Closed lkx007 closed 4 years ago
Hi,
This
from ttp import ttp
from pprint import pprint
data = """
# show service
Name Protocol Dst-Port/Type
DISCARD UDP 9
DNS UDP 53
TCP 53
ECHO UDP 7
"""
template1 = """
<group method="table" record="name" set="name">
{{ ignore("\s+") }}{{ name }} {{ protocols }} {{ ports | DIGIT }}
{{ ignore("\s+") }} {{ protocols }} {{ ports | DIGIT }}
</group>
"""
parser = ttp(data, template1)
parser.parse()
pprint(parser.result(structure="flat_list"))
# prints:
# [{'name': 'DISCARD', 'ports': '9', 'protocols': 'UDP'},
# {'name': 'DNS', 'ports': '53', 'protocols': 'UDP'},
# {'name': 'DNS', 'ports': '53', 'protocols': 'TCP'},
# {'name': 'ECHO', 'ports': '7', 'protocols': 'UDP'}]
How it works:
method="table"
tells that each template line is a start line and matches for it should be saved to resultsrecord="name"
function tells to store value of name
match in cacheset="name"
function tells to retrieve value of name
variable from cache and add it to matches that does not have it{{ ignore("\s+") }}
- helps to ignore indentationOr use this if you decide to go with a bit more hierarchy:
template2 = """
<template name="services" results="per_template">
<group name="{{ name }}.{{ proto }}" method="table">
{{ ignore("\s+") }}{{ name }} {{ proto }} {{ port | DIGIT }}
{{ ignore("\s+") }} {{ proto }} {{ port | DIGIT }}
</group>
</template>
"""
parser = ttp(data, template2)
parser.parse()
pprint(parser.result(structure="dictionary"))
# prints:
# {'services': {'DISCARD': {'UDP': {'port': '9'}},
# 'DNS': {'TCP': {'port': '53'}, 'UDP': {'port': '53'}},
# 'ECHO': {'UDP': {'port': '7'}}}}
for last example to work need to use latest code from master branch though
it works well, excellent! but when I use the following code, some column is missing, could u please help me?
from ttp import ttp
from pprint import pprint
data= '''
SG-6000# show service
Name Protocol Dst-Port/Type Src-Port/Code Timeout
Total configured: 99
Any Any - - -
AFS TCP 7002-7009 - -
UDP 7002-7009 - -
AIM TCP 5190-5194 - -
BFD UDP 3784-3785 - -
BGP TCP 179 - -
CHARGEN UDP 19 - -
DayTime TCP 13 - -
UDP 13 - -
DHCP-Relay UDP 67-68 - -
DISCARD UDP 9 - -
DNS UDP 53 - -
TCP 53 - -
ECHO UDP 7 - -
FINGER TCP 79 - -
FTP TCP 21 - -
GIT TCP 9418 - -
UDP 9418 - -
Gnutella UDP 6346-6347 - -
GOPHER TCP 70 - -
GRE GRE - - -
GTPCv1 UDP 2123 - -
GTPUv1 UDP 2152 - -
GTPv0 UDP 3386 - -
HTTP TCP 80 - -
TCP 8080 - -
HTTP-EXT TCP 7001 - -
HTTPS TCP 443 - -
ICMP ICMP type:Any code:Any -
IDENT TCP 113 - -
IKE UDP 500 - -
UDP 4500 - -
IKE-NAT UDP 500 500 -
IMAP4 TCP 143 - -
Internet-Locator-Servi~ TCP 1002 - -
IP-IP IP - - -
IPSEC ESP - - -
AH - - -
IPv6-IP IPv6 - - -
IRC TCP 6660-6669 - -
Kerberos UDP 88 - -
L2TP UDP 1701 - -
LDAP TCP 389 - -
UDP 389 - -
LLMNR TCP 5355 - -
UDP 5355 - -
LPR TCP 515 - -
McIDAS TCP 112 - -
UDP 112 - -
MDNS TCP 5353 - -
MGCP-CA UDP 2727 - -
MGCP-UA UDP 2427 - -
MS-SQL TCP 1433 - -
MS-SQL-MON UDP 1434 - -
MSRPC TCP 135 - -
UDP 135 - -
MySQL TCP 3306 - -
NBDS UDP 138 - -
NBNAME UDP 137 - -
NFS TCP 2049 - -
UDP 2049 - -
NNTP TCP 119 - -
NTP UDP 123 - -
OpenVPN TCP 1194 - -
UDP 1194 - -
OSPF OSPFIGP - - -
PING ICMP type:8 code:0 -
POP3 TCP 110 - -
PPTP TCP 1723 - -
Q.931 TCP 1720 - -
RADIUS UDP 1812-1813 - -
RAS UDP 1719 - -
Razor TCP 1666 - -
RDP TCP 3389 - -
RealMedia TCP 7070 - -
REXEC TCP 512 - -
RIP UDP 520 - -
RLOGIN TCP 513 - -
RMI TCP 1099 - -
RSH TCP 514 - -
Rsync TCP 873 - -
UDP 873 - -
RTIP TCP 771 - -
UDP 771 - -
RTSP TCP 554 - -
SCVPN TCP 4433 - -
UDP 4433 - -
SIP UDP 5060 - -
TCP 5060 - -
SMB TCP 139 - -
TCP 445 - -
SMS TCP 2701-2704 - -
UDP 2701-2704 - -
SMTP TCP 25 - -
SMTPS TCP 465 - -
UDP 465 - -
SNMP UDP 161-162 - -
SQLNETv1 TCP 1525 - -
SQLNETv2 TCP 1521 - -
SSH TCP 22 - -
SUNRPC TCP 111 - -
UDP 111 - -
SYSLOG UDP 514 - -
TALK UDP 517-518 - -
TCP-ANY TCP Any - -
TELNET TCP 23 - -
TFTP UDP 69 - -
Time TCP 37 - -
UDP 37 - -
TimeServer TCP 525 - -
UDP 525 - -
UDP-ANY UDP Any - -
UUCP UDP 540 - -
VDO-Live TCP 7000-7010 - -
VMware TCP 902 - -
UDP 902 - -
VNC TCP 5800-5809 - -
TCP 5900-5909 - -
WAIS TCP 210 - -
WHOIS TCP 4321 - -
UDP 4321 - -
TCP 43 - -
WINFRAME TCP 1494 - -
WINS TCP 42 - -
UDP 42 - -
X-WINDOW TCP 6000-6003 - -
XDMCP TCP 177 - -
UDP 177 - -
SG-6000#
'''
template1 = """
<group method="table" record="name" set="name">
{{ ignore("\s+") }}{{ name }} {{ Protocol }} {{ DstPort }} {{ SrcPort }} {{ Timeout }}
{{ ignore("\s+") }} {{ Protocol }} {{ DstPort }} {{ SrcPort }} {{ Timeout }}
</group>
"""
parser = ttp(data, template1)
parser.parse()
pprint(parser.result(structure="flat_list"))
Indentation is important in TTP as it honours it, try this template:
template1 = """
<group method="table" record="name" set="name">
{{ name | exclude("Name") }} {{ Protocol }} {{ DstPort }} {{ SrcPort }} {{ Timeout }}
{{ ignore(r"\s+") }} {{ Protocol }} {{ DstPort }} {{ SrcPort }} {{ Timeout }}
</group>
"""
{{ ignore(r"\s+") }}
is useful when need to ignore indentation, in other cases indentation is part of regex TTP uses to produce its results
perfect, thanks a lot.
how can I get json as: [ {"Name": "DISCARD","Protocol":"UDP","Port":9}, {"Name": "DNS","Protocol":"UDP","Port":53}, {"Name": "DNS","Protocol":"TCP","Port":53}, {"Name": "ECHO","Protocol":"UDP","Port":7} ] without missing DNS TCP 53 ??