NWS: Network Statistics

Now hosted at SourceForge.net: smbnws.sourceforge.net.

What it is

NWS consists of a Perl module, Networkstats.pm and a set of example scripts. It is intended for the collection of network statistics on a VPN where the subnets consist of Windows clients and SAMBA fileservers. Files and their meaning:

/var/log/networkstats, the log file, mostly a list of what commands have been executed and when
/var/lib/nws/networks.txt, list of networks (server;description;email) where empty lines and comments are ignored, e.g.
```
# network file

172.16.8.1;my network;admin@mydomain
172.16.12.1;my other network;admin@mydomain
```
/var/lib/nws/networks.dat, the data that have been collected (output format is Data::Dumper)
Networkstats.pm, the Perl module containing an object that provides the network scan facility and read access to the data that have been obtained, copy to e.g. /usr/lib/perl/5.8
example scripts:
- nws-scan.pl, the main script that scans the network, should go into crontab
- nws-machines.pl, list all machine/IP/user combinations in the database
- nws-smbcurrent.pl, list samba users currently connected (command line parameter: time interval before now in hours)
- nws-smblastseen.pl, list all samba users on which data have been collected
- nws-usergroups.pl, list users and the groups they belong to, in addition to net and IP
- nws-usershosts.pl, list user/IP combinations, sorted by IP
- nws-usersnet.pl, list user/SAMBA server combinations, also sorted by IP

The script nws-scan.pl invokes the method "scan" of the Networkstats.pm object to scan all networks, using arp to obtain mac addresses and IP addresses. Next it runs smbstatus -b to discover SAMBA users and where they are logged on. It consults /etc/group to collect group information for all users. Finally, nmap -O is used to obtain information about the OS of the machines found. The result goes into a hash, whose keys are machine/IP/user combinations. The data are recorded in the following data structure:

'FF:FF:FF:FF:FF:FF$;172.16.8.16$;someuser' => {
     'nmap' => 1173681362,
     'first' => 1173111465,
     'last' => 1173716506,
     'network' => '172.16.8.1',
     'groups' => [ users, samba, print ],
     'type' => 'Microsoft Windows 95/98/ME|NT/2K/XP',
     'host' => 'host2007'
}

The respective entries for first and last show the times when the combination was last/first seen. The user may produce any kind of report from these data, as shown in the example scripts.

Downloads

The Perl module and the example scripts may be downloaded here: nws.tgz or nws.zip.

Home page, email, software

My homepage is here.