONS]}"
|
|
fi
|
|
|
|
if [ -n "${categories[PERFORMANCE]}" ]; then
|
|
report_content+="=============================================================================="$'\n'
|
|
report_content+="NETWORK PERFORMANCE"$'\n'
|
|
report_content+="=============================================================================="$'\n'
|
|
report_content+=""$'\n'
|
|
report_content+="${categories[PERFORMANCE]}"
|
|
fi
|
|
|
|
if [ -n "${categories[TOOLS]}" ]; then
|
|
report_content+="=============================================================================="$'\n'
|
|
report_content+="MONITORING TOOLS"$'\n'
|
|
report_content+="=============================================================================="$'\n'
|
|
report_content+=""$'\n'
|
|
report_content+="${categories[TOOLS]}"
|
|
fi
|
|
|
|
if [ -n "${categories[OTHER]}" ]; then
|
|
report_content+="=============================================================================="$'\n'
|
|
report_content+="OTHER FINDINGS"$'\n'
|
|
report_content+="=============================================================================="$'\n'
|
|
report_content+=""$'\n'
|
|
report_content+="${categories[OTHER]}"
|
|
fi
|
|
|
|
report_content+="=============================================================================="$'\n'
|
|
report_content+="NEXT STEPS"$'\n'
|
|
report_content+="=============================================================================="$'\n'
|
|
report_content+=""$'\n'
|
|
report_content+="Priority Actions:"$'\n'
|
|
report_content+=" 1. Review bandwidth usage trends for unusual patterns"$'\n'
|
|
report_content+=" 2. Investigate high-volume IP addresses and domains"$'\n'
|
|
report_content+=" 3. Address any network performance issues"$'\n'
|
|
report_content+=" 4. Consider installing monitoring tools for real-time tracking"$'\n'
|
|
report_content+=""$'\n'
|
|
report_content+="Additional Analysis Available:"$'\n'
|
|
report_content+=" • Bot Analyzer (Main Menu → Security) for bot/attack traffic analysis"$'\n'
|
|
report_content+=" • System Health Check (Main Menu) for overall server health"$'\n'
|
|
report_content+=""$'\n'
|
|
report_content+="Report saved to: $REPORT_FILE"$'\n'
|
|
report_content+=""$'\n'
|
|
|
|
echo "$report_content"
|
|
echo "$report_content" > "$REPORT_FILE"
|
|
}
|
|
|
|
# Main execution
|
|
main() {
|
|
show_banner
|
|
echo -e "${BLUE}${BOLD}🌐 Network & Bandwidth Analyzer${NC}"
|
|
echo ""
|
|
echo ""
|
|
|
|
echo -e "${CYAN}[INFO]${NC} Starting network and bandwidth analysis..."
|
|
echo ""
|
|
|
|
# Run analyses
|
|
analyze_bandwidth_vnstat
|
|
analyze_web_traffic
|
|
analyze_network_connections
|
|
analyze_network_performance
|
|
recommend_monitoring_tools
|
|
|
|
echo ""
|
|
echo -e "${GREEN}[OK]${NC} Analysis complete!"
|
|
echo ""
|
|
|
|
# Generate and display report
|
|
generate_report
|
|
|
|
echo ""
|
|
echo -e "${GREEN}[INFO]${NC} Full report saved to: ${CYAN}$REPORT_FILE${NC}"
|
|
echo ""
|
|
echo ""
|
|
|
|
press_enter
|
|
}
|
|
|
|
# Run main function
|
|
main
|