procinfo.py 文件源码

def get_procinfo_by_address(ip_src, ip_dst, port_src=None, port_dst=None):
    """
    Gets Infos about the Prozess associated with the given address information
    Both port_src and port_dst must be not None or None at the same time.

    return -- [pid, "/path/to/command", "user", "hash"] or []
    """
    result = []

    if port_src is not None:
        pids = [c.pid for c in net_connections()
            if len(c.raddr) != 0 and c.pid is not None and
                (c.laddr[0], c.raddr[0], c.laddr[1], c.raddr[1]) == (ip_src, ip_dst, port_src, port_dst)]
    else:
        pids = [c.pid for c in net_connections()
            if len(c.raddr) != 0 and c.pid is not None and (c.laddr[0], c.raddr[0]) == (ip_src, ip_dst)]

    try:
        if len(pids) > 1:
            logger.warning("more than 1 matching process: %r", pids)
        proc = Process(pids[0])
        cmd = [pids[0], proc.cmdline(), proc.username()]
        hash_input = "%d%s%s" % (cmd[0], cmd[1], cmd[2])
        procinfo_hash = hashlib.sha256(hash_input.encode("UTF-8"))
        cmd.append(procinfo_hash)
        logger.debug("process info: %r", cmd)
        return cmd
    except IndexError:
        pass
    return []