diff --git a/.gitignore b/.gitignore
index e8b82ccc1..a43f99d63 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1,24 +1,8 @@
-/fibratus/__pycache__
-/.cache
-.coverage
-coverage.xml
-/.idea
-/build
-/kstream/build
-/kstream/*.pyd
-/kstream/*.c
-/kstream/*.cpp
-/tests/.cache
-/tests/__pycache__
-/tests/*/__pycache__
-/tests/*/.cache
-/tests/htmlcov
-/tests/.coverage
-/tests/unit/.coverage
-/tests/*/htmlcov
-/tests/coverage.xml
-/tests/*/coverage.xml
-/kstreamc.pyd
-/htmlcov
-dist
-fibratus.egg-info
\ No newline at end of file
+cmd/fibratus/fibratus.exe
+cmd/fibratus/fibratus.syso
+
+build/package/release
+build/package/*.exe
+
+.idea
+filaments/__pycache__
diff --git a/.landscape.yml b/.landscape.yml
deleted file mode 100644
index e9816b1b0..000000000
--- a/.landscape.yml
+++ /dev/null
@@ -1,4 +0,0 @@
-ignore-paths:
- - filaments
-python-targets:
- - 3
\ No newline at end of file
diff --git a/MANIFEST.in b/MANIFEST.in
deleted file mode 100644
index 9a961e1f1..000000000
--- a/MANIFEST.in
+++ /dev/null
@@ -1,8 +0,0 @@
-recursive-include filaments *
-recursive-include kstream *.pxd
-
-include fibratus.yml
-include requirements.txt
-include LICENSE.MD
-
-recursive-exclude * __pycache__
\ No newline at end of file
diff --git a/appveyor.yml b/appveyor.yml
deleted file mode 100644
index 4305133b7..000000000
--- a/appveyor.yml
+++ /dev/null
@@ -1,28 +0,0 @@
-environment:
-
- MSVS_VERSION: 2015
-
- matrix:
- - PYTHON: "C:\\Python34-x64"
- DISTUTILS_USE_SDK: "1"
-
-platform:
- - x64
-
-install:
- - call "C:\Program Files (x86)\Microsoft Visual Studio 14.0\VC\vcvarsall.bat" x64
- - "SET PATH=%PYTHON%;%PYTHON%\\Scripts;%PATH%"
- - "pip install -r requirements.txt"
-
-build_script:
- - call "C:\Program Files (x86)\Microsoft Visual Studio 14.0\VC\vcvarsall.bat" x64
- - "python setup.py build_ext install"
-
-test_script:
- - py.test tests/"
-
-artifacts:
- - path: dist\*
-
-on_success:
- - "codecov"
diff --git a/build/package/LICENSE.txt b/build/package/LICENSE.txt
new file mode 100644
index 000000000..d9eb5356b
--- /dev/null
+++ b/build/package/LICENSE.txt
@@ -0,0 +1,11 @@
+Copyright 2019-2020 by Nedim Sabic Sabic
+
+All Rights Reserved.
+
+Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR
+CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License.
diff --git a/build/package/fibratus.nsi b/build/package/fibratus.nsi
new file mode 100644
index 000000000..6d95f15cb
--- /dev/null
+++ b/build/package/fibratus.nsi
@@ -0,0 +1,163 @@
+!define APPNAME "Fibratus"
+!define COMPANYNAME "Fibratus"
+!define DESCRIPTION "Fibratus is a modern tool for exploration and tracing of the Windows kernel"
+
+
+# These will be displayed by the "Click here for support information" link in "Add/Remove Programs"
+!define HELPURL "https://www.fibratus.io" # "Support Information" link
+!define UPDATEURL "https://www.fibratus.io" # "Product Updates" link
+!define ABOUTURL "https://www.fibratus.io" # "Publisher" link
+
+RequestExecutionLevel admin ;Require admin rights on NT6+ (When UAC is turned on)
+
+InstallDir "$PROGRAMFILES64\${COMPANYNAME}"
+!define UNINSTALLDIR "Software\Microsoft\Windows\CurrentVersion\Uninstall\${COMPANYNAME}"
+BrandingText " "
+
+# This will be in the installer/uninstaller's title bar
+Name "${APPNAME}"
+OutFile "fibratus-${VERSION}-amd64.exe"
+
+!include "LogicLib.nsh"
+!include "MUI2.nsh" ; Modern UI
+
+!define MUI_FINISHPAGE_NOAUTOCLOSE
+!define MUI_UNFINISHPAGE_NOAUTOCLOSE
+
+!insertmacro MUI_PAGE_WELCOME
+!insertmacro MUI_PAGE_LICENSE "LICENSE.txt"
+!insertmacro MUI_PAGE_INSTFILES
+!insertmacro MUI_PAGE_FINISH
+
+!insertmacro MUI_UNPAGE_WELCOME
+!insertmacro MUI_UNPAGE_CONFIRM
+!insertmacro MUI_UNPAGE_INSTFILES
+!insertmacro MUI_UNPAGE_FINISH
+
+; Set languages (first is default language)
+;!insertmacro MUI_LANGUAGE "English"
+!define MUI_LANGDLL_ALLLANGUAGES
+;Languages
+
+ !insertmacro MUI_LANGUAGE "English"
+ !insertmacro MUI_LANGUAGE "French"
+ !insertmacro MUI_LANGUAGE "TradChinese"
+ !insertmacro MUI_LANGUAGE "Spanish"
+ !insertmacro MUI_LANGUAGE "Hungarian"
+ !insertmacro MUI_LANGUAGE "Russian"
+ !insertmacro MUI_LANGUAGE "German"
+ !insertmacro MUI_LANGUAGE "Dutch"
+ !insertmacro MUI_LANGUAGE "SimpChinese"
+ !insertmacro MUI_LANGUAGE "Italian"
+ !insertmacro MUI_LANGUAGE "Danish"
+ !insertmacro MUI_LANGUAGE "Polish"
+ !insertmacro MUI_LANGUAGE "Czech"
+ !insertmacro MUI_LANGUAGE "Slovenian"
+ !insertmacro MUI_LANGUAGE "Slovak"
+ !insertmacro MUI_LANGUAGE "Swedish"
+ !insertmacro MUI_LANGUAGE "Norwegian"
+ !insertmacro MUI_LANGUAGE "PortugueseBR"
+ !insertmacro MUI_LANGUAGE "Ukrainian"
+ !insertmacro MUI_LANGUAGE "Turkish"
+ !insertmacro MUI_LANGUAGE "Catalan"
+ !insertmacro MUI_LANGUAGE "Arabic"
+ !insertmacro MUI_LANGUAGE "Lithuanian"
+ !insertmacro MUI_LANGUAGE "Finnish"
+ !insertmacro MUI_LANGUAGE "Greek"
+ !insertmacro MUI_LANGUAGE "Korean"
+ !insertmacro MUI_LANGUAGE "Hebrew"
+ !insertmacro MUI_LANGUAGE "Portuguese"
+ !insertmacro MUI_LANGUAGE "Farsi"
+ !insertmacro MUI_LANGUAGE "Bulgarian"
+ !insertmacro MUI_LANGUAGE "Indonesian"
+ !insertmacro MUI_LANGUAGE "Japanese"
+ !insertmacro MUI_LANGUAGE "Croatian"
+ !insertmacro MUI_LANGUAGE "Serbian"
+ !insertmacro MUI_LANGUAGE "Thai"
+ !insertmacro MUI_LANGUAGE "NorwegianNynorsk"
+ !insertmacro MUI_LANGUAGE "Belarusian"
+ !insertmacro MUI_LANGUAGE "Albanian"
+ !insertmacro MUI_LANGUAGE "Malay"
+ !insertmacro MUI_LANGUAGE "Galician"
+ !insertmacro MUI_LANGUAGE "Basque"
+ !insertmacro MUI_LANGUAGE "Luxembourgish"
+ !insertmacro MUI_LANGUAGE "Afrikaans"
+ !insertmacro MUI_LANGUAGE "Uzbek"
+ !insertmacro MUI_LANGUAGE "Macedonian"
+ !insertmacro MUI_LANGUAGE "Latvian"
+ !insertmacro MUI_LANGUAGE "Bosnian"
+ !insertmacro MUI_LANGUAGE "Mongolian"
+ !insertmacro MUI_LANGUAGE "Estonian"
+
+!insertmacro MUI_RESERVEFILE_LANGDLL
+
+Function .onInit
+
+ !insertmacro MUI_LANGDLL_DISPLAY
+
+FunctionEnd
+
+Section "Install"
+ # Files for the install directory
+ SetOutPath $INSTDIR
+
+ # Create directories
+ CreateDirectory $INSTDIR\Logs
+
+ # Files added here should be removed by the uninstaller
+ File /r "release\Bin"
+ File /r "release\Config"
+ File /r /x .idea /x __pycache__ "release\Filaments"
+ File /r "release\Python"
+
+ # Uninstaller - See function un.onInit and section "uninstall" for configuration
+ WriteUninstaller "$INSTDIR\uninstall.exe"
+
+ # Registry information for add/remove programs
+ WriteRegStr HKLM "${UNINSTALLDIR}" "DisplayName" "${APPNAME} - ${DESCRIPTION}"
+ WriteRegStr HKLM "${UNINSTALLDIR}" "UninstallString" "$\"$INSTDIR\uninstall.exe$\""
+ WriteRegStr HKLM "${UNINSTALLDIR}" "QuietUninstallString" "$\"$INSTDIR\uninstall.exe$\" /S"
+ WriteRegStr HKLM "${UNINSTALLDIR}" "InstallLocation" "$\"$INSTDIR$\""
+ WriteRegStr HKLM "${UNINSTALLDIR}" "Publisher" "${COMPANYNAME}"
+ WriteRegStr HKLM "${UNINSTALLDIR}" "HelpLink" "$\"${HELPURL}$\""
+ WriteRegStr HKLM "${UNINSTALLDIR}" "URLUpdateInfo" "$\"${UPDATEURL}$\""
+ WriteRegStr HKLM "${UNINSTALLDIR}" "URLInfoAbout" "$\"${ABOUTURL}$\""
+ WriteRegStr HKLM "${UNINSTALLDIR}" "DisplayVersion" "${VERSION}"
+
+ # There is no option for modifying or repairing the install
+ WriteRegDWORD HKLM "${UNINSTALLDIR}" "NoModify" 1
+ WriteRegDWORD HKLM "${UNINSTALLDIR}" "NoRepair" 1
+
+ # Set the INSTALLSIZE constant (!defined at the top of this script) so Add/Remove Programs can accurately report the size
+ WriteRegDWORD HKLM "${UNINSTALLDIR}" "EstimatedSize" ${INSTALLSIZE}
+
+ # Add executable to PATH
+ EnVar::SetHKCU
+ EnVar::AddValue "Path" "$INSTDIR\Bin\"
+
+
+SectionEnd
+
+Section "Uninstall"
+
+ # Remove uninstalled executable from PATH
+ EnVar::SetHKCU
+ EnVar::DeleteValue "Path" "$INSTDIR\Bin\"
+
+ # Remove files/directories
+ RMDir /r /REBOOTOK $INSTDIR\Bin
+ RMDir /r /REBOOTOK $INSTDIR\Logs
+ RMDir /r /REBOOTOK $INSTDIR\Config
+ RMDir /r /REBOOTOK $INSTDIR\Filaments
+ RMDir /r /REBOOTOK $INSTDIR\Python
+
+ # Always delete uninstaller as the last action
+ Delete /REBOOTOK $INSTDIR\uninstall.exe
+
+ # Try to remove the install directory - this will only happen if it is empty
+ RmDir /REBOOTOK $INSTDIR
+
+ # Remove uninstaller information from the registry
+ DeleteRegKey HKLM "${UNINSTALLDIR}"
+
+SectionEnd
diff --git a/cmd/fibratus/app/capture.go b/cmd/fibratus/app/capture.go
new file mode 100644
index 000000000..15ab22cf9
--- /dev/null
+++ b/cmd/fibratus/app/capture.go
@@ -0,0 +1,143 @@
+/*
+ * Copyright 2019-2020 by Nedim Sabic Sabic
+ * https://www.fibratus.io
+ * All Rights Reserved.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package app
+
+import (
+ "github.com/rabbitstack/fibratus/pkg/api"
+ "github.com/rabbitstack/fibratus/pkg/config"
+ "github.com/rabbitstack/fibratus/pkg/filter"
+ "github.com/rabbitstack/fibratus/pkg/handle"
+ "github.com/rabbitstack/fibratus/pkg/kcap"
+ "github.com/rabbitstack/fibratus/pkg/kstream"
+ "github.com/rabbitstack/fibratus/pkg/ps"
+ "github.com/rabbitstack/fibratus/pkg/syscall/security"
+ logger "github.com/rabbitstack/fibratus/pkg/util/log"
+ "github.com/rabbitstack/fibratus/pkg/util/spinner"
+ log "github.com/sirupsen/logrus"
+ "github.com/spf13/cobra"
+ "os"
+ "os/signal"
+ "time"
+)
+
+var captureCmd = &cobra.Command{
+ Use: "capture [filter]",
+ Short: "Capture kernel event stream to the kcap file",
+ RunE: capture,
+}
+
+var captureConfig = config.NewWithOpts(config.WithCapture())
+
+func init() {
+ captureConfig.MustViperize(captureCmd)
+}
+
+func capture(cmd *cobra.Command, args []string) error {
+ if err := captureConfig.TryLoadFile(captureConfig.File()); err != nil {
+ return err
+ }
+ if err := captureConfig.Init(); err != nil {
+ return err
+ }
+ if err := captureConfig.Validate(); err != nil {
+ return err
+ }
+ if captureConfig.DebugPrivilege {
+ security.SetDebugPrivilege()
+ }
+ if err := logger.InitFromConfig(captureConfig.Log); err != nil {
+ return err
+ }
+
+ spin := spinner.Show("Snapshotting processes and handles")
+ // make sure to not wait more than a minute if system handle enumeration
+ // got stuck or taking too much time to complete.
+ wait := make(chan struct{}, 1)
+ deadline := time.AfterFunc(time.Minute, func() {
+ wait <- struct{}{}
+ })
+ cb := func(total uint64, withName uint64) {
+ deadline.Stop()
+ spin.Stop()
+ wait <- struct{}{}
+ }
+
+ // the capture will start after all system handles have been enumerated. This gives us a
+ // chance to build the handle state before writing the event flow
+ hsnap := handle.NewSnapshotter(captureConfig, cb)
+ psnap := ps.NewSnapshotter(hsnap, captureConfig)
+
+ // we'll start writing to the kcap file once we receive on the wait channel
+ <-wait
+
+ // initiate the kernel trace and start consuming from the event stream
+ ktracec := kstream.NewKtraceController(captureConfig.Kstream)
+ err := ktracec.StartKtrace()
+ if err != nil {
+ return err
+ }
+ defer ktracec.CloseKtrace()
+
+ kstreamc := kstream.NewConsumer(ktracec, psnap, hsnap, captureConfig)
+ kfilter, err := filter.NewFromCLI(args)
+ if err != nil {
+ return err
+ }
+ if kfilter != nil {
+ kstreamc.SetFilter(kfilter)
+ }
+ err = kstreamc.OpenKstream()
+ if err != nil {
+ return err
+ }
+ defer kstreamc.CloseKstream()
+
+ // bootstrap kcap writer with inbound event channel
+ writer, err := kcap.NewWriter(captureConfig.KcapFile, psnap, hsnap)
+ if err != nil {
+ return err
+ }
+ errsc := writer.Write(kstreamc.Events(), kstreamc.Errors())
+ go func() {
+ for err := range errsc {
+ log.Warnf("fail to write event to kcap: %v", err)
+ }
+ }()
+
+ // start rendering the spinner
+ spin = spinner.Show("Capturing")
+
+ // start the HTTP server
+ if err := api.StartServer(captureConfig); err != nil {
+ return err
+ }
+
+ signal.Notify(sig, os.Kill, os.Interrupt)
+ <-sig
+ spin.Stop()
+
+ if err := writer.Close(); err != nil {
+ return err
+ }
+ if err := api.CloseServer(); err != nil {
+ return err
+ }
+
+ return nil
+}
diff --git a/cmd/fibratus/app/config.go b/cmd/fibratus/app/config.go
new file mode 100644
index 000000000..1217ada8f
--- /dev/null
+++ b/cmd/fibratus/app/config.go
@@ -0,0 +1,60 @@
+/*
+ * Copyright 2019-2020 by Nedim Sabic Sabic
+ * https://www.fibratus.io
+ * All Rights Reserved.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package app
+
+import (
+ "fmt"
+ "github.com/rabbitstack/fibratus/pkg/config"
+ "github.com/rabbitstack/fibratus/pkg/util/rest"
+ "github.com/spf13/cobra"
+ "os"
+)
+
+var configCmd = &cobra.Command{
+ Use: "config",
+ Short: "Show runtime config",
+ RunE: printConfig,
+}
+
+var c = config.NewWithOpts(config.WithStats())
+
+func init() {
+ c.MustViperize(configCmd)
+}
+
+func printConfig(cmd *cobra.Command, args []string) error {
+ if err := c.TryLoadFile(c.File()); err != nil {
+ return err
+ }
+ if err := c.Init(); err != nil {
+ return err
+ }
+ if err := c.Validate(); err != nil {
+ return err
+ }
+ body, err := rest.Get(rest.WithTransport(c.API.Transport), rest.WithURI("config"))
+ if err != nil {
+ return err
+ }
+ _, err = fmt.Fprintln(os.Stdout, string(body))
+ if err != nil {
+ return err
+ }
+ return nil
+}
diff --git a/cmd/fibratus/app/control_service.go b/cmd/fibratus/app/control_service.go
new file mode 100644
index 000000000..c66904628
--- /dev/null
+++ b/cmd/fibratus/app/control_service.go
@@ -0,0 +1,265 @@
+/*
+ * Copyright 2019-2020 by Nedim Sabic Sabic
+ * https://www.fibratus.io
+ * All Rights Reserved.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package app
+
+import (
+ "fmt"
+ "github.com/rabbitstack/fibratus/pkg/aggregator"
+ "github.com/rabbitstack/fibratus/pkg/api"
+ "github.com/rabbitstack/fibratus/pkg/config"
+ "github.com/rabbitstack/fibratus/pkg/handle"
+ "github.com/rabbitstack/fibratus/pkg/kstream"
+ "github.com/rabbitstack/fibratus/pkg/outputs"
+ "github.com/rabbitstack/fibratus/pkg/ps"
+ "github.com/rabbitstack/fibratus/pkg/syscall/security"
+ logger "github.com/rabbitstack/fibratus/pkg/util/log"
+ "github.com/spf13/cobra"
+ "golang.org/x/sys/windows"
+ "golang.org/x/sys/windows/svc"
+ "golang.org/x/sys/windows/svc/debug"
+ "golang.org/x/sys/windows/svc/eventlog"
+ "golang.org/x/sys/windows/svc/mgr"
+ "time"
+)
+
+var startSvcCmd = &cobra.Command{
+ Use: "start-service",
+ RunE: startService,
+ Short: "Start fibratus service",
+}
+
+var stopSvcCmd = &cobra.Command{
+ Use: "stop-service",
+ RunE: stopService,
+ Short: "Stop fibratus service",
+}
+
+var restartSvcCmd = &cobra.Command{
+ Use: "restart-service",
+ RunE: restartService,
+ Short: "Restart fibratus service",
+}
+
+var svcConfig = config.NewWithOpts(config.WithRun())
+
+func init() {
+ svcConfig.MustViperize(startSvcCmd)
+}
+
+func startService(cmd *cobra.Command, args []string) error {
+ h, err := windows.OpenSCManager(nil, nil, windows.SC_MANAGER_CONNECT)
+ if err != nil {
+ return fmt.Errorf("couldn't connect to Windows Service Manager: %v", err)
+ }
+ m := &mgr.Mgr{Handle: h}
+ defer m.Disconnect()
+ s, err := windows.OpenService(
+ m.Handle,
+ windows.StringToUTF16Ptr(svcName),
+ windows.SERVICE_START|windows.SERVICE_STOP,
+ )
+ if err != nil {
+ return fmt.Errorf("could not open fibratus service: %v", err)
+ }
+ scm := &mgr.Service{Name: svcName, Handle: s}
+ defer scm.Close()
+ err = scm.Start()
+ if err != nil {
+ return fmt.Errorf("could not start fibratus service: %v", err)
+ }
+
+ start := time.Now()
+ var status svc.Status
+ for time.Since(start) > 5*time.Second {
+ status, err = scm.Query()
+ if err != nil {
+ return fmt.Errorf("failed to get fibratus service status: %v", err)
+ }
+
+ if status.State == svc.Running {
+ return nil
+ }
+ }
+ return nil
+}
+
+func stopService(cmd *cobra.Command, args []string) error {
+ return stopSvc()
+}
+
+func restartService(cmd *cobra.Command, args []string) error {
+ if err := stopSvc(); err != nil {
+ return err
+ }
+ return startService(cmd, args)
+}
+
+func stopSvc() error {
+ h, err := windows.OpenSCManager(nil, nil, windows.SC_MANAGER_CONNECT)
+ if err != nil {
+ return fmt.Errorf("couldn't connect to Windows Service Manager: %v", err)
+ }
+ m := &mgr.Mgr{Handle: h}
+ defer m.Disconnect()
+
+ s, err := windows.OpenService(
+ m.Handle,
+ windows.StringToUTF16Ptr(svcName),
+ windows.SERVICE_START|windows.SERVICE_STOP|windows.SERVICE_QUERY_STATUS,
+ )
+ if err != nil {
+ return fmt.Errorf("could not open fibratus service: %v", err)
+ }
+ scm := &mgr.Service{Name: svcName, Handle: s}
+ defer scm.Close()
+
+ status, err := scm.Control(svc.Stop)
+ if err != nil {
+ return fmt.Errorf("couldn't stop fibratus service: %v", err)
+ }
+ timeout := time.Now().Add(10 * time.Second)
+ for status.State != svc.Stopped {
+ if timeout.Before(time.Now()) {
+ return fmt.Errorf("timeout waiting for service to go to state=%d", svc.Stopped)
+ }
+ time.Sleep(300 * time.Millisecond)
+ status, err = scm.Query()
+ if err != nil {
+ return fmt.Errorf("could not retrieve service status: %v", err)
+ }
+ }
+ return nil
+}
+
+type fsvc struct{}
+
+var evtlog debug.Log
+
+var sktracec kstream.KtraceController
+var skstreamc kstream.Consumer
+var sagg *aggregator.BufferedAggregator
+
+func (s *fsvc) Execute(args []string, r <-chan svc.ChangeRequest, changes chan<- svc.Status) (bool, uint32) {
+ const cmdsAccepted = svc.AcceptStop | svc.AcceptShutdown
+ changes <- svc.Status{State: svc.StartPending}
+ changes <- svc.Status{State: svc.Running, Accepts: cmdsAccepted}
+
+ if err := s.run(); err != nil {
+ evtlog.Error(0xc000000B, err.Error())
+ changes <- svc.Status{State: svc.Stopped}
+ return false, 1
+ }
+
+loop:
+ for {
+ select {
+ case c := <-r:
+ switch c.Cmd {
+ case svc.Interrogate:
+ changes <- c.CurrentStatus
+ time.Sleep(100 * time.Millisecond)
+ changes <- c.CurrentStatus
+ case svc.Stop:
+ break loop
+ case svc.Shutdown:
+ break loop
+ }
+ }
+ }
+
+ changes <- svc.Status{State: svc.StopPending}
+ if sktracec != nil {
+ sktracec.CloseKtrace()
+ }
+ if skstreamc != nil {
+ skstreamc.CloseKstream()
+ }
+ if sagg != nil {
+ sagg.Stop()
+ }
+ handle.CloseTimeout()
+ api.CloseServer()
+ changes <- svc.Status{State: svc.Stopped}
+
+ return true, 0
+}
+
+func (s *fsvc) run() error {
+ if err := svcConfig.TryLoadFile(svcConfig.GetConfigFile()); err != nil {
+ return err
+ }
+ if err := svcConfig.Init(); err != nil {
+ return err
+ }
+ if err := svcConfig.Validate(); err != nil {
+ return err
+ }
+ // ask for debug privileges
+ if svcConfig.DebugPrivilege {
+ security.SetDebugPrivilege()
+ }
+ if err := logger.InitFromConfig(svcConfig.Log); err != nil {
+ return err
+ }
+ sktracec = kstream.NewKtraceController(svcConfig.Kstream)
+ err := sktracec.StartKtrace()
+ if err != nil {
+ return err
+ }
+ // initialize handle/process snapshotters and try to open the kernel event stream
+ hsnap := handle.NewSnapshotter(svcConfig, nil)
+ psnap := ps.NewSnapshotter(hsnap, svcConfig)
+ skstreamc = kstream.NewConsumer(sktracec, psnap, hsnap, svcConfig)
+ // open the kernel event stream, start processing events and forwarding to outputs
+ err = skstreamc.OpenKstream()
+ if err != nil {
+ return err
+ }
+ sagg, err = aggregator.NewBuffered(
+ skstreamc.Events(),
+ skstreamc.Errors(),
+ svcConfig.Aggregator,
+ outputs.Config{Type: svcConfig.Output.Type, Output: svcConfig.Output.Output},
+ svcConfig.Transformers,
+ svcConfig.Alertsenders,
+ )
+ if err != nil {
+ return err
+ }
+ if err := api.StartServer(svcConfig); err != nil {
+ return err
+ }
+ return nil
+}
+
+// RunService runs the service handler.
+func RunService() {
+ var err error
+ evtlog, err = eventlog.Open(svcName)
+ if err != nil {
+ return
+ }
+ defer evtlog.Close()
+
+ err = svc.Run(svcName, &fsvc{})
+ if err != nil {
+ evtlog.Error(0xc0000008, err.Error())
+ return
+ }
+}
diff --git a/cmd/fibratus/app/docs.go b/cmd/fibratus/app/docs.go
new file mode 100644
index 000000000..db95375ce
--- /dev/null
+++ b/cmd/fibratus/app/docs.go
@@ -0,0 +1,32 @@
+/*
+ * Copyright 2019-2020 by Nedim Sabic Sabic
+ * https://www.fibratus.io
+ * All Rights Reserved.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package app
+
+import (
+ "github.com/spf13/cobra"
+ "os/exec"
+)
+
+var docsCmd = &cobra.Command{
+ Use: "docs",
+ Short: "Open Fibratus docs in the web browser",
+ RunE: func(cmd *cobra.Command, args []string) error {
+ return exec.Command("rundll32", "url.dll,FileProtocolHandler", "https://www.fibratus.io").Start()
+ },
+}
diff --git a/cmd/fibratus/app/install_service.go b/cmd/fibratus/app/install_service.go
new file mode 100644
index 000000000..c42236aea
--- /dev/null
+++ b/cmd/fibratus/app/install_service.go
@@ -0,0 +1,72 @@
+/*
+ * Copyright 2019-2020 by Nedim Sabic Sabic
+ * https://www.fibratus.io
+ * All Rights Reserved.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package app
+
+import (
+ "errors"
+ "fmt"
+ "github.com/spf13/cobra"
+ "golang.org/x/sys/windows/svc/eventlog"
+ "golang.org/x/sys/windows/svc/mgr"
+ "os"
+)
+
+const svcName = "fibratus"
+
+var errServiceAlreadyInstalled = errors.New("fibratus service is already installed")
+
+var installSvcCmd = &cobra.Command{
+ Use: "install-service",
+ Short: "Install fibratus within the Windows service control manager",
+ RunE: installService,
+}
+
+func installService(cmd *cobra.Command, args []string) error {
+ exe, err := os.Executable()
+ if err != nil {
+ return err
+ }
+ m, err := mgr.Connect()
+ if err != nil {
+ return err
+ }
+ defer m.Disconnect()
+ s, err := m.OpenService(svcName)
+ if err == nil {
+ s.Close()
+ return errServiceAlreadyInstalled
+ }
+ svccfg := mgr.Config{
+ DisplayName: "Fibratus Service",
+ Description: "Exploration and tracing of the Windows kernel",
+ }
+ s, err = m.CreateService(svcName, exe, svccfg)
+ if err != nil {
+ return err
+ }
+ defer s.Close()
+ err = eventlog.InstallAsEventCreate(svcName, eventlog.Error|eventlog.Warning|eventlog.Info)
+ if err != nil {
+ if err := s.Delete(); err != nil {
+ return err
+ }
+ return fmt.Errorf("couldn't create event log record: %v", err)
+ }
+ return nil
+}
diff --git a/cmd/fibratus/app/list.go b/cmd/fibratus/app/list.go
new file mode 100644
index 000000000..6a7a3653d
--- /dev/null
+++ b/cmd/fibratus/app/list.go
@@ -0,0 +1,154 @@
+/*
+ * Copyright 2019-2020 by Nedim Sabic Sabic
+ * https://www.fibratus.io
+ * All Rights Reserved.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package app
+
+import (
+ "bufio"
+ "fmt"
+ "github.com/jedib0t/go-pretty/v6/table"
+ "github.com/rabbitstack/fibratus/pkg/config"
+ "github.com/rabbitstack/fibratus/pkg/filter/fields"
+ "github.com/rabbitstack/fibratus/pkg/kevent/ktypes"
+ "github.com/spf13/cobra"
+ "io/ioutil"
+ "os"
+ "path/filepath"
+ "strings"
+)
+
+var listCmd = &cobra.Command{
+ Use: "list",
+ Short: "Show info about filaments, filter fields or kernel event types",
+}
+
+var listFilamentsCmd = &cobra.Command{
+ Use: "filaments",
+ Short: "List available filaments",
+ RunE: listFilaments,
+}
+
+var listFieldsCmd = &cobra.Command{
+ Use: "fields",
+ Short: "List available filtering fields",
+ Run: listFields,
+}
+
+var listsKeventsCmd = &cobra.Command{
+ Use: "kevents",
+ Short: "List supported kernel event types",
+ Run: listKevents,
+}
+
+var listConfig = config.NewWithOpts(config.WithList())
+
+func init() {
+ listConfig.MustViperize(listFilamentsCmd)
+
+ listCmd.AddCommand(listFilamentsCmd)
+ listCmd.AddCommand(listFieldsCmd)
+ listCmd.AddCommand(listsKeventsCmd)
+
+ RootCmd.AddCommand(listCmd)
+}
+
+// listFilaments renders a table with all available filaments.
+func listFilaments(cmd *cobra.Command, args []string) error {
+ if err := listConfig.Init(); err != nil {
+ return err
+ }
+
+ dir := listConfig.Filament.Path
+ if _, err := os.Stat(dir); err != nil {
+ if os.IsNotExist(err) {
+ return fmt.Errorf("%q directory does not exist", dir)
+ }
+ return err
+ }
+
+ filaments, err := ioutil.ReadDir(dir)
+ if err != nil {
+ return err
+ }
+
+ t := table.NewWriter()
+ t.SetOutputMirror(os.Stdout)
+ t.AppendHeader(table.Row{"Name", "Description"})
+ t.SetStyle(table.StyleLight)
+
+ for _, f := range filaments {
+ if f.IsDir() {
+ continue
+ }
+ py, err := os.Open(filepath.Join(dir, f.Name()))
+ if err != nil {
+ continue
+ }
+ if filepath.Ext(f.Name()) != ".py" {
+ continue
+ }
+
+ sn := bufio.NewScanner(py)
+ var docStart bool
+ var doc string
+ for sn.Scan() {
+ ln := sn.Text()
+ if docStart {
+ doc = ln
+ break
+ }
+ if ln == `"""` {
+ docStart = true
+ }
+
+ }
+ _ = py.Close()
+ t.AppendRow(table.Row{strings.TrimSuffix(f.Name(), ".py"), doc})
+ }
+ t.Render()
+
+ return nil
+}
+
+// listKevents renders a table with supported kernel event types showing the category to which their pertain and a short description.
+func listKevents(cmd *cobra.Command, args []string) {
+ t := table.NewWriter()
+ t.SetOutputMirror(os.Stdout)
+ t.AppendHeader(table.Row{"Name", "Category", "Description"})
+ t.SetStyle(table.StyleLight)
+
+ for _, ktyp := range ktypes.GetKtypesMeta() {
+ t.AppendRow(table.Row{ktyp.Name, ktyp.Category, ktyp.Description})
+ }
+
+ t.Render()
+}
+
+// listFields renders a table with available filtering fields containing the name, description and the example filtering expression.
+func listFields(cmd *cobra.Command, args []string) {
+ t := table.NewWriter()
+ t.SetOutputMirror(os.Stdout)
+ t.AppendHeader(table.Row{"Name", "Description", "Example"})
+ t.SetStyle(table.StyleLight)
+
+ for _, field := range fields.Get() {
+ t.AppendRow(table.Row{field.Field, field.Desc, strings.Join(field.Examples, ",")})
+ }
+
+ t.Render()
+}
diff --git a/cmd/fibratus/app/remove_service.go b/cmd/fibratus/app/remove_service.go
new file mode 100644
index 000000000..db6d6cf02
--- /dev/null
+++ b/cmd/fibratus/app/remove_service.go
@@ -0,0 +1,57 @@
+/*
+ * Copyright 2019-2020 by Nedim Sabic Sabic
+ * https://www.fibratus.io
+ * All Rights Reserved.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package app
+
+import (
+ "errors"
+ "fmt"
+ "github.com/spf13/cobra"
+ "golang.org/x/sys/windows/svc/eventlog"
+ "golang.org/x/sys/windows/svc/mgr"
+)
+
+var removeSvcCmd = &cobra.Command{
+ Use: "remove-service",
+ Short: "Remove fibratus from the Windows service control manager",
+ RunE: removeService,
+}
+
+var errServiceNotInstalled = errors.New("fibratus service is not installed")
+
+func removeService(cmd *cobra.Command, args []string) error {
+ m, err := mgr.Connect()
+ if err != nil {
+ return err
+ }
+ defer m.Disconnect()
+ s, err := m.OpenService(svcName)
+ if err != nil {
+ return errServiceNotInstalled
+ }
+ defer s.Close()
+ err = s.Delete()
+ if err != nil {
+ return err
+ }
+ err = eventlog.Remove(svcName)
+ if err != nil {
+ return fmt.Errorf("couldn't create eventlog remove record: %v", err)
+ }
+ return nil
+}
diff --git a/cmd/fibratus/app/replay.go b/cmd/fibratus/app/replay.go
new file mode 100644
index 000000000..f35e201e2
--- /dev/null
+++ b/cmd/fibratus/app/replay.go
@@ -0,0 +1,142 @@
+/*
+ * Copyright 2019-2020 by Nedim Sabic Sabic
+ * https://www.fibratus.io
+ * All Rights Reserved.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package app
+
+import (
+ "context"
+ "github.com/rabbitstack/fibratus/pkg/aggregator"
+ "github.com/rabbitstack/fibratus/pkg/api"
+ "github.com/rabbitstack/fibratus/pkg/config"
+ "github.com/rabbitstack/fibratus/pkg/filament"
+ "github.com/rabbitstack/fibratus/pkg/filter"
+ "github.com/rabbitstack/fibratus/pkg/kcap"
+ "github.com/rabbitstack/fibratus/pkg/outputs"
+ logger "github.com/rabbitstack/fibratus/pkg/util/log"
+ "github.com/spf13/cobra"
+ "os"
+ "os/signal"
+)
+
+var replayCmd = &cobra.Command{
+ Use: "replay",
+ Short: "Replay kernel event flow from the kcap file",
+ RunE: replay,
+}
+
+var replayConfig = config.NewWithOpts(config.WithReplay())
+
+func init() {
+ replayConfig.MustViperize(replayCmd)
+}
+
+func replay(cmd *cobra.Command, args []string) error {
+ if err := replayConfig.TryLoadFile(replayConfig.File()); err != nil {
+ return err
+ }
+ if err := replayConfig.Init(); err != nil {
+ return err
+ }
+ if err := replayConfig.Validate(); err != nil {
+ return err
+ }
+ if err := logger.InitFromConfig(replayConfig.Log); err != nil {
+ return err
+ }
+ kfilter, err := filter.NewFromCLI(args)
+ if err != nil {
+ return err
+ }
+ // initialize kcap reader and try to recover the snapshotters
+ // from the captured state
+ reader, err := kcap.NewReader(replayConfig.KcapFile, replayConfig)
+ if err != nil {
+ return err
+ }
+ hsnap, psnap, err := reader.RecoverSnapshotters()
+ if err != nil {
+ return err
+ }
+
+ ctx, cancel := context.WithCancel(context.Background())
+
+ filamentConfig := replayConfig.Filament
+ filamentName := filamentConfig.Name
+ // we don't need the aggregator is user decided to replay the
+ // kcap on the filament. Otwherise, we setup the full-fledged
+ // buffered aggregator
+ var agg *aggregator.BufferedAggregator
+
+ if filamentName != "" {
+ f, err := filament.New(filamentName, psnap, hsnap, filamentConfig)
+ if err != nil {
+ return err
+ }
+ if f.Filter() != nil {
+ kfilter = f.Filter()
+ }
+ reader.SetFilter(kfilter)
+
+ // returns the channel where events are read from the kcap
+ kevents, errs := reader.Read(ctx)
+
+ go func() {
+ defer f.Close()
+ err = f.Run(kevents, errs)
+ if err != nil {
+ sig <- os.Interrupt
+ }
+ }()
+ } else {
+ if kfilter != nil {
+ reader.SetFilter(kfilter)
+ }
+
+ // use the channels where events are read from the kcap as aggregator source
+ kevents, errs := reader.Read(ctx)
+
+ var err error
+ agg, err = aggregator.NewBuffered(
+ kevents,
+ errs,
+ replayConfig.Aggregator,
+ outputs.Config{Type: replayConfig.Output.Type, Output: replayConfig.Output.Output},
+ replayConfig.Transformers,
+ replayConfig.Alertsenders,
+ )
+ if err != nil {
+ return err
+ }
+ }
+ // start the HTTP server
+ if err := api.StartServer(replayConfig); err != nil {
+ return err
+ }
+ signal.Notify(sig, os.Kill, os.Interrupt)
+ <-sig
+ // stop reader consumer goroutines
+ cancel()
+
+ if agg != nil {
+ if err := agg.Stop(); err != nil {
+ return err
+ }
+ }
+
+ return nil
+}
diff --git a/cmd/fibratus/app/root.go b/cmd/fibratus/app/root.go
new file mode 100644
index 000000000..821f7f48e
--- /dev/null
+++ b/cmd/fibratus/app/root.go
@@ -0,0 +1,65 @@
+/*
+ * Copyright 2019-2020 by Nedim Sabic Sabic
+ * https://www.fibratus.io
+ * All Rights Reserved.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package app
+
+import (
+ "errors"
+ "github.com/spf13/cobra"
+ "os"
+ "runtime"
+)
+
+var sig = make(chan os.Signal, 2)
+
+var RootCmd = &cobra.Command{
+ Use: "fibratus",
+ Short: "Modern tool for the kernel observability and exploration",
+ Long: `
+ Fibratus is a tool for exploration and tracing of the Windows kernel.
+ It lets you trap system-wide events such as process life-cycle, file system I/O,
+ registry modifications or network requests among many other observability signals.
+ In a nutshell, Fibratus allows for gaining deep operational visibility into the Windows
+ kernel but also processes running on top of it.
+ `,
+ SilenceUsage: true,
+ PersistentPreRunE: func(cmd *cobra.Command, args []string) error {
+ if runtime.GOOS != "windows" {
+ return errors.New("fibratus can only be run on Windows operating systems")
+ }
+ if runtime.GOARCH == "386" {
+ return errors.New("fibratus can't be run on 32-bits Windows operating systems")
+ }
+ return nil
+ },
+}
+
+func init() {
+ RootCmd.AddCommand(runCmd)
+ RootCmd.AddCommand(captureCmd)
+ RootCmd.AddCommand(replayCmd)
+ RootCmd.AddCommand(installSvcCmd)
+ RootCmd.AddCommand(removeSvcCmd)
+ RootCmd.AddCommand(startSvcCmd)
+ RootCmd.AddCommand(stopSvcCmd)
+ RootCmd.AddCommand(restartSvcCmd)
+ RootCmd.AddCommand(statsCmd)
+ RootCmd.AddCommand(configCmd)
+ RootCmd.AddCommand(docsCmd)
+ RootCmd.AddCommand(versionCmd)
+}
diff --git a/cmd/fibratus/app/run.go b/cmd/fibratus/app/run.go
new file mode 100644
index 000000000..6a1069aa8
--- /dev/null
+++ b/cmd/fibratus/app/run.go
@@ -0,0 +1,187 @@
+/*
+ * Copyright 2019-2020 by Nedim Sabic Sabic
+ * https://www.fibratus.io
+ * All Rights Reserved.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package app
+
+import (
+ "github.com/rabbitstack/fibratus/pkg/aggregator"
+ "github.com/rabbitstack/fibratus/pkg/alertsender"
+ "github.com/rabbitstack/fibratus/pkg/api"
+ "github.com/rabbitstack/fibratus/pkg/config"
+ "github.com/rabbitstack/fibratus/pkg/filament"
+ "github.com/rabbitstack/fibratus/pkg/filter"
+ "github.com/rabbitstack/fibratus/pkg/handle"
+ "github.com/rabbitstack/fibratus/pkg/kstream"
+ "github.com/rabbitstack/fibratus/pkg/outputs"
+ "github.com/rabbitstack/fibratus/pkg/ps"
+ "github.com/rabbitstack/fibratus/pkg/syscall/security"
+ logger "github.com/rabbitstack/fibratus/pkg/util/log"
+ log "github.com/sirupsen/logrus"
+ "github.com/spf13/cobra"
+ "os"
+ "os/signal"
+)
+
+var runCmd = &cobra.Command{
+ Use: "run [filter]",
+ Short: "Bootstrap fibratus or a filament",
+ Aliases: []string{"start"},
+ RunE: run,
+ Example: `
+ # Run without the filter
+ fibratus run
+
+ # Run with the filter that drops all but events produced by the svchost.exe process
+ fibratus run ps.name = 'svchost.exe'
+
+ # Run with the filter that traps all events that were generated by process that contains the 'svc' string and it was started by 'SYSTEM' or 'admin' users
+ fibratus run ps.name contains 'svc' and ps.sid in ('NT AUTHORITY\\SYSTEM', 'ARCHRABBIT\\admin')
+
+ # Run the top_keys filament
+ fibratus run -f top_keys
+ `,
+}
+
+var cfg = config.NewWithOpts(config.WithRun())
+
+func init() {
+ cfg.MustViperize(runCmd)
+}
+
+func run(cmd *cobra.Command, args []string) error {
+ // even though it is possible to bootstrap with default config, we'll
+ // return an error if for some reason the config can't be loaded from the file
+ if err := cfg.TryLoadFile(cfg.File()); err != nil {
+ return err
+ }
+ // initialize and validate the config
+ if err := cfg.Init(); err != nil {
+ return err
+ }
+ if err := cfg.Validate(); err != nil {
+ return err
+ }
+ // inject the debug privilege if enabled
+ if cfg.DebugPrivilege {
+ security.SetDebugPrivilege()
+ }
+ if err := logger.InitFromConfig(cfg.Log); err != nil {
+ return err
+ }
+ // initialize kernel trace controller and try to start the trace
+ ktracec := kstream.NewKtraceController(cfg.Kstream)
+ err := ktracec.StartKtrace()
+ if err != nil {
+ return err
+ }
+ defer ktracec.CloseKtrace()
+ // bootstrap essential components, including handle, process snapshotters
+ // and the kernel stream consumer that will actually collect all the events
+ hsnap := handle.NewSnapshotter(cfg, nil)
+ psnap := ps.NewSnapshotter(hsnap, cfg)
+ kstreamc := kstream.NewConsumer(ktracec, psnap, hsnap, cfg)
+ // build the filter from the CLI argument. If we got a valid expression the filter
+ // is linked to the kernel stream consumer so it can drop any events that don't match
+ // the filter criteria
+ kfilter, err := filter.NewFromCLI(args)
+ if err != nil {
+ return err
+ }
+ if kfilter != nil {
+ kstreamc.SetFilter(kfilter)
+ }
+ log.Infof("bootstrapping with pid %d", os.Getpid())
+ // user can either instruct to bootstrap a filament or start a regular run. We'll setup
+ // the corresponding components accordingly to what we got from the CLI options. If a filament
+ // was given, we'll assign it the previous filter if it wasn't provided in the filament init function.
+ // Finally, we open the kernel stream flow and run the filament i.e. Python main thread in a new goroutine.
+ // In case of a regular run, we additionally setup the aggregator. The aggregator will grab the events
+ // from the queue, assemble them into batches and hand over to output sinks.
+ var f filament.Filament
+ filamentName := cfg.Filament.Name
+ if filamentName != "" {
+ f, err = filament.New(filamentName, psnap, hsnap, cfg.Filament)
+ if err != nil {
+ return err
+ }
+ if f.Filter() != nil {
+ kstreamc.SetFilter(f.Filter())
+ }
+ err = kstreamc.OpenKstream()
+ if err != nil {
+ return err
+ }
+ defer kstreamc.CloseKstream()
+ // load alert senders so emitting alerts is possible from filaments
+ err = alertsender.LoadAll(cfg.Alertsenders)
+ if err != nil {
+ log.Warnf("couldn't load alertsenders: %v", err)
+ }
+ go func() {
+ err = f.Run(kstreamc.Events(), kstreamc.Errors())
+ if err != nil {
+ log.Error(err)
+ sig <- os.Interrupt
+ }
+ }()
+ } else {
+ err = kstreamc.OpenKstream()
+ if err != nil {
+ return err
+ }
+ defer kstreamc.CloseKstream()
+ // setup the aggregator that forwards events to outputs
+ agg, err := aggregator.NewBuffered(
+ kstreamc.Events(),
+ kstreamc.Errors(),
+ cfg.Aggregator,
+ outputs.Config{Type: cfg.Output.Type, Output: cfg.Output.Output},
+ cfg.Transformers,
+ cfg.Alertsenders,
+ )
+ if err != nil {
+ return err
+ }
+ defer func() {
+ if err := agg.Stop(); err != nil {
+ log.Error(err)
+ }
+ }()
+ }
+ // start the HTTP server
+ if err := api.StartServer(cfg); err != nil {
+ return err
+ }
+ // wait for signals
+ signal.Notify(sig, os.Interrupt, os.Kill)
+ <-sig
+ log.Infof("shutting down...")
+ // shutdown everything gracefully
+ if f != nil {
+ if err := f.Close(); err != nil {
+ return err
+ }
+ }
+ if err := handle.CloseTimeout(); err != nil {
+ return err
+ }
+ if err := api.CloseServer(); err != nil {
+ return err
+ }
+ return nil
+}
diff --git a/cmd/fibratus/app/stats.go b/cmd/fibratus/app/stats.go
new file mode 100644
index 000000000..35c2e67ff
--- /dev/null
+++ b/cmd/fibratus/app/stats.go
@@ -0,0 +1,162 @@
+/*
+ * Copyright 2019-2020 by Nedim Sabic Sabic
+ * https://www.fibratus.io
+ * All Rights Reserved.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package app
+
+import (
+ "encoding/json"
+ "github.com/jedib0t/go-pretty/v6/table"
+ "github.com/rabbitstack/fibratus/pkg/config"
+ "github.com/rabbitstack/fibratus/pkg/util/rest"
+ "github.com/spf13/cobra"
+ "os"
+ "reflect"
+)
+
+var statsCmd = &cobra.Command{
+ Use: "stats",
+ Short: "Show runtime stats",
+ RunE: stats,
+}
+
+var statsConfig = config.NewWithOpts(config.WithStats())
+
+func init() {
+ statsConfig.MustViperize(statsCmd)
+}
+
+// Stats stores runtime statistics that are retrieved from the expvar endpoint.
+type Stats struct {
+ AggregatorBatchEvents int `json:"aggregator.batch.events"`
+ AggregatorFlushesCount int `json:"aggregator.flushes.count"`
+ AggregatorKeventErrors int `json:"aggregator.kevent.errors"`
+ AggregatorTransformerErrors map[string]int `json:"aggregator.transformer.errors"`
+ AggregatorWorkerClientPublishErrors int `json:"aggregator.worker.client.publish.errors"`
+ FilamentKdictErrors int `json:"filament.kdict.errors"`
+ FilamentKeventBatchFlushes int `json:"filament.kevent.batch.flushes"`
+ FilamentKeventErrors map[string]int `json:"filament.kevent.errors"`
+ FilamentKeventProcessErrors int `json:"filament.kevent.process.errors"`
+ FilterAccessorErrors map[string]int `json:"filter.accessor.errors"`
+ FsFileObjectHandleHits int `json:"fs.file.object.handle.hits"`
+ FsFileObjectMisses int `json:"fs.file.object.misses"`
+ FsFileReleases int `json:"fs.file.releases"`
+ FsTotalRundownFiles int `json:"fs.total.rundown.files"`
+ HandleDeferredEvictions int `json:"handle.deferred.evictions"`
+ HandleNameQueryFailures map[string]int `json:"handle.name.query.failures"`
+ HandleSnapshotCount int `json:"handle.snapshot.count"`
+ HandleSnapshotBytes int `json:"handle.snapshot.bytes"`
+ HandleTypesCount int `json:"handle.types.count"`
+ HandleTypeNameMisses int `json:"handle.type.name.misses"`
+ HandleWaitTimeouts int `json:"handle.wait.timeouts"`
+ HostnameErrors map[string]int `json:"hostname.errors"`
+ KcapDroppedKevents int `json:"kcap.dropped.kevents"`
+ KcapFlusherErrors map[string]int `json:"kcap.flusher.errors"`
+ KcapHandleWriteErrors int `json:"kcap.handle.write.errors"`
+ KcapKeventUnmarshalErrors int `json:"kcap.kevent.unmarshal.errors"`
+ KcapKeventWriteErrors int `json:"kcap.kevent.write.errors"`
+ KcapKstreamConsumerErrors int `json:"kcap.kstream.consumer.errors"`
+ KcapOverflowErrors int `json:"kcap.overflow.errors"`
+ KcapReadBytes int `json:"kcap.read.bytes"`
+ KcapReadKevents int `json:"kcap.read.kevents"`
+ KcapReaderDroppedByFilter int `json:"kcap.reader.dropped.by.filter"`
+ KcapReaderHandleUnmarshalErrors int `json:"kcap.reader.handle.unmarshal.errors"`
+ KeventInterceptorFailures int `json:"kevent.interceptor.failures"`
+ KeventSeqInitErrors map[string]int `json:"kevent.seq.init.errors"`
+ KeventSeqStoreErrors int `json:"kevent.seq.store.errors"`
+ KeventTimestampUnmarshalErrors int `json:"kevent.timestamp.unmarshal.errors"`
+ KstreamBlacklistDroppedKevents map[string]int `json:"kstream.blacklist.dropped.kevents"`
+ KstreamBlacklistDroppedProcs map[string]int `json:"kstream.blacklist.dropped.procs"`
+ KstreamKbuffersRead int `json:"kstream.kbuffers.read"`
+ KstreamKeventParamFailures int `json:"kstream.kevent.param.failures"`
+ KstreamKeventsEnqueued int `json:"kstream.kevents.enqueued"`
+ KstreamKeventsDequeued int `json:"kstream.kevents.dequeued"`
+ KstreamKeventsFailures map[string]int `json:"kstream.kevents.failures"`
+ KstreamKeventsMissingSchemaErrors map[string]int `json:"kstream.kevents.missing.schema.errors"`
+ KstreamUpstreamCancellations int `json:"kstream.upstream.cancellations"`
+ LoggerErrors map[string]int `json:"logger.errors"`
+ OutputAmqpChannelFailures int `json:"output.amqp.channel.failures"`
+ OutputAmqpConnectionFailures int `json:"output.amqp.connection.failures"`
+ OutputAmqpPublishErrors int `json:"output.amqp.publish.errors"`
+ OutputConsoleErrors int `json:"output.console.errors"`
+ OutputNullBlackholeEvents int `json:"output.null.blackhole.events"`
+ PeFailedResourceEntryReads int `json:"pe.failed.resource.entry.reads"`
+ PeMaxResourceEntriesExceeded int `json:"pe.max.resource.entries.exceeded"`
+ ProcessCount int `json:"process.count"`
+ ProcessModuleCount int `json:"process.module.count"`
+ ProcessLookupFailureCount map[int]int `json:"process.lookup.failure.count"`
+ ProcessPebReadErrors int `json:"process.peb.read.errors"`
+ ProcessReaped int `json:"process.reaped"`
+ ProcessThreadCount int `json:"process.thread.count"`
+ RegistryKcbCount int `json:"registry.kcb.count"`
+ RegistryKcbMisses int `json:"registry.kcb.misses"`
+ RegistryKeyHandleHits int `json:"registry.key.handle.hits"`
+ RegistryUnknownKeysCount int `json:"registry.unknown.keys.count"`
+ SidsCount int `json:"sids.count"`
+ YaraImageScans int `json:"yara.image.scans"`
+ YaraProcScans int `json:"yara.proc.scans"`
+ YaraRuleMatches int `json:"yara.rule.matches"`
+}
+
+func stats(cmd *cobra.Command, args []string) error {
+ if err := statsConfig.TryLoadFile(statsConfig.File()); err != nil {
+ return err
+ }
+ if err := statsConfig.Init(); err != nil {
+ return err
+ }
+ if err := statsConfig.Validate(); err != nil {
+ return err
+ }
+
+ c := statsConfig.API
+ body, err := rest.Get(rest.WithTransport(c.Transport), rest.WithURI("debug/vars"))
+ if err != nil {
+ return err
+ }
+ var stats Stats
+ if err := json.Unmarshal(body, &stats); err != nil {
+ return err
+ }
+
+ t := table.NewWriter()
+ t.SetOutputMirror(os.Stdout)
+ t.AppendHeader(table.Row{"Name", "Value"})
+ t.SetStyle(table.StyleLight)
+
+ typ := reflect.TypeOf(stats)
+ val := reflect.ValueOf(stats)
+
+ for i := 0; i < typ.NumField(); i++ {
+ f := typ.Field(i)
+ tag := f.Tag.Get("json")
+
+ if tag == "" {
+ continue
+ }
+
+ if !val.Field(i).CanInterface() {
+ continue
+ }
+
+ t.AppendRow(table.Row{tag, val.Field(i).Interface()})
+ }
+
+ t.Render()
+
+ return nil
+}
diff --git a/cmd/fibratus/app/version.go b/cmd/fibratus/app/version.go
new file mode 100644
index 000000000..3e04e0e2f
--- /dev/null
+++ b/cmd/fibratus/app/version.go
@@ -0,0 +1,40 @@
+/*
+ * Copyright 2019-2020 by Nedim Sabic Sabic
+ * https://www.fibratus.io
+ * All Rights Reserved.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package app
+
+import (
+ "fmt"
+ "github.com/spf13/cobra"
+ "os"
+ "runtime"
+)
+
+var version string
+var commit string
+
+var versionCmd = &cobra.Command{
+ Use: "version",
+ Short: "Show version info",
+ Run: func(cmd *cobra.Command, args []string) {
+ if version == "" {
+ version = "dev"
+ }
+ _, _ = fmt.Fprintln(os.Stdout, "Version:", version, "Commit:", commit, "Go compiler:", runtime.Version())
+ },
+}
diff --git a/cmd/fibratus/fibratus.exe.manifest b/cmd/fibratus/fibratus.exe.manifest
new file mode 100644
index 000000000..c1cb48310
--- /dev/null
+++ b/cmd/fibratus/fibratus.exe.manifest
@@ -0,0 +1,9 @@
+
+
+
+
+
+
+
+
+
\ No newline at end of file
diff --git a/cmd/fibratus/fibratus.rc b/cmd/fibratus/fibratus.rc
new file mode 100644
index 000000000..64be5cbd6
--- /dev/null
+++ b/cmd/fibratus/fibratus.rc
@@ -0,0 +1,38 @@
+#include "version.h"
+#define RT_MANIFEST 24
+
+#define VS_VERSION_INFO 1
+VS_VERSION_INFO VERSIONINFO
+ FILEVERSION RC_FILE_VERSION
+ PRODUCTVERSION RC_FILE_VERSION
+ FILEFLAGSMASK 0x3fL
+#ifdef _DEBUG
+ FILEFLAGS 0x1L
+#else
+ FILEFLAGS 0x0L
+#endif
+ FILEOS 0x40004L
+ FILETYPE 0x0L
+ FILESUBTYPE 0x0L
+BEGIN
+ BLOCK "StringFileInfo"
+ BEGIN
+ BLOCK "040904b0"
+ BEGIN
+ VALUE "CompanyName", "Fibratus"
+ VALUE "FileDescription", "Kernel tracing and exploration tool"
+ VALUE "FileVersion", FILE_VERSION_STRING
+ VALUE "InternalName", "fibratus"
+ VALUE "LegalCopyright", "Copyright (C) 2019-2020"
+ VALUE "OriginalFilename", "fibratus.exe"
+ VALUE "ProductName", "Fibratus"
+ VALUE "ProductVersion", FILE_VERSION_STRING
+ END
+ END
+ BLOCK "VarFileInfo"
+ BEGIN
+ VALUE "Translation", 0x409, 1200
+ END
+END
+
+1 RT_MANIFEST "fibratus.exe.manifest"
\ No newline at end of file
diff --git a/cmd/fibratus/main.go b/cmd/fibratus/main.go
new file mode 100644
index 000000000..315296881
--- /dev/null
+++ b/cmd/fibratus/main.go
@@ -0,0 +1,42 @@
+/*
+ * Copyright 2019-2020 by Nedim Sabic Sabic
+ * https://www.fibratus.io
+ * All Rights Reserved.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package main
+
+import (
+ "fmt"
+ "github.com/rabbitstack/fibratus/cmd/fibratus/app"
+ "golang.org/x/sys/windows/svc"
+ "os"
+)
+
+func main() {
+ // determine if we are running in an interactive session
+ in, err := svc.IsAnInteractiveSession()
+ if err != nil {
+ fmt.Printf("interactive session check failed: %v\n", err)
+ os.Exit(-1)
+ }
+ if !in {
+ app.RunService()
+ return
+ }
+ if err := app.RootCmd.Execute(); err != nil {
+ os.Exit(-1)
+ }
+}
diff --git a/cmd/fibratus/version.h b/cmd/fibratus/version.h
new file mode 100644
index 000000000..237ddd52b
--- /dev/null
+++ b/cmd/fibratus/version.h
@@ -0,0 +1,6 @@
+#define RC_FILE_VERSION RC_VER,0
+
+#define STRINGIFY(x) #x
+#define TO_STRING(x) STRINGIFY(x)
+
+#define FILE_VERSION_STRING TO_STRING(VER)
diff --git a/configs/fibratus.json b/configs/fibratus.json
new file mode 100644
index 000000000..cac66b122
--- /dev/null
+++ b/configs/fibratus.json
@@ -0,0 +1,55 @@
+{
+ "aggregator": {
+ "flush-period": "500ms",
+ "flush-timeout": "4s"
+ },
+
+ "alertsenders": {
+ "mail": {
+ "enabled": false
+ },
+
+ "slack": {
+ "enabled": false
+ }
+ },
+
+ "api": {
+ "transport": "localhost:8090",
+ "timeout": "5s"
+ },
+
+ "debug-privilege": true,
+
+ "filament": {
+ "name": "",
+ "flush-period": "200ms"
+ },
+
+ "handle": {
+ "init-snapshot": true
+ },
+
+ "kevent": {
+
+ },
+
+ "kcap": {
+
+ },
+
+ "kstream": {},
+ "logging": {},
+
+ "output": {
+ "console": {
+ "enabled": true,
+ "format": "pretty",
+ "kv-delimiter": "->"
+ }
+ },
+
+ "pe": {},
+ "transformers": {},
+ "yara": {}
+}
\ No newline at end of file
diff --git a/configs/fibratus.yml b/configs/fibratus.yml
new file mode 100644
index 000000000..62e9b60c5
--- /dev/null
+++ b/configs/fibratus.yml
@@ -0,0 +1,476 @@
+###################### Fibratus Configuration File #####################################
+
+# =============================== Aggregator ==========================================
+
+# Aggregator is responsible for creating kernel event batches, applying transformers to each event
+# present in the batch, and forwarding those batches to the output sinks.
+aggregator:
+ # Determines the flush period that triggers the flushing of the kernel event batches to output sinks
+ flush-period: 500ms
+
+ # Represents the max time to wait before announcing failed flushing of enqueued events when fibratus
+ # is stopped
+ flush-timeout: 4s
+
+# =============================== Alert senders ========================================
+
+# Alert senders deal with emitting alerts via different channels.
+alertsenders:
+ # Mail sender transports the alerts via SMTP protocol.
+ mail:
+ # Enables/disables mail alert sender
+ enabled: false
+
+ # Represents the host of the SMTP server
+ #host:
+
+ # Represents the port of the SMTP server
+ #port: 25
+
+ # Specifies the user name when authenticating to the SMTP server
+ #user:
+
+ # Specifies the password when authenticating to the SMTP server
+ #password:
+
+ # Specifies the sender's address
+ #from:
+
+ # Specifies all the recipients that'll receive the alert
+ #to:
+ # - ""
+
+ # Slack sender transports the alerts to the Slack workspace.
+ slack:
+ # Enables/disables Slack alert sender
+ enabled: false
+
+ # Represents the Webhook URL of the workspace where alerts will be dispatched
+ #url:
+
+ # Designates the Slack workspace where alerts will be routed
+ #workspace:
+
+ # Is the slack channel in which to post alerts
+ #channel:
+
+ # Represents the emoji icon surrounded in ':' characters for the Slack bot
+ #emoji: ""
+
+# =============================== API ==================================================
+
+# Settings that influence the behaviour of the HTTP server that exposes a number of endpoints such as
+# expvar metrics, internal state, and so on
+api:
+ # Specifies the underlying transport protocol for the API HTTP server. The transport can either be the
+ # named pipe or TCP socket. Default is named pipe but you can override it to expose the API server on
+ # TCP address, e.g. 192.168.1.32:8084.
+ transport: localhost:8482
+
+ # Represents the timeout interval for the HTTP server responses.
+ timeout: 5s
+
+# =============================== General ==============================================
+
+# Indicates whether debug privilege is set in Fibratus process' token. Enabling this security policy allows
+# Fibratus to obtain handles of protected processes for the purpose of querying the Process Environment Block
+# regions.
+debug-privilege: true
+
+
+# =============================== Filament =============================================
+
+# Filaments are lightweight Python scriplets that are executed on top of the kernel event stream. You can easily
+# extend Fibratus with custom features that is encapsulated in filaments. This section controls the behaviour of
+# the filament engine.
+filament:
+ # Specifies the name of the filament that is executed by the run command
+ name: ""
+
+ # The directory where all filaments are located. By default, filaments are stored in the ${PROGRAMFILES}/fibratus/filaments directory.
+ #path: ${PROGRAMFILES}/fibratus/filaments
+
+ # Determines how often event batches are propagated to the filament callback function
+ #flush-period: 200ms
+
+# =============================== Handle ===============================================
+
+# Indicates whether initial handle snapshot is built. The snapshot contains the state of system handles.
+handle:
+ init-snapshot: true
+
+# =============================== Kevent ===============================================
+
+# The following settings control the state of the kernel event.
+kevent:
+ # Indicates if threads are serialized as part of the process state
+ serialize-threads: false
+
+ # Indicates if modules such as Dynamic Linked Libraries are serialized as part of the process state
+ serialize-images: false
+
+ # Indicates if handles are serialized as part of the process state
+ serialize-handles: false
+
+ # Indicates if PE (Portable Executable) metadata are serialized as part of the process state
+ serialize-pe: false
+
+ # Indicates if environment variables are serialized as part of the process state
+ serialize-envs: false
+
+# =============================== Kcap =================================================
+
+# Contains the settings that dictate the behaviour of the kernel event captures.
+
+kcap:
+ # Specifies the name of the output kcap file. If not empty, capture files are always stored
+ # to this file by overwriting any existing capture file
+ file: ""
+
+# =============================== Kstream ==============================================
+
+# Tweaks for controlling the behaviour of the kernel stream consumer.
+kstream:
+ # Determines the maximum number of buffers allocated for the event tracing session's buffer pool
+ #max-buffers:
+
+ # Determines the minimum number of buffers allocated for the event tracing session's buffer pool
+ #min-buffers:
+
+ # Specifies how often the trace buffers are forcibly flushed
+ #flush-interval: 1s
+
+ # Represents the amount of memory allocated for each event tracing session buffer, in kilobytes.
+ # The buffer size affects the rate at which buffers fill and must be flushed (small buffer size requires
+ # less memory but it increases the rate at which buffers must be flushed)
+ #buffer-size:
+
+ # Determines whether thread kernel events are collected by Kernel Logger provider
+ #enable-thread: true
+
+ # Determines whether registry kernel events are collected by Kernel Logger provider
+ #enable-registry: true
+
+ # Determines whether network kernel events are collected by Kernel Logger provider
+ #enable-net: true
+
+ # Determines whether file kernel events are collected by Kernel Logger provider
+ #enable-fileio: true
+
+ # Determines whether image kernel events are collected by Kernel Logger provider
+ #enable-image: true
+
+ # Determines whether object manager kernel events (handle creation/destruction) are
+ # collected by Kernel Logger provider
+ #enable-handle: false
+
+ # Determines which events are dropped either by the event name or the process' image
+ # name that triggered the event.
+ blacklist:
+ # Contains a list of kernel event names that are dropped from the event stream
+ events:
+ - CloseFile
+ # Contains a list of case-insensitive process image names including the extension.
+ # Any event originated by the image specified in this list is dropped from the event stream
+ images:
+ - System
+
+
+# =============================== Logging ================================================
+
+# Contains the tweaks for fine-tuning the behaviour of the log files produced by Fibratus.
+logging:
+ # Specifies the minimum allowed log level. Anything logged below this log level will
+ # not get dumped to a file or stdout stream
+ level: info
+
+ # Represents the maximum number of days to retain old log files based on the timestamp
+ # encoded in their filename. By default, all log files are retained
+ # max-age: 0
+
+ # Specifies the maximum number of old log files to retain
+ #max-backups: 15
+
+ # Specifies the maximum size in megabytes of the log file before it gets rotated
+ #max-size: 100
+
+ # Represents the log file format. By default, Fibratus will dump the logs in JSON format
+ #formatter: json
+
+ # Represents the alternative paths for storing the logs. Logs are usually stored in the
+ # same directory where Fibratus was installed
+ #path:
+
+ # Indicates whether log lines are written to standard output in addition to writing them to log files
+ #log-stdout: false
+
+
+# =============================== Output ================================================
+
+# Outputs transport the event flowing through kernel event stream to its final destination. Only one output
+# can be active at the time. The following section contains available outputs and their preferences.
+output:
+ # Console output writes the event to standard output stream.
+ console:
+ # Indicates whether the console output is active
+ enabled: true
+
+ # Specifies the console output format. The "pretty" format dictates that formatting is accomplished
+ # by replacing the specifiers in the template. The "json" format outputs the event as a raw JSON string
+ format: pretty
+
+ # Template that's feed into event formatter. The default event formatter template is:
+ #
+ # {{ .Seq }} {{ .Timestamp }} - {{ .CPU }} {{ .Process }} ({{ .Pid }}) - {{ .Type }} ({{ .Kparams }})
+ #
+ #template:
+
+ # Specifies the separator that's rendered between the event parameter's key and its value.
+ #kv-delimiter:
+
+ # Elasticsearch output indexes event bulks into Elasticsearch clusters.
+ elasticsearch:
+ # Indicates whether the Elasticsearch output is enabled
+ enabled: false
+
+ # Defines the URL endpoints of the Elasticsearch nodes
+ #servers:
+ # - http://localhost:9200
+
+ # Represents the initial HTTP connection timeout
+ #timeout: 5s
+
+ # Specifies when to flush the bulk at the end of the given interval
+ #flush-period: 1s
+
+ # Determines the number of workers that commit docs to Elasticsearch
+ #bulk-workers: 1
+
+ # Enables/disables nodes health checking
+ #healthcheck: true
+
+ # Specifies the interval for checking if the Elasticsearch nodes are available
+ #healthcheck-interval: 10s
+
+ # Specifies the timeout for periodic health checks
+ #healthcheck-timeout: 5s
+
+ # Identifies the user name for the basic HTTP authentication
+ #username:
+
+ # Identifies the password for the basic HTTP authentication
+ #password:
+
+ # Enables the discovery of all Elasticsearch nodes in the cluster. This avoids populating the list
+ # of available Elasticsearch nodes
+ #sniff: false
+
+ # Determines if the Elasticsearch trace log is enabled. Useful for troubleshooting
+ #trace-log: false
+
+ # Specifies if gzip compression is enabled
+ #gzip-compression: false
+
+ # Specifies the name of the index template
+ #template-name: fibratus
+
+ # Represents the target index for kernel events. It allows time specifiers to create indices per time frame.
+ # For example, fibratus-%Y-%m generates the index name with current year and and month time specifiers
+ #index-name: fibratus
+
+ # Contains the full JSON body of the index template. For more information refer to
+ # https://www.elastic.co/guide/en/elasticsearch/reference/current/index-templates.html
+ #template-config:
+
+ # Path to the public/private key file
+ #tls-key:
+
+ # Path to certificate file
+ #tls-cert:
+
+ # Represents the path of the certificate file that is associated with the Certification Authority (CA)
+ #tls-ca:
+
+ # Indicates if the chain and host verification stage is skipped
+ #tls-insecure-skip-verify: false
+
+ # Amqp output emits event batches to RabbitMQ brokers.
+ amqp:
+ # Indicates if the AMQP output is enabled
+ enabled: false
+
+ # Represents the AMQP connection string
+ #url: amqp://localhost:5672
+
+ # Specifies the AMQP connection timeout
+ #timeout: 5s
+
+ # Specifies target exchange name that receives inbound kernel events
+ #exchange: fibratus
+
+ # Represents the AMQP exchange type. Available exchange type include common types are "direct", "fanout",
+ # "topic", "header", and "x-consistent-hash"
+ #exchange-type: topic
+
+ # Represents the static routing key to link exchanges with queues.
+ #routing-key: fibratus
+
+ # Represents the virtual host name
+ #vhost: /
+
+ # Indicates if the exchange is marked as durable. Durable exchanges can survive server restarts
+ #durable: false
+
+ # Indicates if the server checks whether the exchange already exists and raises an error if it doesn't exist
+ #passive: false
+
+ # Determines if a published message is persistent or transient
+ #delivery-mode: transient
+
+ # The username for the plain authentication method
+ #username:
+ # The password for the plain authentication method
+ #password:
+
+ # Designates static headers that are added to each published message
+ #headers:
+ # env: dev
+
+ # Path to the public/private key file
+ #tls-key:
+
+ # Path to certificate file
+ #tls-cert:
+
+ # Represents the path of the certificate file that is associated with the Certification Authority (CA)
+ #tls-ca:
+
+ # Indicates if the chain and host verification stage is skipped
+ #tls-insecure-skip-verify: false
+
+# =============================== Portable Executable (PE) =============================
+
+# Tweaks for controlling the fetching of the PE (Portable Executable) metadata from the process' binary image.
+pe:
+ # Designates whether inspecting PE metadata is allowed.
+ enabled: false
+
+ # Contains a list of image names that are excluded from PE parsing
+ excluded-images:
+ - svchost.exe
+
+ # Determines if resources are read from the PE resource directory
+ #read-resources: false
+
+ # Indicates if symbols are read from the PE headers
+ #read-symbols: false
+
+ # Indicates if full section inspection is allowed. When se to true, section's individual bytes are
+ # consulted for computing section hashes, calculating the entropy, and so on
+ #read-sections: false
+
+# =============================== Transformers =========================================
+
+# Transformers are responsible for augmenting, parsing or enriching kernel events.
+transformers:
+ # Remove transformer deletes provided event parameters.
+ remove:
+ # Indicates if the remove transformer is enabled
+ enabled: false
+
+ # Represents the list of parameters that are removed from the event
+ #kparams:
+ # - irp
+
+ # Rename transformer renames parameter from old to new name.
+ rename:
+ # Indicates if the rename transformer is enabled
+ enabled: false
+
+ # Contains the list of old/new mappings. Old represents the original
+ # parameter name, while new is the new parameter name
+ #kparams:
+ # - old:
+ # new:
+
+ # Replace transformer replaces all non-overlapping instances of old parameter's value with the new one.
+ replace:
+ # Indicates if the replace transformer is enabled
+ enabled: false
+
+ # Contains the list of parameter replacements. For each target event parameter, the old represent the substring
+ # that gets replaced by the new string.
+ #replacements:
+ # - kparam:
+ # old:
+ # new:
+
+ # Tags transformer appends custom key/value pairs to event metadata.
+ tags:
+ # Indicates if the tags transformer is enabled
+ enabled: false
+
+ # Contains the list of tags that are appended to event metadata. Values can be fetched from environment
+ # variables by enclosing them in % symbols
+ #tags:
+ # - key:
+ # value:
+
+ # Trim transformer removes prefixes/suffixes from event parameter values.
+ trim:
+ # # Indicates if the trim transformer is enabled
+ enabled: false
+
+ # Contains the list of parameters associated with the prefix that is trimmed from the parameter's value
+ #prefixes:
+ # - kparam:
+ # trim:
+
+ # Contains the list of parameters associated with the suffix that is trimmed from the parameter's value
+ #suffixes:
+ # - kparam:
+ # trim:
+
+# =============================== YARA =================================================
+
+# Tweaks that influence the behaviour of the YARA scanner.
+yara:
+ # Indicates if the YARA scanner is enabled. When enabled, each newly created process is scanned for pattern matches.
+ enabled: false
+
+ # Contains rule paths and rule definition information
+ rule:
+ # Represents the paths within the file system along with the YARA namespace identifier
+ paths:
+ - path: ""
+ namespace: ""
+
+ # Represents the string with the rule definition along with the YARA namespace identifier
+ strings:
+ - string:
+ namespace:
+
+ # Indicates which sender is used to transport the alert generated by scanner
+ #alert-via: mail
+
+ # Specifies templates for the alert title and text in Go templating language (https://golang.org/pkg/text/template)
+ #alert-template:
+ # title:
+ # text:
+
+ # Determines when multiple matches of the same string can be avoided when not necessary
+ #fastscan: true
+
+ # Specifies the timeout for the scanner. If the timeout is reached, the scan operation is cancelled
+ #scan-timeout: 20s
+
+ # Indicates whether file scanning is disabled. This affects the scan triggered by the image loading events.
+ #skip-files: true
+
+ # Contains the list of file names that shouldn't be scanned
+ #excluded-files:
+ # - kernel32.dll
+
+ # Contains the list of the process' image names that shouldn't be scanned
+ #excluded-procs:
+ # - System
diff --git a/fibratus.spec b/fibratus.spec
deleted file mode 100644
index d9180136b..000000000
--- a/fibratus.spec
+++ /dev/null
@@ -1,30 +0,0 @@
-# -*- mode: python -*-
-
-block_cipher = None
-
-
-a = Analysis(['fibratus\\cli.py'],
- pathex=[],
- binaries=[],
- datas=[('schema.yml', '.')],
- hiddenimports=[],
- hookspath=[],
- runtime_hooks=[],
- excludes=[],
- win_no_prefer_redirects=False,
- win_private_assemblies=False,
- cipher=block_cipher)
-pyz = PYZ(a.pure, a.zipped_data,
- cipher=block_cipher)
-exe = EXE(pyz,
- a.scripts,
- a.binaries + [('msvcp140.dll', 'C:\\Windows\\System32\\msvcp140.dll', 'BINARY'),
- ('vcruntime140.dll', 'C:\\Windows\\System32\\vcruntime140.dll', 'BINARY')],
- a.zipfiles,
- a.datas,
- name='fibratus',
- debug=False,
- strip=False,
- upx=True,
- console=True,
- icon=None)
diff --git a/fibratus.yml b/fibratus.yml
deleted file mode 100644
index f6dc466a7..000000000
--- a/fibratus.yml
+++ /dev/null
@@ -1,55 +0,0 @@
-image_meta:
- enabled: false
- imports: false
- file_info: false
-
-skips:
- images:
- - svchost.exe
- - smss.exe
- - services.exe
- - taskmgr.exe
- - dwm.exe
- - vprot.exe
- - lsass.exe
- - sihost.exe
- - system
-
-output:
- - console:
- format: pretty
-# - amqp:
-# host: 127.0.0.1
-# port: 5672
-# username: guest
-# password: guest
-# vhost: /
-# exchange: amq.direct
-# routingkey: fibratus
-# - smtp:
-# host: smtp.gmail.com
-# port: 587
-# from: info@github.io
-# password: secret
-# to:
-# - fibratus@github.io
-# - netmutatus@github.io
-# - elasticsearch:
-# hosts:
-# - localhost:9200
-# index: kernelstream
-# index_type: daily
-# daily_index_format: %Y.%m.%d
-# document: threads
-# bulk: False
-# username: elastic
-# password: changeme
-# ssl: True
-# - fs:
-# path: D:\\
-# mode: a
-# format: json
-
-#binding:
-# - yara:
-# path: D:\yara-rules
diff --git a/fibratus/__init__.py b/fibratus/__init__.py
deleted file mode 100644
index 1a28ab226..000000000
--- a/fibratus/__init__.py
+++ /dev/null
@@ -1,15 +0,0 @@
-# Copyright 2015 by Nedim Sabic (RabbitStack)
-# All Rights Reserved.
-# http://rabbitstack.github.io
-
-# Licensed under the Apache License, Version 2.0 (the "License"); you may
-# not use this file except in compliance with the License. You may obtain
-# a copy of the License at
-#
-# http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
-# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
-# License for the specific language governing permissions and limitations
-# under the License.
diff --git a/fibratus/apidefs/__init__.py b/fibratus/apidefs/__init__.py
deleted file mode 100644
index 23b74303e..000000000
--- a/fibratus/apidefs/__init__.py
+++ /dev/null
@@ -1,14 +0,0 @@
-# Copyright 2015 by Nedim Sabic (RabbitStack)
-# All Rights Reserved.
-#
-# Licensed under the Apache License, Version 2.0 (the "License"); you may
-# not use this file except in compliance with the License. You may obtain
-# a copy of the License at
-#
-# http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
-# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
-# License for the specific language governing permissions and limitations
-# under the License.
\ No newline at end of file
diff --git a/fibratus/apidefs/cdefs.py b/fibratus/apidefs/cdefs.py
deleted file mode 100644
index 79f3cc230..000000000
--- a/fibratus/apidefs/cdefs.py
+++ /dev/null
@@ -1,74 +0,0 @@
-# Copyright 2015 by Nedim Sabic (RabbitStack)
-# All Rights Reserved.
-# http://rabbitstack.github.io
-
-# Licensed under the Apache License, Version 2.0 (the "License"); you may
-# not use this file except in compliance with the License. You may obtain
-# a copy of the License at
-#
-# http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
-# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
-# License for the specific language governing permissions and limitations
-# under the License.
-from ctypes import Structure
-from ctypes import c_void_p, c_ubyte, c_ushort, c_ulong, c_size_t, c_wchar_p
-import re
-import ctypes
-
-# undefined ctypes wintypes
-LPVOID = c_void_p
-PVOID = c_void_p
-UCHAR = c_ubyte
-SIZE_T = c_size_t
-LPTSTR = c_wchar_p
-
-# status codes
-STATUS_INFO_LENGTH_MISMATCH = 0xc0000004
-STATUS_SUCCESS = 0
-
-# error codes
-ERROR_SUCCESS = 0x0
-ERROR_ACCESS_DENIED = 0x5
-ERROR_BAD_LENGTH = 0x18
-ERROR_INVALID_PARAMETER = 0x57
-ERROR_ALREADY_EXISTS = 0xB7
-
-
-def get_last_error():
- return ctypes.GetLastError()
-
-
-class UNICODE_STRING(Structure):
- _fields_ = [('length', c_ushort),
- ('maximum_length', c_ushort),
- ('buffer', c_void_p)]
-
-
-class GUID(Structure):
- _fields_ = [("Data1", c_ulong),
- ("Data2", c_ushort),
- ("Data3", c_ushort),
- ("Data4", c_ubyte * 8)]
- _GUID_REGEX = re.compile('{([0-9A-F]{8})-([0-9A-F]{4})-([0-9A-F]{4})-([0-9A-F]{2})([0-9A-F]{2})-'
- '([0-9A-F]{2})([0-9A-F]{2})([0-9A-F]{2})'
- '([0-9A-F]{2})([0-9A-F]{2})([0-9A-F]{2})}', re.I)
-
- def __init__(self, gs=None):
- if gs:
- match = self._GUID_REGEX.match(gs)
- g = [int(i, 16) for i in match.groups()]
- self.Data1 = g[0]
- self.Data2 = g[1]
- self.Data3 = g[2]
- for i in range(8):
- self.Data4[i] = g[3 + i]
-
- def __str__(self):
- return "{%08x-%04x-%04x-%02x%02x-%02x%02x%02x%02x%02x%02x}" % \
- (self.Data1, self.Data2, self.Data3,
- self.Data4[0], self.Data4[1],
- self.Data4[2], self.Data4[3], self.Data4[4],
- self.Data4[5], self.Data4[6], self.Data4[7])
diff --git a/fibratus/apidefs/declarer.py b/fibratus/apidefs/declarer.py
deleted file mode 100644
index d6ed2bc54..000000000
--- a/fibratus/apidefs/declarer.py
+++ /dev/null
@@ -1,43 +0,0 @@
-# Copyright 2016 by Nedim Sabic (RabbitStack)
-# All Rights Reserved.
-#
-# Licensed under the Apache License, Version 2.0 (the "License"); you may
-# not use this file except in compliance with the License. You may obtain
-# a copy of the License at
-#
-# http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
-# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
-# License for the specific language governing permissions and limitations
-# under the License.
-
-from ctypes import windll, CDLL
-
-
-ADVAPI = 0
-KERNEL = 1
-NT = 2
-C = 3
-USER = 4
-
-__LIBS__ = {ADVAPI: windll.advapi32,
- KERNEL: windll.kernel32,
- NT: windll.ntdll,
- C: CDLL('msvcrt'),
- USER: windll.user32}
-
-
-def declare(lib_name, function_name, args, restype):
- if lib_name in __LIBS__:
- lib = __LIBS__[lib_name]
- function = getattr(lib, function_name)
- if function:
- if len(args) > 0:
- function.argtypes = args
- if restype:
- function.restype = restype
- return function
- else:
- raise AttributeError('The library %s cannot be loaded' % lib_name)
\ No newline at end of file
diff --git a/fibratus/apidefs/etw.py b/fibratus/apidefs/etw.py
deleted file mode 100644
index bd193293d..000000000
--- a/fibratus/apidefs/etw.py
+++ /dev/null
@@ -1,143 +0,0 @@
-# Copyright 2015 by Nedim Sabic (RabbitStack)
-# All Rights Reserved.
-#
-# Licensed under the Apache License, Version 2.0 (the "License"); you may
-# not use this file except in compliance with the License. You may obtain
-# a copy of the License at
-#
-# http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
-# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
-# License for the specific language governing permissions and limitations
-# under the License.
-from ctypes import Structure, POINTER
-from ctypes import c_uint64, c_ulong, c_long, c_ulonglong, c_wchar_p, c_ubyte
-from ctypes.wintypes import LARGE_INTEGER, HANDLE
-
-from fibratus.apidefs.guiddef import GUID
-import fibratus.apidefs.declarer as declarer
-
-
-TRACEHANDLE = c_uint64
-
-WNODE_FLAG_TRACED_GUID = 0x00020000
-PROCESS_TRACE_MODE_REAL_TIME = 0x00000100
-
-
-KERNEL_TRACE_CONTROL_GUID = GUID('{9e814aad-3204-11d2-9a82-006008a86939}')
-KERNEL_LOGGER_NAME = "NT Kernel Logger"
-
-
-# enable flags for kernel events
-EVENT_TRACE_FLAG_PROCESS = 0x00000001
-EVENT_TRACE_FLAG_THREAD = 0x00000002
-EVENT_TRACE_FLAG_IMAGE_LOAD = 0x00000004
-
-EVENT_TRACE_FLAG_DISK_IO = 0x00000100
-EVENT_TRACE_FLAG_DISK_FILE_IO = 0x00000200
-
-EVENT_TRACE_FLAG_MEMORY_PAGE_FAULTS = 0x00001000
-EVENT_TRACE_FLAG_MEMORY_HARD_FAULTS = 0x00002000
-
-EVENT_TRACE_FLAG_NETWORK_TCPIP = 0x00010000
-
-EVENT_TRACE_FLAG_REGISTRY = 0x00020000
-EVENT_TRACE_FLAG_DBGPRINT = 0x00040000
-
-EVENT_TRACE_FLAG_PROCESS_COUNTERS = 0x00000008
-EVENT_TRACE_FLAG_CSWITCH = 0x00000010
-EVENT_TRACE_FLAG_DPC = 0x00000020
-EVENT_TRACE_FLAG_INTERRUPT = 0x00000040
-EVENT_TRACE_FLAG_SYSTEMCALL = 0x00000080
-
-EVENT_TRACE_FLAG_DISK_IO_INIT = 0x00000400
-
-EVENT_TRACE_FLAG_ALPC = 0x00100000
-EVENT_TRACE_FLAG_SPLIT_IO = 0x00200000
-
-EVENT_TRACE_FLAG_DRIVER = 0x00800000
-EVENT_TRACE_FLAG_PROFILE = 0x01000000
-EVENT_TRACE_FLAG_FILE_IO = 0x02000000
-EVENT_TRACE_FLAG_FILE_IO_INIT = 0x04000000
-
-
-EVENT_TRACE_FLAG_DISPATCHER = 0x00000800
-EVENT_TRACE_FLAG_VIRTUAL_ALLOC = 0x00004000
-
-
-EVENT_TRACE_CONTROL_QUERY = 0
-EVENT_TRACE_CONTROL_STOP = 1
-EVENT_TRACE_CONTROL_UPDATE = 2
-
-
-EVENT_CONTROL_CODE_DISABLE_PROVIDER = 0
-EVENT_CONTROL_CODE_ENABLE_PROVIDER = 1
-EVENT_CONTROL_CODE_CAPTURE_STATE = 2
-
-
-class WNODE_HEADER(Structure):
- _fields_ = [('buffer_size', c_ulong),
- ('provider_id', c_ulong),
- ('historical_context', c_uint64),
- ('timestamp', LARGE_INTEGER),
- ('guid', GUID),
- ('client_context', c_ulong),
- ('flags', c_ulong)]
-
-
-class EVENT_TRACE_PROPERTIES(Structure):
- _fields_ = [('wnode', WNODE_HEADER),
- ('buffer_size', c_ulong),
- ('minimum_buffers', c_ulong),
- ('maximum_buffers', c_ulong),
- ('maximum_file_size', c_ulong),
- ('log_file_mode', c_ulong),
- ('flush_timer', c_ulong),
- ('enable_flags', c_ulong),
- ('age_limit', c_long),
- ('number_of_buffers', c_ulong),
- ('free_buffers', c_ulong),
- ('events_lost', c_ulong),
- ('buffers_written', c_ulong),
- ('log_buffers_lost', c_ulong),
- ('real_time_buffer_lost', c_ulong),
- ('logger_thread_id', HANDLE),
- ('log_file_name_offset', c_ulong),
- ('logger_name_offset', c_ulong)]
-
-
-class TRACE_GUID_REGISTRATION(Structure):
- _fields_ = [('guid', POINTER(GUID)),
- ('reg_handle', HANDLE)]
-
-
-class EVENT_FILTER_DESCRIPTOR(Structure):
- _fields_ = [('Ptr', c_ulonglong),
- ('Size', c_ulong),
- ('Type', c_ulong)]
-
-
-class ENABLE_TRACE_PARAMETERS(Structure):
- _fields_ = [('Version', c_ulong),
- ('EnableProperty', c_ulong),
- ('ControlFlags', c_ulong),
- ('SourceId', GUID),
- ('EnableFilterDesc', POINTER(EVENT_FILTER_DESCRIPTOR)),
- ('FilterDescCount', c_ulong)]
-
-
-start_trace = declarer.declare(declarer.ADVAPI, 'StartTraceW',
- [POINTER(TRACEHANDLE), c_wchar_p, POINTER(EVENT_TRACE_PROPERTIES)],
- c_ulong)
-
-
-control_trace = declarer.declare(declarer.ADVAPI, 'ControlTraceW',
- [TRACEHANDLE, c_wchar_p, POINTER(EVENT_TRACE_PROPERTIES), c_ulong],
- c_ulong)
-
-enable_trace_ex = declarer.declare(declarer.ADVAPI, 'EnableTraceEx2',
- [TRACEHANDLE, POINTER(GUID), c_ulong, c_ubyte, c_ulonglong,
- c_ulonglong, c_ulong, POINTER(ENABLE_TRACE_PARAMETERS)],
- c_ulong)
\ No newline at end of file
diff --git a/fibratus/apidefs/fs.py b/fibratus/apidefs/fs.py
deleted file mode 100644
index bdce04440..000000000
--- a/fibratus/apidefs/fs.py
+++ /dev/null
@@ -1,66 +0,0 @@
-# Copyright 2015 by Nedim Sabic (RabbitStack)
-# All Rights Reserved.
-# http://rabbitstack.github.io
-
-# Licensed under the Apache License, Version 2.0 (the "License"); you may
-# not use this file except in compliance with the License. You may obtain
-# a copy of the License at
-#
-# http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
-# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
-# License for the specific language governing permissions and limitations
-# under the License.
-from ctypes import Structure
-from ctypes.wintypes import HANDLE, DWORD, BOOL, WCHAR, LONG
-
-import fibratus.apidefs.declarer as declarer
-from fibratus.apidefs.cdefs import LPVOID, LPTSTR
-
-
-FILE_SHARE_READ = 0x00000001
-FILE_SHARE_WRITE = 0x00000002
-FILE_SHARE_DELETE = 0x00000004
-
-# if the file already exists, replace it with the given file. If it does not, create the given file.
-FILE_SUPERSEDE = 0x00000000
-# if the file already exists, open it instead of creating a new file.
-# If it does not, fail the request and do not create a new file.
-FILE_OPEN = 0x00000001
-# if the file already exists, fail the request and do not create or open the given file.
-# If it does not, create the given file.
-FILE_CREATE = 0x00000002
-# If the file already exists, open it. If it does not, create the given file.
-FILE_OPEN_IF = 0x00000003
-# If the file already exists, open it and overwrite it. If it does not, fail the request.
-FILE_OVERWRITE = 0x00000004
-# If the file already exists, open it and overwrite it. If it does not, create the given file.
-FILE_OVERWRITE_IF = 0x00000005
-
-# the file being created or opened is a directory file
-FILE_DIRECTORY_FILE = 0x00000001
-# open a file with a reparse point and bypass normal reparse point processing for the file
-FILE_OPEN_REPARSE_POINT = 0x00200000
-
-
-class FILE_NAME_INFO(Structure):
- _fields_ = [('file_name_length', DWORD),
- ('filename', WCHAR * 1)]
-
-
-get_file_info_by_handle = declarer.declare(declarer.KERNEL, 'GetFileInformationByHandleEx',
- [HANDLE, DWORD, LPVOID, DWORD],
- BOOL)
-query_dos_device = declarer.declare(declarer.KERNEL, 'QueryDosDeviceW',
- [LPTSTR, LPTSTR, DWORD],
- DWORD)
-
-_get_osfhandle = declarer.declare(declarer.C, '_get_osfhandle',
- [DWORD],
- LONG)
-
-get_file_type = declarer.declare(declarer.KERNEL, 'GetFileType',
- [HANDLE],
- DWORD)
\ No newline at end of file
diff --git a/fibratus/apidefs/guiddef.py b/fibratus/apidefs/guiddef.py
deleted file mode 100644
index a383f78f8..000000000
--- a/fibratus/apidefs/guiddef.py
+++ /dev/null
@@ -1,44 +0,0 @@
-# Copyright 2015 by Nedim Sabic (RabbitStack)
-# All Rights Reserved.
-#
-# Licensed under the Apache License, Version 2.0 (the "License"); you may
-# not use this file except in compliance with the License. You may obtain
-# a copy of the License at
-#
-# http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
-# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
-# License for the specific language governing permissions and limitations
-# under the License.
-import ctypes
-import re
-
-
-class GUID(ctypes.Structure):
- _DECOMPOSE_RE = re.compile('{([0-9A-F]{8})-([0-9A-F]{4})-([0-9A-F]{4})-([0-9A-F]{2})([0-9A-F]{2})-'
- '([0-9A-F]{2})([0-9A-F]{2})([0-9A-F]{2})'
- '([0-9A-F]{2})([0-9A-F]{2})([0-9A-F]{2})}', re.I)
-
- def __init__(self, guid_as_str=None):
- if guid_as_str:
- m = self._DECOMPOSE_RE.match(guid_as_str)
- g = [int(i, 16) for i in m.groups()]
- self.Data1 = g[0]
- self.Data2 = g[1]
- self.Data3 = g[2]
- for i in range(8):
- self.Data4[i] = g[3 + i]
-
- _fields_ = [("Data1", ctypes.c_ulong),
- ("Data2", ctypes.c_ushort),
- ("Data3", ctypes.c_ushort),
- ("Data4", ctypes.c_ubyte * 8)]
-
- def __str__(self):
- return "{%08x-%04x-%04x-%02x%02x-%02x%02x%02x%02x%02x%02x}" % \
- (self.Data1, self.Data2, self.Data3,
- self.Data4[0], self.Data4[1],
- self.Data4[2], self.Data4[3], self.Data4[4],
- self.Data4[5], self.Data4[6], self.Data4[7])
diff --git a/fibratus/apidefs/process.py b/fibratus/apidefs/process.py
deleted file mode 100644
index d02e01fe4..000000000
--- a/fibratus/apidefs/process.py
+++ /dev/null
@@ -1,115 +0,0 @@
-# Copyright 2015 by Nedim Sabic (RabbitStack)
-# All Rights Reserved.
-# http://rabbitstack.github.io
-
-# Licensed under the Apache License, Version 2.0 (the "License"); you may
-# not use this file except in compliance with the License. You may obtain
-# a copy of the License at
-#
-# http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
-# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
-# License for the specific language governing permissions and limitations
-# under the License.
-from ctypes import POINTER
-from ctypes.wintypes import DWORD, BOOL, HANDLE, ULONG, PULONG, BYTE, PDWORD
-
-from fibratus.apidefs.cdefs import *
-from fibratus.apidefs.sys import malloc, free
-import fibratus.apidefs.declarer as declarer
-
-
-# process access rights
-PROCESS_VM_READ = 0x0010
-PROCESS_DUP_HANDLE = 0x0040
-PROCESS_QUERY_INFORMATION = 0x0400
-PROCESS_QUERY_LIMITED_INFORMATION = 0x1000
-
-# thread access rights
-THREAD_QUERY_INFORMATION = 0x0040
-
-# ZwQueryInformationProcess constants
-PROCESS_BASIC_INFO = 0
-PROCESS_IMAGE_FILENAME = 27
-
-
-# PEB (Process Environment Block) structures
-class LIST_ENTRY(Structure):
- pass
-LIST_ENTRY._fields_ = [('flink', POINTER(LIST_ENTRY)), ('blink', POINTER(LIST_ENTRY))]
-
-
-class PEB_LDR_DATA(Structure):
- _fields_ = [('reserved1', BYTE * 8),
- ('reserved2', BYTE * 3),
- ('in_memory_order_module_list', LIST_ENTRY)]
-
-
-class RTL_USER_PROCESS_PARAMETERS(Structure):
- _fields_ = [('reserved1', BYTE * 16),
- ('reserved2', PVOID * 10),
- ('image_path_name', UNICODE_STRING),
- ('command_line', UNICODE_STRING)]
-
-
-class PEB(Structure):
- _fields_ = [('reserved1', BYTE * 2),
- ('being_debugged', BYTE),
- ('reserved2', BYTE * 21),
- ('ldr', POINTER(PEB_LDR_DATA)),
- ('process_parameters', POINTER(RTL_USER_PROCESS_PARAMETERS)),
- ('reserved3', BYTE * 520),
- ('post_process_init_routine', PVOID),
- ('reserved4', BYTE * 136),
- ('session_id', ULONG)]
-
-
-class PROCESS_BASIC_INFORMATION(Structure):
- _fields_ = [('reserved1', PVOID),
- ('peb_base_address', POINTER(PEB)),
- ('reserved2', PVOID * 2),
- ('unique_process_id', PULONG),
- ('inherited_from_unique_process_id', ULONG)]
-
-open_process = declarer.declare(declarer.KERNEL, 'OpenProcess',
- [DWORD, BOOL, DWORD],
- HANDLE)
-
-open_thread = declarer.declare(declarer.KERNEL, 'OpenThread',
- [DWORD, BOOL, DWORD],
- HANDLE)
-
-_read_process_memory = declarer.declare(declarer.KERNEL, 'ReadProcessMemory',
- [HANDLE, LPVOID, LPVOID, SIZE_T, POINTER(SIZE_T)],
- BOOL)
-
-zw_query_information_process = declarer.declare(declarer.NT, 'ZwQueryInformationProcess',
- [HANDLE, DWORD, PVOID, ULONG, PULONG],
- DWORD)
-query_full_process_image_name = declarer.declare(declarer.KERNEL, 'QueryFullProcessImageNameW',
- [HANDLE, DWORD, LPTSTR, PDWORD],
- BOOL)
-
-get_current_process = declarer.declare(declarer.KERNEL, 'GetCurrentProcess',
- [],
- HANDLE)
-get_process_id_of_thread = declarer.declare(declarer.KERNEL, 'GetProcessIdOfThread',
- [HANDLE],
- DWORD)
-
-
-def read_process_memory(process, chunk, size):
- """Reads a memory block from the process address space.
- """
- buff = malloc(size)
- status = _read_process_memory(process,
- chunk,
- buff,
- size,
- None)
- if status != ERROR_SUCCESS:
- return buff
- else:
- free(buff)
diff --git a/fibratus/apidefs/registry.py b/fibratus/apidefs/registry.py
deleted file mode 100644
index c253b419f..000000000
--- a/fibratus/apidefs/registry.py
+++ /dev/null
@@ -1,51 +0,0 @@
-# Copyright 2015 by Nedim Sabic (RabbitStack)
-# All Rights Reserved.
-# http://rabbitstack.github.io
-
-# Licensed under the Apache License, Version 2.0 (the "License"); you may
-# not use this file except in compliance with the License. You may obtain
-# a copy of the License at
-#
-# http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
-# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
-# License for the specific language governing permissions and limitations
-# under the License.
-from ctypes.wintypes import HKEY, DWORD, LPDWORD, LONG, LPCWSTR
-from enum import Enum
-
-from fibratus.apidefs.cdefs import *
-import fibratus.apidefs.declarer as declarer
-
-
-# query type flags
-RRF_RT_ANY = 0x0000ffff
-
-# reserved key handles
-HKEY_CLASSES_ROOT = HKEY(0x80000000)
-HKEY_CURRENT_USER = HKEY(0x80000001)
-HKEY_LOCAL_MACHINE = HKEY(0x80000002)
-HKEY_USERS = HKEY(0x80000003)
-
-MAX_BUFFER_SIZE = 4096
-reg_get_value = declarer.declare(declarer.ADVAPI, 'RegGetValueW',
- [HKEY, LPCWSTR, LPCWSTR,
- DWORD, LPDWORD, PVOID, LPDWORD],
- LONG)
-
-
-class ValueType(Enum):
- REG_NONE = 0
- REG_SZ = 1
- REG_EXPAND_SZ = 2
- REG_BINARY = 3
- REG_DWORD = 4
- REG_DWORD_BIG_ENDIAN = 5
- REG_LINK = 6
- REG_MULTI_SZ = 7
- REG_RESOURCE_LIST = 8
- REG_FULL_RESOURCE_DESCRIPTOR = 9
- REG_RESOURCE_REQUIREMENTS_LIST = 10
- REG_QWORD = 11
diff --git a/fibratus/apidefs/sys.py b/fibratus/apidefs/sys.py
deleted file mode 100644
index 3686ee21a..000000000
--- a/fibratus/apidefs/sys.py
+++ /dev/null
@@ -1,157 +0,0 @@
-# Copyright 2015 by Nedim Sabic (RabbitStack)
-# All Rights Reserved.
-# http://rabbitstack.github.io
-
-# Licensed under the Apache License, Version 2.0 (the "License"); you may
-# not use this file except in compliance with the License. You may obtain
-# a copy of the License at
-#
-# http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
-# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
-# License for the specific language governing permissions and limitations
-# under the License.
-from ctypes import POINTER
-from ctypes import c_int, c_byte, WINFUNCTYPE
-from ctypes.wintypes import DWORD, ULONG, PULONG, USHORT, HANDLE, BOOL, SHORT, WCHAR, CHAR, WORD, LPDWORD
-
-from fibratus.apidefs.cdefs import *
-import fibratus.apidefs.declarer as declarer
-
-
-SYSTEM_HANDLE_INFORMATION_CLASS = 16
-
-PUBLIC_OBJECT_BASIC_INFORMATION = 0
-PUBLIC_OBJECT_NAME_INFORMATION = 1
-PUBLIC_OBJECT_TYPE_INFORMATION = 2
-
-# this constants may vary from
-# one Windows version to another
-# for Win 7/8 they should have
-# the following values
-FILE_OBJECT_TYPE_INDEX = 28
-
-
-STD_OUTPUT_HANDLE = -11
-INVALID_HANDLE_VALUE = -1
-
-CONSOLE_TEXTMODE_BUFFER = 1
-
-GENERIC_READ = 0x80000000
-GENERIC_WRITE = 0x40000000
-
-FILE_SHARE_READ = 0x00000001
-FILE_SHARE_WRITE = 0x00000002
-
-
-# console structures
-class CURSOR_INFO(ctypes.Structure):
- _fields_ = [("size", c_int),
- ("visible", c_byte)]
-
-
-class COORD(ctypes.Structure):
- _fields_ = [("x", SHORT), ("y", SHORT)]
-
-
-class SMALL_RECT(ctypes.Structure):
- _fields_ = [("left", SHORT),
- ("top", SHORT),
- ("right", SHORT),
- ("bottom", SHORT)]
-
-
-class CHAR_INFOU(ctypes.Union):
- _fields_ = [("unicode_char", WCHAR), ("ascii_char", CHAR)]
-
-
-class CHAR_INFO(ctypes.Structure):
- _anonymous_ = ("char",)
- _fields_ = [("char", CHAR_INFOU), ("attributes", WORD)]
-
-
-class CONSOLE_SCREEN_BUFFER_INFO(ctypes.Structure):
- _fields_ = [('size', COORD),
- ('cursor_position', COORD),
- ('attributes', WORD),
- ('window', SMALL_RECT),
- ('maximum_window_size', COORD)]
-
-
-class SYSTEM_HANDLE(Structure):
- _fields_ = [('process_id', ULONG),
- ('object_type_number', UCHAR),
- ('flags', UCHAR),
- ('handle', USHORT),
- ('object', PVOID),
- ('access_mask', DWORD)]
-
-
-class SYSTEM_HANDLE_INFORMATION(Structure):
- _fields_ = [('number_of_handles', ULONG),
- ('handles', SYSTEM_HANDLE * 1)]
-
-
-class OBJECT_TYPE_INFORMATION(Structure):
- _fields_ = [('type_name', UNICODE_STRING),
- ('reserved', ULONG * 22)]
-
-
-# retrieves the specified system information
-zw_query_system_information = declarer.declare(declarer.NT, 'ZwQuerySystemInformation',
- [DWORD, PVOID, ULONG, PULONG],
- DWORD)
-
-# memory alloc/free functions
-malloc = declarer.declare(declarer.C, 'malloc', [c_size_t], c_void_p)
-realloc = declarer.declare(declarer.C, 'realloc', [c_void_p, c_size_t], c_void_p)
-free = declarer.declare(declarer.C, 'free', [c_void_p], None)
-
-# object handle cleanup
-close_handle = declarer.declare(declarer.KERNEL, 'CloseHandle', [HANDLE], BOOL)
-# duplicate object handle
-duplicate_handle = declarer.declare(declarer.KERNEL, 'DuplicateHandle',
- [HANDLE, HANDLE, HANDLE, POINTER(HANDLE), DWORD, ULONG, ULONG],
- DWORD)
-
-# query object name / type
-nt_query_object = declarer.declare(declarer.NT, 'NtQueryObject',
- [HANDLE, ULONG, PVOID, ULONG, PULONG],
- DWORD)
-
-# low level console api
-get_std_handle = declarer.declare(declarer.KERNEL, 'GetStdHandle', [DWORD], HANDLE)
-set_console_active_screen_buffer = declarer.declare(declarer.KERNEL, 'SetConsoleActiveScreenBuffer', [HANDLE], BOOL)
-
-create_console_screen_buffer = declarer.declare(declarer.KERNEL, 'CreateConsoleScreenBuffer',
- [DWORD, DWORD, c_void_p, DWORD, LPVOID], HANDLE)
-get_console_screen_buffer_info = declarer.declare(declarer.KERNEL, 'GetConsoleScreenBufferInfo',
- [HANDLE, POINTER(CONSOLE_SCREEN_BUFFER_INFO)], BOOL)
-
-write_console_output = declarer.declare(declarer.KERNEL, 'WriteConsoleOutputW',
- [HANDLE, POINTER(CHAR_INFO), COORD, COORD, POINTER(SMALL_RECT)], BOOL)
-
-set_console_cursor_position = declarer.declare(declarer.KERNEL, 'SetConsoleCursorPosition',
- [HANDLE, COORD], BOOL)
-
-get_console_cursor_info = declarer.declare(declarer.KERNEL, 'GetConsoleCursorInfo',
- [HANDLE, POINTER(CURSOR_INFO)], BOOL)
-
-set_console_cursor_info = declarer.declare(declarer.KERNEL, 'SetConsoleCursorInfo',
- [HANDLE, POINTER(CURSOR_INFO)], BOOL)
-
-write_console_unicode = declarer.declare(declarer.KERNEL, 'WriteConsoleW',
- [HANDLE, c_void_p, DWORD, LPDWORD, LPVOID], BOOL)
-
-
-PHANDLER_ROUTINE = WINFUNCTYPE(BOOL, DWORD)
-set_console_ctrl_handler = declarer.declare(declarer.KERNEL, 'SetConsoleCtrlHandler',
- [PHANDLER_ROUTINE, BOOL], BOOL)
-
-
-# event objects
-create_event = declarer.declare(declarer.KERNEL, 'CreateEventW', [c_void_p, BOOL, BOOL, LPTSTR], HANDLE)
-
-
diff --git a/fibratus/binding/__init__.py b/fibratus/binding/__init__.py
deleted file mode 100644
index d7ce39087..000000000
--- a/fibratus/binding/__init__.py
+++ /dev/null
@@ -1,14 +0,0 @@
-# Copyright 2017 by Nedim Sabic (RabbitStack)
-# All Rights Reserved.
-#
-# Licensed under the Apache License, Version 2.0 (the "License"); you may
-# not use this file except in compliance with the License. You may obtain
-# a copy of the License at
-#
-# http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
-# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
-# License for the specific language governing permissions and limitations
-# under the License.
\ No newline at end of file
diff --git a/fibratus/binding/base.py b/fibratus/binding/base.py
deleted file mode 100644
index f4a8913cf..000000000
--- a/fibratus/binding/base.py
+++ /dev/null
@@ -1,24 +0,0 @@
-# Copyright 2017 by Nedim Sabic (RabbitStack)
-# All Rights Reserved.
-#
-# Licensed under the Apache License, Version 2.0 (the "License"); you may
-# not use this file except in compliance with the License. You may obtain
-# a copy of the License at
-#
-# http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
-# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
-# License for the specific language governing permissions and limitations
-# under the License.
-
-
-class BaseBinding(object):
-
- def __init__(self, outputs, logger):
- self.outputs = outputs
- self.logger = logger
-
- def run(self, **kwargs):
- raise NotImplementedError()
diff --git a/fibratus/binding/yar.py b/fibratus/binding/yar.py
deleted file mode 100644
index 57db325e6..000000000
--- a/fibratus/binding/yar.py
+++ /dev/null
@@ -1,94 +0,0 @@
-# Copyright 2017 by Nedim Sabic (RabbitStack)
-# All Rights Reserved.
-#
-# Licensed under the Apache License, Version 2.0 (the "License"); you may
-# not use this file except in compliance with the License. You may obtain
-# a copy of the License at
-#
-# http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
-# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
-# License for the specific language governing permissions and limitations
-# under the License.
-
-from fibratus.binding.base import BaseBinding
-from fibratus.errors import BindingError
-
-import os
-import glob
-
-try:
- import yara
-except ImportError:
- yara = None
-
-
-class YaraBinding(BaseBinding):
-
- def __init__(self, outputs, logger, **config):
- """Creates an instance of the YARA binding.
-
- This binding integrates with YARA tool to provide real time classification and pattern matching of the
- process's binary images. The image path is extracted from the `ThreadInfo` instance after `CreateProcess`
- kernel event has been captured.
-
- :param dict outputs: declared output adapters
- :param logbook.Logger logger: reference to the logger implementation
- :param dict config: configuration for this binding
- """
-
- BaseBinding.__init__(self, outputs, logger)
- self._path = config.pop('path', None)
- self._rules = None
- if not yara:
- raise BindingError('yara-python package is not installed')
- if not os.path.exists(self._path) or not os.path.isdir(self._path):
- raise BindingError('%s rules path does not exist' %
- self._path)
- try:
- for file in glob.glob(os.path.join(self._path, '*.yar')):
- self._rules = yara.compile(os.path.join(self._path, file))
- except yara.SyntaxError as e:
- raise BindingError("rule compilation error %s" % e)
-
- def run(self, **kwargs):
- """Apply the YARA rule set to process's image path.
-
- If a rule match occurs, the data with rule information, matching strings, process name, etc. is transported
- over provided output implementation. If output type is not specified, the console output stream is used.
-
- :param dict kwargs: parameters for the binding context
- """
- thread_info = kwargs.pop('thread_info', None)
- kevent = kwargs.pop('kevent', None)
- if thread_info:
- def yara_callback(data):
- matches = data['matches']
- if matches:
- rule_context = {
- 'rule_info': {
- 'meta': data['meta'],
- 'tags': data['tags'],
- 'namespace': data['namespace'],
- 'rule': data['rule'],
- 'strings': [self.__string_meta(string) for string in data['strings']]
- }
- }
- kevent.params.update(rule_context)
- return yara.CALLBACK_CONTINUE
- self._rules.match(thread_info.exe, callback=yara_callback)
-
- def __string_meta(self, string):
- """Unpacks the tuple with matching string data and transforms it to a dictionary.
-
- :param tuple string: the tuple with matching string data
- :return: dict:
- """
- offset, ident, data = string
- return {
- 'offset': offset,
- 'identifier': ident,
- 'data': data.decode('utf-8')
- }
diff --git a/fibratus/cli.py b/fibratus/cli.py
deleted file mode 100644
index 07a4cd373..000000000
--- a/fibratus/cli.py
+++ /dev/null
@@ -1,135 +0,0 @@
-# Copyright 2015 by Nedim Sabic (RabbitStack)
-# All Rights Reserved.
-# http://rabbitstack.github.io
-
-# Licensed under the Apache License, Version 2.0 (the "License"); you may
-# not use this file except in compliance with the License. You may obtain
-# a copy of the License at
-#
-# http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
-# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
-# License for the specific language governing permissions and limitations
-# under the License.
-
-"""
-Usage:
- fibratus run ([--filament=] | [--filters ...])
- [--pid= | --image=] [--no-enum-handles] [--cswitch]
- fibratus list-kevents
- fibratus list-filaments
- fibratus -h | --help
- fibratus --version
-
-Options:
- -h --help Show this screen.
- --filament= Specify the filament to execute.
- --no-enum-handles Avoids enumerating the system handles.
- --pid= Spy on a specific process identifier.
- --image= Spy on a specific image name.
- --cswitch Enables context switch kernel events.
- --version Show version.
-"""
-import sys
-
-from docopt import docopt
-
-from fibratus.apidefs.sys import set_console_ctrl_handler, PHANDLER_ROUTINE
-from fibratus.errors import FilamentError
-from fibratus.entrypoint import Fibratus
-from fibratus.filament import Filament
-from fibratus.kevent import KEvents
-from fibratus.version import VERSION
-from fibratus.common import panic, Tabular
-
-args = docopt(__doc__, version=VERSION)
-
-kevent_filters = args['']
-filament_name = args['--filament'] if args['--filament'] else None
-
-
-def _check_kevent(kevent):
- if kevent not in KEvents.all():
- panic('fibratus run: ERROR - %s is not a valid kernel event. Run list-kevents to see '
- 'the available kernel events' % kevent)
-
-
-def main():
- if args['run']:
- if len(kevent_filters) > 0 and not filament_name:
- for kfilter in kevent_filters:
- _check_kevent(kfilter)
-
- enum_handles = False if args['--no-enum-handles'] else True
- cswitch = True if args['--cswitch'] else False
-
- filament = None
- filament_filters = []
-
- if filament_name:
- if not Filament.exists(filament_name):
- panic('fibratus run: ERROR - %s filament does not exist. Run list-filaments to see '
- 'the available filaments' % filament_name)
- filament = Filament()
- try:
- filament.load_filament(filament_name)
- except FilamentError as e:
- panic('fibratus run: ERROR - %s' % e)
-
- filament_filters = filament.filters
-
- if len(filament_filters) > 0:
- for kfilter in filament_filters:
- _check_kevent(kfilter)
-
- filament.render_tabular()
-
- try:
- fibratus = Fibratus(filament, enum_handles=enum_handles, cswitch=cswitch)
- except KeyboardInterrupt:
- # the user has stopped command execution
- # before opening the kernel event stream
- sys.exit(0)
-
- @PHANDLER_ROUTINE
- def handle_ctrl_c(event):
- if event == 0:
- fibratus.stop_ktrace()
- return 0
- set_console_ctrl_handler(handle_ctrl_c, True)
-
- # add specific filters
- filters = dict()
- filters['pid'] = args['--pid'] if args['--pid'] else None
- filters['image'] = args['--image'] if args['--image'] else None
-
- if not filament:
- if len(kevent_filters) > 0:
- fibratus.add_filters(kevent_filters, **filters)
- else:
- fibratus.add_filters([], **filters)
- else:
- if len(filament_filters) > 0:
- fibratus.add_filters(filament_filters, **filters)
- else:
- fibratus.add_filters([], **filters)
- try:
- fibratus.run()
- except KeyboardInterrupt:
- set_console_ctrl_handler(handle_ctrl_c, False)
-
- elif args['list-filaments']:
- filaments = Tabular(['Filament', 'Description'], 'Description',
- sort_by='Filament')
- for filament, desc in Filament.list_filaments().items():
- filaments.add_row([filament, desc])
- filaments.draw()
-
- elif args['list-kevents']:
- kevents = Tabular(['KEvent', 'Category', 'Description'], 'Description',
- sort_by='Category')
- for kevent, meta in KEvents.meta_info().items():
- kevents.add_row([kevent, meta[0].name, meta[1]])
- kevents.draw()
diff --git a/fibratus/common.py b/fibratus/common.py
deleted file mode 100644
index d7e7f830e..000000000
--- a/fibratus/common.py
+++ /dev/null
@@ -1,92 +0,0 @@
-# Copyright 2015 by Nedim Sabic (RabbitStack)
-# All Rights Reserved.
-# http://rabbitstack.github.io
-
-# Licensed under the Apache License, Version 2.0 (the "License"); you may
-# not use this file except in compliance with the License. You may obtain
-# a copy of the License at
-#
-# http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
-# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
-# License for the specific language governing permissions and limitations
-# under the License.
-
-import sys
-import re
-from prettytable import PrettyTable
-
-__underscore_regex__ = re.compile('((?<=[a-z0-9])[A-Z]|(?!^)[A-Z](?=[a-z]))')
-
-
-NA = ''
-
-
-def panic(msg):
- """Write the message on the console and terminates the process.
-
- Parameters
- ----------
- msg: str
- the message to be written on the standard output stream
- """
- print(msg)
- sys.exit()
-
-
-def underscore_dict_keys(in_dict):
- if type(in_dict) is dict:
- out_dict = {}
- for key, item in in_dict.items():
- out_dict[__underscore_regex__.sub(r'_\1', key).lower()] = underscore_dict_keys(item)
- return out_dict
- elif type(in_dict) is list:
- return [__underscore_regex__.sub(r'_\1', obj).lower() for obj in in_dict]
- else:
- return in_dict
-
-
-class Tabular(PrettyTable):
-
- def __init__(self, columns, align_col=None, align_type='l', sort_by=None):
- PrettyTable.__init__(self, columns)
- if align_col:
- self.align[align_col] = align_type
- if sort_by:
- self.sortby = sort_by
-
- def draw(self):
- print(self.get_string())
-
-
-class DotD(dict):
- """This code is borrowed from easydict
- Credits to:
-
- https://github.com/makinacorpus/easydict/blob/master/easydict/__init__.py
- """
- def __init__(self, d=None, **kwargs):
- if d is None:
- d = {}
- if kwargs:
- d.update(**kwargs)
- for k, v in d.items():
- setattr(self, k, v)
- # class attributes
- for k in self.__class__.__dict__.keys():
- if not (k.startswith('__') and k.endswith('__')):
- setattr(self, k, getattr(self, k))
-
- def __setattr__(self, name, value):
- if isinstance(value, (list, tuple)):
- value = [self.__class__(x)
- if isinstance(x, dict) else x for x in value]
- else:
- value = self.__class__(value) if isinstance(value, dict) else value
- super(DotD, self).__setattr__(name, value)
- super(DotD, self).__setitem__(name, value)
-
- __setitem__ = __setattr__
-
diff --git a/fibratus/config.py b/fibratus/config.py
deleted file mode 100644
index 40b819133..000000000
--- a/fibratus/config.py
+++ /dev/null
@@ -1,85 +0,0 @@
-# Copyright 2016 by Nedim Sabic (RabbitStack)
-# All Rights Reserved.
-#
-# Licensed under the Apache License, Version 2.0 (the "License"); you may
-# not use this file except in compliance with the License. You may obtain
-# a copy of the License at
-#
-# http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
-# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
-# License for the specific language governing permissions and limitations
-# under the License.
-
-import os
-import sys
-import anyconfig
-from fibratus.common import panic, DotD as ddict
-from pykwalify.core import Core
-
-
-class YamlConfig(object):
- """YAML based configuration reader.
-
- Reads the configuration from YAML file, and ensures the content satisfies the structure
- as defined in the schema file.
- """
-
- def __init__(self, config_path=None):
- self._default_config_path = os.path.join(os.path.expanduser('~'), '.fibratus', 'fibratus.yml')
- self._default_schema_path = os.path.join(os.path.expanduser('~'), '.fibratus', 'schema.yml')
- self.path = config_path or os.getenv('FIBRATUS_CONFIG_PATH', self._default_config_path)
- self._yaml = None
-
- def load(self, validate=True):
- schema_file = os.path.join(sys._MEIPASS, 'schema.yml') \
- if hasattr(sys, '_MEIPASS') else self._default_schema_path
- try:
- self._yaml = anyconfig.load(self.path, ignore_missing=False)
- except FileNotFoundError:
- panic('ERROR - %s configuration file does not exist' % self.path)
- if validate:
- validator = Core(source_file=self.path, schema_files=[schema_file])
- validator.validate(raise_exception=True)
-
- @property
- def image_meta(self):
- return ddict(self._yaml.pop('image_meta', {}))
-
- @property
- def skips(self):
- return ddict(self._yaml.pop('skips', {}))
-
- @property
- def outputs(self):
- return self._yaml.pop('output', None)
-
- @property
- def bindings(self):
- return self._yaml.pop('binding', None)
-
- @property
- def yaml(self):
- return self._yaml
-
- @property
- def default_config_path(self):
- return self._default_config_path
-
- @default_config_path.setter
- def default_config_path(self, path):
- self._default_config_path = path
-
- @property
- def default_schema_path(self):
- return self._default_schema_path
-
- @default_schema_path.setter
- def default_schema_path(self, path):
- self._default_schema_path = path
-
- @property
- def config_path(self):
- return self.path
\ No newline at end of file
diff --git a/fibratus/context_switch.py b/fibratus/context_switch.py
deleted file mode 100644
index eb8be4a28..000000000
--- a/fibratus/context_switch.py
+++ /dev/null
@@ -1,405 +0,0 @@
-# Copyright 2016 by Nedim Sabic (RabbitStack)
-# All Rights Reserved.
-#
-# Licensed under the Apache License, Version 2.0 (the "License"); you may
-# not use this file except in compliance with the License. You may obtain
-# a copy of the License at
-#
-# http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
-# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
-# License for the specific language governing permissions and limitations
-# under the License.
-import ctypes
-import os
-from ctypes.wintypes import MAX_PATH, DWORD
-from enum import Enum
-
-from fibratus.apidefs.process import open_thread, get_process_id_of_thread, \
- THREAD_QUERY_INFORMATION, open_process, PROCESS_QUERY_INFORMATION, PROCESS_VM_READ, \
- query_full_process_image_name
-from fibratus.apidefs.sys import close_handle
-from fibratus.common import NA
-
-
-class ContextSwitchRegistry(object):
- """Keeps the state of the context switches ocurring on the system.
-
- Once the CPU scheduler selects a new thread to execute, the context switch
- registry tracks down a plethora of attributes like the new thread priority,
- the old thread state, the wait reason, etc. It also keeps a counter on how many
- context switches has been made for a particular thread and the logical cpu.
-
- """
-
- def __init__(self, thread_registry, kevent):
- self._css = {}
- self._thread_registry = thread_registry
- self._kevent = kevent
-
- def next_cswitch(self, cpu, ts, kcs, on_context_switch=None):
- """Parses the context switch kernel events.
-
- Parameters
- ----------
- cpu: int
- the logical cpu where the context switch occurs
- ts: str
- the timestamp of the context switch
- kcs: dict
- the context switch info as forwarded
- from the kstream collector
- on_context_switch: callable
- the callback to execute after the parsing stage
-
- """
- new_thread_id = int(kcs.new_thread_id, 16)
- old_thread_id = int(kcs.old_thread_id, 16)
- new_thread_wait_time = int(kcs.new_thread_wait_time, 16)
- thread_cs = (cpu, new_thread_id,)
- next_thread = self._thread_registry.get_thread(new_thread_id)
- prev_thread = self._thread_registry.get_thread(old_thread_id)
-
- next_pid = next_thread.pid if next_thread else None
- next_proc_name = next_thread.name if next_thread \
- else self._get_proc(new_thread_id)
- prev_proc_name = prev_thread.name if prev_thread \
- else self._get_proc(old_thread_id)
-
- if thread_cs in self._css:
- # if the thread has been previously scheduled
- # on the same logical cpu, we can update its
- # context switch info
- cs = self._css[thread_cs]
- cs.timestamp = ts
- cs.prev_thread = prev_proc_name or NA
- cs.next_thread_prio = kcs.new_thread_priority
- cs.next_thread_wait_time = new_thread_wait_time
- cs.prev_thread_prio = kcs.old_thread_priority
- cs.prev_thread_state = ContextSwitchRegistry._human_thread_state(kcs.old_thread_state)
- cs.prev_thread_wait_mode = ContextSwitchRegistry._human_wait_mode(kcs.old_thread_wait_mode)
- cs.prev_thread_wait_reason = ContextSwitchRegistry._human_wait_reason(kcs.old_thread_wait_reason)
- cs.increment_count()
- else:
- # the new thread has been scheduled
- # add it to the registry of context
- # switches
- cs = CSwitch(ts,
- next_proc_name or NA,
- prev_proc_name or NA,
- kcs.new_thread_priority,
- new_thread_wait_time,
- kcs.old_thread_priority,
- ContextSwitchRegistry._human_thread_state(kcs.old_thread_state),
- ContextSwitchRegistry._human_wait_mode(kcs.old_thread_wait_mode),
- ContextSwitchRegistry._human_wait_reason(kcs.old_thread_wait_reason))
- cs.increment_count()
- self._css[thread_cs] = cs
-
- if on_context_switch:
- if next_proc_name:
- on_context_switch(cpu, next_proc_name)
- else:
- on_context_switch(cpu, kcs.new_thread_id)
-
- self._kevent.tid = new_thread_id
- self._kevent.pid = next_pid
- params = {
- 'next_proc_name': cs.next_proc_name,
- 'prev_proc_name': cs.prev_proc_name,
- 'cpu': cpu,
- 'next_thread_id': new_thread_id,
- 'prev_thread_id': old_thread_id,
- 'next_thread_prio': cs.next_thread_prio,
- 'prev_thread_prio': cs.prev_thread_prio,
- 'prev_thread_state': cs.prev_thread_state.name if cs.prev_thread_state else NA,
- 'next_thread_wait_time': cs.next_thread_wait_time,
- 'prev_thread_wait_mode': cs.prev_thread_wait_mode.name if cs.prev_thread_wait_mode else NA,
- 'prev_thread_wait_reason': cs.prev_thread_wait_reason.name if cs.prev_thread_wait_reason else NA
- }
- self._kevent.params = params
-
- def context_switches(self):
- """Returns a dictionary of context switches.
- """
- return self._css
-
- def _get_proc(self, thread_id):
- handle = open_thread(THREAD_QUERY_INFORMATION,
- False,
- thread_id)
-
- if handle:
- # if it was possible to get the process id
- # which is the parent of the thread, we can
- # try to get the process name from its pid
- pid = get_process_id_of_thread(handle)
- close_handle(handle)
- handle = open_process(PROCESS_QUERY_INFORMATION | PROCESS_VM_READ,
- False,
- pid)
- if handle:
- exe = ctypes.create_unicode_buffer(MAX_PATH)
- status = query_full_process_image_name(handle, 0,
- exe, DWORD(MAX_PATH))
- close_handle(handle)
- if status:
- return os.path.basename(exe.value)
-
- @classmethod
- def _human_thread_state(cls, thread_state):
- if thread_state == ThreadState.INITIALIZED.value:
- return ThreadState.INITIALIZED
- elif thread_state == ThreadState.READY.value:
- return ThreadState.READY
- elif thread_state == ThreadState.RUNNING.value:
- return ThreadState.RUNNING
- elif thread_state == ThreadState.STANDBY.value:
- return ThreadState.STANDBY
- elif thread_state == ThreadState.TERMINATED.value:
- return ThreadState.TERMINATED
- elif thread_state == ThreadState.WAITING.value:
- return ThreadState.WAITING
- elif thread_state == ThreadState.TRANSITION.value:
- return ThreadState.TRANSITION
- elif thread_state == ThreadState.DEFERRED_READY.value:
- return ThreadState.DEFERRED_READY
-
- @classmethod
- def _human_wait_reason(cls, wait_reason):
- if wait_reason == WaitReason.EXECUTIVE.value or wait_reason == WaitReason.EXECUTIVE.value + 7:
- return WaitReason.EXECUTIVE
- elif wait_reason == WaitReason.FREE_PAGE.value or wait_reason == WaitReason.FREE_PAGE.value + 7:
- return WaitReason.FREE_PAGE
- elif wait_reason == WaitReason.PAGE_IN.value or wait_reason == WaitReason.PAGE_IN.value + 7:
- return WaitReason.PAGE_IN
- elif wait_reason == WaitReason.POOL_ALLOCATION.value or wait_reason == WaitReason.POOL_ALLOCATION.value + 7:
- return WaitReason.POOL_ALLOCATION
- elif wait_reason == WaitReason.DELAY_EXECUTION.value or wait_reason == WaitReason.DELAY_EXECUTION.value + 7:
- return WaitReason.DELAY_EXECUTION
- elif wait_reason == WaitReason.SUSPENDED.value or wait_reason == WaitReason.SUSPENDED.value + 7:
- return WaitReason.SUSPENDED
- elif wait_reason == WaitReason.USER_REQUEST or wait_reason == WaitReason.USER_REQUEST.value + 7:
- return WaitReason.USER_REQUEST
- elif wait_reason == WaitReason.EVENT_PAIR.value:
- return WaitReason.EVENT_PAIR
- elif wait_reason == WaitReason.QUEUE.value:
- return WaitReason.QUEUE
- elif wait_reason == WaitReason.LPC_RECEIVE.value:
- return WaitReason.LPC_RECEIVE
- elif wait_reason == WaitReason.LPC_REPLY.value:
- return WaitReason.LPC_REPLY
- elif wait_reason == WaitReason.VIRTUAL_MEMORY.value:
- return WaitReason.VIRTUAL_MEMORY
- elif wait_reason == WaitReason.PAGE_OUT.value:
- return WaitReason.PAGE_OUT
- elif wait_reason == WaitReason.RENDEZVOUS.value:
- return WaitReason.RENDEZVOUS
- elif wait_reason == WaitReason.KEYED_EVENT.value:
- return WaitReason.KEYED_EVENT
- elif wait_reason == WaitReason.TERMINATED.value:
- return WaitReason.TERMINATED
- elif wait_reason == WaitReason.PROCESS_IN_SWAP.value:
- return WaitReason.PROCESS_IN_SWAP
- elif wait_reason == WaitReason.CPU_WAIT_CONTROL.value:
- return WaitReason.CPU_WAIT_CONTROL
- elif wait_reason == WaitReason.CALLOUT_STACK.value:
- return WaitReason.CALLOUT_STACK
- elif wait_reason == WaitReason.KERNEL.value:
- return WaitReason.KERNEL
- elif wait_reason == WaitReason.RESOURCE.value:
- return WaitReason.RESOURCE
- elif wait_reason == WaitReason.PUSH_LOCK.value:
- return WaitReason.PUSH_LOCK
- elif wait_reason == WaitReason.MUTEX.value:
- return WaitReason.MUTEX
- elif wait_reason == WaitReason.QUANTUM_END.value:
- return WaitReason.QUANTUM_END
- elif wait_reason == WaitReason.DISPATCH_INT.value:
- return WaitReason.DISPATCH_INT
- elif wait_reason == WaitReason.PREEMPTED.value:
- return WaitReason.PREEMPTED
- elif wait_reason == WaitReason.YIELD_EXECUTION.value:
- return WaitReason.YIELD_EXECUTION
- elif wait_reason == WaitReason.FAST_MUTEX.value:
- return WaitReason.FAST_MUTEX
- elif wait_reason == WaitReason.GUARDED_MUTEX.value:
- return WaitReason.GUARDED_MUTEX
- elif wait_reason == WaitReason.RUNDOWN.value:
- return WaitReason.RUNDOWN
- elif wait_reason == WaitReason.MAXIMUM_WAIT_REASON.value:
- return WaitReason.MAXIMUM_WAIT_REASON
-
- @classmethod
- def _human_wait_mode(cls, wait_mode):
- if wait_mode == WaitMode.KERNEL.value:
- return WaitMode.KERNEL
- elif wait_mode == WaitMode.USER.value:
- return WaitMode.USER
-
-
-class CSwitch(object):
-
- def __init__(self, ts, next_proc_name, prev_proc_name, next_thread_prio,
- next_thread_wait_time, prev_thread_prio, prev_thread_state,
- prev_thread_wait_mode,
- prev_thread_wait_reason):
- """Context switch state info.
-
- Parameters
- ----------
- ts: str
- the timestamp of the context switch
- next_proc_name: str
- process name of the thread which is about to be scheduled
- prev_proc_name: str
- process name right before the context switch
- next_thread_prio: int
- the priority of the new thread
- next_thread_wait_time: int
- wait time for the new thread
- prev_thread_prio: int
- the priority of the old thread
- prev_thread_state: Enum
- state of the previous thread
- prev_thread_wait_mode: Enum
- the wait mode of the old thread
- prev_thread_wait_reason: Enum
- the wait reason of the previous thread
-
- """
- self._ts = ts
- self._next_proc_name = next_proc_name
- self._prev_proc_name = prev_proc_name
- self._next_thread_prio = next_thread_prio
- self._next_thread_wait_time = next_thread_wait_time
- self._prev_thread_prio = prev_thread_prio
- self._prev_thread_state = prev_thread_state
- self._prev_thread_wait_mode = prev_thread_wait_mode
- self._prev_thread_wait_reason = prev_thread_wait_reason
- self._count = 0
-
- @property
- def timestamp(self):
- return self._ts
-
- @timestamp.setter
- def timestamp(self, ts):
- self._ts = ts
-
- @property
- def next_proc_name(self):
- return self._next_proc_name
-
- @property
- def prev_proc_name(self):
- return self._prev_proc_name
-
- @property
- def next_thread_prio(self):
- return self._next_thread_prio
-
- @next_thread_prio.setter
- def next_thread_prio(self, next_thread_prio):
- self._next_thread_prio = next_thread_prio
-
- @property
- def next_thread_wait_time(self):
- return self._next_thread_wait_time
-
- @next_thread_wait_time.setter
- def next_thread_wait_time(self, next_thread_wait_time):
- self._next_thread_wait_time = next_thread_wait_time
-
- @property
- def prev_thread_prio(self):
- return self._prev_thread_prio
-
- @prev_thread_prio.setter
- def prev_thread_prio(self, prev_thread_prio):
- self._prev_thread_prio = prev_thread_prio
-
- @property
- def prev_thread_state(self):
- return self._prev_thread_state
-
- @prev_thread_state.setter
- def prev_thread_state(self, prev_thread_state):
- self._prev_thread_state = prev_thread_state
-
- @property
- def prev_thread_wait_mode(self):
- return self._prev_thread_wait_mode
-
- @prev_thread_wait_mode.setter
- def prev_thread_wait_mode(self, prev_thread_wait_mode):
- self._prev_thread_wait_mode = prev_thread_wait_mode
-
- @property
- def prev_thread_wait_reason(self):
- return self._prev_thread_wait_reason
-
- @prev_thread_wait_reason.setter
- def prev_thread_wait_reason(self, prev_thread_wait_reason):
- self._prev_thread_wait_reason = prev_thread_wait_reason
-
- @property
- def count(self):
- return self._count
-
- def increment_count(self):
- self._count += 1
-
-
-class ThreadState(Enum):
- """Possible thread states.
- """
- INITIALIZED = 0
- READY = 1
- RUNNING = 2
- STANDBY = 3
- TERMINATED = 4
- WAITING = 5
- TRANSITION = 6
- DEFERRED_READY = 7
-
-
-class WaitMode(Enum):
- KERNEL = 0
- USER = 1
-
-
-class WaitReason(Enum):
- EXECUTIVE = 0
- FREE_PAGE = 1
- PAGE_IN = 2
- POOL_ALLOCATION = 3
- DELAY_EXECUTION = 4
- SUSPENDED = 5
- USER_REQUEST = 6
- EVENT_PAIR = 14
- QUEUE = 15
- LPC_RECEIVE = 16
- LPC_REPLY = 17
- VIRTUAL_MEMORY = 18
- PAGE_OUT = 19
- RENDEZVOUS = 20
- KEYED_EVENT = 21
- TERMINATED = 22
- PROCESS_IN_SWAP = 23
- CPU_WAIT_CONTROL = 24
- CALLOUT_STACK = 25
- KERNEL = 26
- RESOURCE = 27
- PUSH_LOCK = 28
- MUTEX = 29
- QUANTUM_END = 30
- DISPATCH_INT = 31
- PREEMPTED = 32
- YIELD_EXECUTION = 33
- FAST_MUTEX = 34
- GUARDED_MUTEX = 35
- RUNDOWN = 36
- MAXIMUM_WAIT_REASON = 37
diff --git a/fibratus/controller.py b/fibratus/controller.py
deleted file mode 100644
index 48da194fc..000000000
--- a/fibratus/controller.py
+++ /dev/null
@@ -1,158 +0,0 @@
-# Copyright 2015 by Nedim Sabic (RabbitStack)
-# All Rights Reserved.
-# http://rabbitstack.github.io
-#
-# Licensed under the Apache License, Version 2.0 (the "License"); you may
-# not use this file except in compliance with the License. You may obtain
-# a copy of the License at
-#
-# http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
-# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
-# License for the specific language governing permissions and limitations
-# under the License.
-
-from ctypes import addressof, byref, cast, memmove, sizeof, c_char, c_wchar
-from ctypes import ArgumentError, pointer
-
-from fibratus.apidefs.cdefs import ERROR_ALREADY_EXISTS, ERROR_ACCESS_DENIED, ERROR_BAD_LENGTH, \
- ERROR_INVALID_PARAMETER, ERROR_SUCCESS
-from fibratus.apidefs.etw import *
-from fibratus.errors import FibratusError
-from fibratus.common import panic
-
-class KTraceProps(object):
-
- def __init__(self, buffer_size=1024):
- """Builds the tracing session properties.
-
- Parameters
- ---------
-
- buffer_size: int
- the amount of memory allocated for each trace buffer
- """
-
- # allocate buffer for the trace
- self.max_string_len = 1024
- self.buff_size = sizeof(EVENT_TRACE_PROPERTIES) + 2 * sizeof(c_wchar) * self.max_string_len
-
- self._buff = (c_char * self.buff_size)()
- self._props = cast(pointer(self._buff), POINTER(EVENT_TRACE_PROPERTIES))
-
- # set trace properties
- self._props.contents.wnode.buffer_size = self.buff_size
- self._props.contents.wnode.guid = KERNEL_TRACE_CONTROL_GUID
- self._props.contents.wnode.flags = WNODE_FLAG_TRACED_GUID
- self._props.contents.logger_name_offset = sizeof(EVENT_TRACE_PROPERTIES)
- self._props.contents.log_file_name_offset = 0
- self._props.contents.log_file_mode = PROCESS_TRACE_MODE_REAL_TIME
- self._props.contents.buffer_size = buffer_size
-
- def enable_kflags(self, syscall=False, cswitch=False):
- # enable the basic set of flags
- # for the kernel events
- self._props.contents.enable_flags = (EVENT_TRACE_FLAG_PROCESS |
- EVENT_TRACE_FLAG_REGISTRY |
- EVENT_TRACE_FLAG_THREAD |
- EVENT_TRACE_FLAG_DISK_IO |
- EVENT_TRACE_FLAG_DISK_FILE_IO |
- EVENT_TRACE_FLAG_FILE_IO |
- EVENT_TRACE_FLAG_FILE_IO_INIT |
- EVENT_TRACE_FLAG_IMAGE_LOAD |
- EVENT_TRACE_FLAG_NETWORK_TCPIP)
-
- # syscall / cswitch flags generate a LOT of kevents
- # and they are disabled by default
- if syscall:
- self._props.contents.enable_flags |= (EVENT_TRACE_FLAG_SYSTEMCALL | EVENT_TRACE_FLAG_CSWITCH)
- if cswitch:
- self._props.contents.enable_flags |= EVENT_TRACE_FLAG_CSWITCH
-
- def get(self):
- return self._props
-
- @property
- def logger_name(self):
- return c_wchar_p(addressof(self._props.contents) +
- self._props.contents.logger_name_offset)
-
- @logger_name.setter
- def logger_name(self, logger_name):
- name_len = len(logger_name) + 1
- if self.max_string_len < name_len:
- raise ArgumentError("Logger name %s is too long" % logger_name)
- props = self._props
- logger = c_wchar_p(addressof(props.contents) + props.contents.logger_name_offset)
- memmove(logger, c_wchar_p(logger_name), sizeof(c_wchar) * name_len)
-
-
-class KTraceController(object):
- """Controls the life cycle of the kernel traces.
-
- """
-
- def __init__(self):
- self._handle = TRACEHANDLE()
- self._trace_name = None
-
- def __del__(self):
- if self._handle:
- self.stop_ktrace()
-
- def start_ktrace(self, name, kprops):
- """Starts a new trace.
-
- Parameters
- ---------
-
- name: str
- the name for the trace session
- kprops: KTraceProps
- an instance of the kernel trace properties
- """
- self._trace_name = name
- handle = TRACEHANDLE()
- kp = kprops.get()
- status = start_trace(byref(handle),
- self._trace_name,
- kp)
- self._handle = handle
- if status == ERROR_ALREADY_EXISTS:
- # the kernel logger trace session
- # is already running. Restart the trace.
- self.stop_ktrace()
- status = start_trace(byref(handle),
- self._trace_name,
- kp)
- if status != ERROR_SUCCESS:
- raise FibratusError('Unable to start fibratus')
- self._handle = handle
- elif status == ERROR_ACCESS_DENIED:
- # insufficient privileges
- panic("You don't have administrative privileges. Stopping fibratus...")
- elif status == ERROR_BAD_LENGTH:
- raise FibratusError('Incorrect buffer size for the trace buffer')
- elif status == ERROR_INVALID_PARAMETER:
- raise FibratusError('Invalid trace handle or provider GUID')
- elif status != ERROR_SUCCESS:
- raise FibratusError('Unable to start fibratus')
-
- def stop_ktrace(self, kprops=None):
- """Stops the current running trace.
-
- Parameters
- ---------
- kprops: KTraceProps
- an instance of the kernel trace properties
- """
- kprops = kprops or KTraceProps()
-
- handle = self._handle
- self._handle = TRACEHANDLE()
- control_trace(handle,
- self._trace_name,
- kprops.get(),
- EVENT_TRACE_CONTROL_STOP)
diff --git a/fibratus/dll.py b/fibratus/dll.py
deleted file mode 100644
index 7fe42afa0..000000000
--- a/fibratus/dll.py
+++ /dev/null
@@ -1,138 +0,0 @@
-# Copyright 2015 by Nedim Sabic (RabbitStack)
-# All Rights Reserved.
-#
-# Licensed under the Apache License, Version 2.0 (the "License"); you may
-# not use this file except in compliance with the License. You may obtain
-# a copy of the License at
-#
-# http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
-# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
-# License for the specific language governing permissions and limitations
-# under the License.
-
-import os
-
-
-class DllRepository(object):
-
- def __init__(self, kevent):
- self.dlls = {}
- self._kevent = kevent
-
- def register_dll(self, kdll):
- """Registers a loaded image.
-
- Registers an image when
- the latter is loaded into the address space
- of the process.
-
- Parameters
- ----------
-
- kdll: dict
- Image load event payload as forwarded
- from the kernel event stream collector
- """
- pid = kdll.process_id
- path = kdll.file_name
- image = os.path.basename(path)
- size = kdll.image_size
- checksum = kdll.image_checksum
- base = kdll.image_base
-
- self._kevent.pid = pid
-
- dll = Dll(pid, path,
- image,
- size,
- checksum,
- base)
-
- if pid in self.dlls:
- # append a new image to
- # the associated process
- self.dlls[pid].append(dll)
- else:
- self.dlls[pid] = [dll]
-
- self._kevent.params = dict(image=image,
- pid=pid,
- path=path,
- size=dll.size,
- checksum=checksum,
- base=hex(base))
-
- def unregister_dll(self, kdll):
- """Unregisters a loaded image.
-
- Removes the loaded image from
- the repository for a given process.
-
- Parameters
- ----------
-
- kdll: dict
- Image unload event payload as forwarded
- from the kernel event stream collector
- """
- pid = kdll.process_id
- path = kdll.file_name
- image = os.path.basename(path)
- size = kdll.image_size / 1024
- checksum = kdll.image_checksum
- base = kdll.image_base
-
- self._kevent.pid = pid
-
- if pid in self.dlls:
- dlls = self.dlls[pid]
- for dll in dlls:
- if dll.image == image:
- dlls.remove(dll)
- self._kevent.params = dict(image=image,
- pid=pid,
- path=path,
- size=size,
- checksum=checksum,
- base=hex(base))
-
- def dlls_for_process(self, pid):
- return self.dlls[pid] if pid in self.dlls else []
-
-
-class Dll(object):
-
- def __init__(self, pid, path, image, size, checksum, base):
- self._pid = pid
- self._path = path
- self._size = size
- self._checksum = checksum
- self._base = base
- self._image = image
-
- @property
- def pid(self):
- return self._pid
-
- @property
- def path(self):
- return self._path
-
- @property
- def image(self):
- return self._image
-
- @property
- def size(self):
- return self._size
-
- @property
- def base(self):
- return hex(self._base)
-
- @property
- def checksum(self):
- return self._checksum
diff --git a/fibratus/entrypoint.py b/fibratus/entrypoint.py
deleted file mode 100644
index 737593f6f..000000000
--- a/fibratus/entrypoint.py
+++ /dev/null
@@ -1,435 +0,0 @@
-# Copyright 2015 by Nedim Sabic (RabbitStack)
-# http://rabbitstack.github.io
-# All Rights Reserved.
-#
-# Licensed under the Apache License, Version 2.0 (the "License"); you may
-# not use this file except in compliance with the License. You may obtain
-# a copy of the License at
-#
-# http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
-# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
-# License for the specific language governing permissions and limitations
-# under the License.
-
-import atexit
-import os
-import sys
-from datetime import datetime
-
-from kstreamc import KEventStreamCollector
-from pykwalify.errors import SchemaError
-
-from fibratus.binding.yar import YaraBinding
-from fibratus.errors import BindingError
-from fibratus.image_meta import ImageMetaRegistry
-from fibratus.output.aggregator import OutputAggregator
-from fibratus.output.console import ConsoleOutput
-from fibratus.output.elasticsearch import ElasticsearchOutput
-from fibratus.output.fs import FsOutput
-from fibratus.output.smtp import SmtpOutput
-from logbook import Logger, FileHandler, StreamHandler
-
-import fibratus.apidefs.etw as etw
-from fibratus.common import DotD as ddict, panic
-from fibratus.config import YamlConfig
-from fibratus.context_switch import ContextSwitchRegistry
-from fibratus.controller import KTraceController, KTraceProps
-from fibratus.dll import DllRepository
-from fibratus.fs import FsIO
-from fibratus.handle import HandleRepository
-from fibratus.kevent import KEvent
-from fibratus.kevent_types import *
-from fibratus.tcpip.tcpip import TcpIpParser
-from fibratus.output.amqp import AmqpOutput
-from fibratus.registry import HiveParser
-from fibratus.thread import ThreadRegistry
-
-
-class Fibratus(object):
-
- """Fibratus entrypoint.
-
- Setup the core components including the kernel
- event stream collector and the tracing controller.
- At this point the system handles are also being
- enumerated.
-
- """
- def __init__(self, filament, **kwargs):
-
- self._start = datetime.now()
- try:
- log_path = os.path.join(os.path.expanduser('~'), '.fibratus', 'fibratus.log')
- FileHandler(log_path, mode='w+').push_application()
- StreamHandler(sys.stdout, bubble=True).push_application()
- except PermissionError:
- panic("ERROR - Unable to open log file for writing due to permission error")
-
- self.logger = Logger(Fibratus.__name__)
- self.logger.info('Starting Fibratus...')
-
- self._config = YamlConfig()
- self.logger.info('Loading configuration from [%s]' % self._config.config_path)
- try:
- self._config.load()
- except SchemaError as e:
- panic('Invalid configuration file. %s' % e.msg)
-
- enable_cswitch = kwargs.pop('cswitch', False)
-
- self.kcontroller = KTraceController()
- self.ktrace_props = KTraceProps()
- self.ktrace_props.enable_kflags(cswitch=enable_cswitch)
- self.ktrace_props.logger_name = etw.KERNEL_LOGGER_NAME
-
- enum_handles = kwargs.pop('enum_handles', True)
-
- self.handle_repository = HandleRepository()
- self._handles = []
- # query for handles on the
- # start of the kernel trace
- if enum_handles:
- self.logger.info('Enumerating system handles...')
- self._handles = self.handle_repository.query_handles()
- self.logger.info('%s handles found' % len(self._handles))
- self.handle_repository.free_buffers()
-
- image_meta_config = self._config.image_meta
- self.image_meta_registry = ImageMetaRegistry(image_meta_config.enabled, image_meta_config.imports,
- image_meta_config.file_info)
-
- self.thread_registry = ThreadRegistry(self.handle_repository, self._handles,
- self.image_meta_registry)
-
- self.kevt_streamc = KEventStreamCollector(etw.KERNEL_LOGGER_NAME.encode())
- skips = self._config.skips
- image_skips = skips.images if 'images' in skips else []
- if len(image_skips) > 0:
- self.logger.info("Adding skips for images %s" % image_skips)
- for skip in image_skips:
- self.kevt_streamc.add_skip(skip)
-
- self.kevent = KEvent(self.thread_registry)
-
- self._output_classes = dict(console=ConsoleOutput,
- amqp=AmqpOutput,
- smtp=SmtpOutput,
- elasticsearch=ElasticsearchOutput,
- fs=FsOutput)
- self._outputs = self._construct_outputs()
- self.output_aggregator = OutputAggregator(self._outputs)
-
- self._binding_classes = dict(yara=YaraBinding)
- self._bindings = self._construct_bindings()
-
- if filament:
- filament.logger = self.logger
- filament.do_output_accessors(self._outputs)
- self._filament = filament
-
- self.fsio = FsIO(self.kevent, self._handles)
- self.hive_parser = HiveParser(self.kevent, self.thread_registry)
- self.tcpip_parser = TcpIpParser(self.kevent)
- self.dll_repository = DllRepository(self.kevent)
- self.context_switch_registry = ContextSwitchRegistry(self.thread_registry, self.kevent)
-
- self.output_kevents = {}
- self.filters_count = 0
-
- def run(self):
-
- @atexit.register
- def _exit():
- self.stop_ktrace()
-
- self.kcontroller.start_ktrace(etw.KERNEL_LOGGER_NAME, self.ktrace_props)
-
- def on_kstream_open():
- if self._filament is None:
- delta = datetime.now() - self._start
- self.logger.info('Started in %sm:%02ds.%s' % (int(delta.total_seconds() / 60), delta.seconds,
- int(delta.total_seconds() * 1000)))
- else:
- self.logger.info('Running [%s] filament...' % self._filament.name)
- self.kevt_streamc.set_kstream_open_callback(on_kstream_open)
- self._open_kstream()
-
- def _open_kstream(self):
- try:
- self.kevt_streamc.open_kstream(self._on_next_kevent)
- except Exception as e:
- self.logger.error(e)
- except KeyboardInterrupt:
- self.stop_ktrace()
-
- def _construct_outputs(self):
- """Instantiates output classes.
-
- Builds the dictionary with instances
- of the output classes.
- """
- outputs = {}
- output_configs = self._config.outputs
- if not output_configs:
- return outputs
- for output in output_configs:
- name = next(iter(list(output.keys())), None)
- if name and \
- name in self._output_classes.keys():
- # get the output configuration
- # and instantiate its class
- output_config = output[name]
- self.logger.info("Deploying [%s] output - [%s]"
- % (name, {k: v for k, v in output_config.items()
- if 'password' not in k}))
- output_class = self._output_classes[name]
- outputs[name] = output_class(**output_config)
- return outputs
-
- def _construct_bindings(self):
- """Builds binding classes.
-
- :return: dict: dictionary with instances of the binding classes
- """
- bindings = {}
- binding_configs = self._config.bindings
- if not binding_configs:
- return bindings
- for b in binding_configs:
- name = next(iter(list(b.keys())), None)
- if name and \
- name in self._binding_classes.keys():
- binding_config = b[name]
- self.logger.info("Starting [%s] binding - [%s]" %
- (name, binding_config))
- binding_class = self._binding_classes[name]
- try:
- binding = binding_class(self._outputs, self.logger,
- **binding_config)
- bindings[name] = binding
- except BindingError as e:
- self.logger.error("Couldn't start [%s] binding. Reason: %s" %
- (name, e))
- return bindings
-
- def __find_binding(self, name):
- return self._bindings[name] if name in self._bindings else None
-
- def stop_ktrace(self):
- self.logger.info('Stopping fibratus...')
- if self._filament:
- self._filament.close()
- self.kcontroller.stop_ktrace(self.ktrace_props)
- self.kevt_streamc.close_kstream()
-
- def add_filters(self, kevent_filters, **kwargs):
- self.kevt_streamc.add_pid_filter(kwargs.pop('pid', None))
- self.kevt_streamc.add_image_filter(kwargs.pop('image', None))
- if len(kevent_filters) > 0:
- self.filters_count = len(kevent_filters)
- # include the basic filters
- # that are essential to the
- # rest of kernel events
- self.kevt_streamc.add_ktuple_filter(ENUM_PROCESS)
- self.kevt_streamc.add_ktuple_filter(ENUM_THREAD)
- self.kevt_streamc.add_ktuple_filter(ENUM_IMAGE)
- self.kevt_streamc.add_ktuple_filter(REG_CREATE_KCB)
- self.kevt_streamc.add_ktuple_filter(REG_DELETE_KCB)
-
- # these kevents are necessary for consistent state
- # of the trace. If the user doesn't include them
- # in a filter list, then we do the job but set the
- # kernel event type as not eligible for rendering
- if KEvents.CREATE_PROCESS not in kevent_filters:
- self.kevt_streamc.add_ktuple_filter(CREATE_PROCESS)
- self.output_kevents[CREATE_PROCESS] = False
- else:
- self.output_kevents[CREATE_PROCESS] = True
-
- if KEvents.CREATE_THREAD not in kevent_filters:
- self.kevt_streamc.add_ktuple_filter(CREATE_THREAD)
- self.output_kevents[CREATE_THREAD] = False
- else:
- self.output_kevents[CREATE_THREAD] = True
-
- if KEvents.TERMINATE_PROCESS not in kevent_filters:
- self.kevt_streamc.add_ktuple_filter(TERMINATE_PROCESS)
- self.output_kevents[TERMINATE_PROCESS] = False
- else:
- self.output_kevents[TERMINATE_PROCESS] = True
-
- if KEvents.TERMINATE_THREAD not in kevent_filters:
- self.kevt_streamc.add_ktuple_filter(TERMINATE_THREAD)
- self.output_kevents[TERMINATE_THREAD] = False
- else:
- self.output_kevents[TERMINATE_THREAD] = True
-
- for kevent_filter in kevent_filters:
- ktuple = kname_to_tuple(kevent_filter)
- if isinstance(ktuple, list):
- for kt in ktuple:
- self.kevt_streamc.add_ktuple_filter(kt)
- if kt not in self.output_kevents:
- self.output_kevents[kt] = True
- else:
- self.kevt_streamc.add_ktuple_filter(ktuple)
- if ktuple not in self.output_kevents:
- self.output_kevents[ktuple] = True
-
- def _on_next_kevent(self, ktype, cpuid, ts, kparams):
- """Callback which fires when new kernel event arrives.
-
- This callback is invoked for every new kernel event
- forwarded from the kernel stream collector.
-
- Parameters
- ----------
-
- ktype: tuple
- Kernel event type.
- cpuid: int
- Indentifies the CPU core where the event
- has been captured.
- ts: str
- Temporal reference of the kernel event.
- kparams: dict
- Kernel event's parameters.
- """
-
- # initialize kernel event properties
- self.kevent.ts = ts
- self.kevent.cpuid = cpuid
- self.kevent.name = ktuple_to_name(ktype)
- kparams = ddict(kparams)
-
- # thread / process kernel events
- if ktype in [CREATE_PROCESS,
- CREATE_THREAD,
- ENUM_PROCESS,
- ENUM_THREAD]:
- self.thread_registry.add_thread(ktype, kparams)
- if ktype in [CREATE_PROCESS, CREATE_THREAD]:
- self.thread_registry.init_thread_kevent(self.kevent,
- ktype,
- kparams)
- # apply yara binding by matching against the process's image path
- if ktype == CREATE_PROCESS:
- yara_binding = self.__find_binding('yara')
- pid = int(kparams.process_id, 16)
- thread = self.thread_registry.get_thread(pid)
- if thread and yara_binding:
- yara_binding.run(thread_info=thread,
- kevent=self.kevent)
- self._aggregate(ktype)
-
- elif ktype in [TERMINATE_PROCESS, TERMINATE_THREAD]:
- self.thread_registry.init_thread_kevent(self.kevent,
- ktype,
- kparams)
- self._aggregate(ktype)
- self.thread_registry.remove_thread(ktype, kparams)
-
- # file system/disk kernel events
- elif ktype in [CREATE_FILE,
- DELETE_FILE,
- CLOSE_FILE,
- READ_FILE,
- WRITE_FILE,
- RENAME_FILE,
- SET_FILE_INFORMATION]:
- self.fsio.parse_fsio(ktype, kparams)
- self._aggregate(ktype)
-
- # dll kernel events
- elif ktype in [LOAD_IMAGE, ENUM_IMAGE]:
- self.dll_repository.register_dll(kparams)
- if ktype == LOAD_IMAGE:
- self._aggregate(ktype)
- elif ktype == UNLOAD_IMAGE:
- self.dll_repository.unregister_dll(kparams)
- self._aggregate(ktype)
- #
- # # registry kernel events
- elif ktype == REG_CREATE_KCB:
- self.hive_parser.add_kcb(kparams)
- elif ktype == REG_DELETE_KCB:
- self.hive_parser.remove_kcb(kparams.key_handle)
-
- elif ktype in [REG_CREATE_KEY,
- REG_DELETE_KEY,
- REG_OPEN_KEY,
- REG_QUERY_KEY,
- REG_SET_VALUE,
- REG_DELETE_VALUE,
- REG_QUERY_VALUE]:
- self.hive_parser.parse_hive(ktype, kparams)
- self._aggregate(ktype)
-
- # network kernel events
- elif ktype in [SEND_SOCKET_TCPV4,
- SEND_SOCKET_UDPV4,
- RECV_SOCKET_TCPV4,
- RECV_SOCKET_UDPV4,
- ACCEPT_SOCKET_TCPV4,
- CONNECT_SOCKET_TCPV4,
- DISCONNECT_SOCKET_TCPV4,
- RECONNECT_SOCKET_TCPV4]:
- self.tcpip_parser.parse_tcpip(ktype, kparams)
- self._aggregate(ktype)
-
- # context switch events
- elif ktype == CONTEXT_SWITCH:
- self.context_switch_registry.next_cswitch(cpuid, ts, kparams)
- self._aggregate(ktype)
-
- if self._filament:
- if ktype not in [ENUM_PROCESS,
- ENUM_THREAD,
- ENUM_IMAGE,
- REG_CREATE_KCB,
- REG_DELETE_KCB]:
- ok = self.output_kevents[ktype] if ktype in self.output_kevents \
- else False
- if self.kevent.name and ok:
- thread = self.kevent.thread
- kevent = {
- 'params': self.kevent.params,
- 'name': self.kevent.name,
- 'pid': self.kevent.pid,
- 'tid': self.kevent.tid,
- 'timestamp': self.kevent.ts,
- 'cpuid': self.kevent.cpuid,
- 'category': self.kevent.category
- }
- if thread:
- kevent.update({
- 'thread': {
- 'name': thread.name,
- 'exe': thread.exe,
- 'comm': thread.comm,
- 'pid': thread.pid,
- 'ppid': thread.ppid
- }
- })
- self._filament.on_next_kevent(kevent)
-
- def _aggregate(self, ktype):
- """Aggregates the kernel event to the output sink.
-
- Parameters
- ----------
-
- ktype: tuple
- Identifier of the kernel event
- """
- if not self._filament:
- if ktype in self.output_kevents:
- if self.output_kevents[ktype]:
- self.kevent.inc_kid()
- self.output_aggregator.aggregate(self.kevent)
- elif self.filters_count == 0:
- self.kevent.inc_kid()
- self.output_aggregator.aggregate(self.kevent)
\ No newline at end of file
diff --git a/fibratus/errors.py b/fibratus/errors.py
deleted file mode 100644
index 1e2349b32..000000000
--- a/fibratus/errors.py
+++ /dev/null
@@ -1,54 +0,0 @@
-# Copyright 2015 by Nedim Sabic (RabbitStack)
-# All Rights Reserved.
-# http://rabbitstack.github.io
-
-# Licensed under the Apache License, Version 2.0 (the "License"); you may
-# not use this file except in compliance with the License. You may obtain
-# a copy of the License at
-#
-# http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
-# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
-# License for the specific language governing permissions and limitations
-# under the License.
-
-
-class KTraceError(Exception):
- pass
-
-
-class FibratusError(Exception):
- pass
-
-
-class FilamentError(Exception):
- pass
-
-
-class TermInitializationError(Exception):
- pass
-
-
-class UnknownKeventTypeError(Exception):
-
- def __init__(self, kevent):
- Exception.__init__(self, '%s cannot be recognized as a valid kernel event'
- % kevent)
-
-
-class HandleEnumError(Exception):
-
- def __init__(self, status):
- Exception.__init__(self, 'Unable to enumerate handles. Error code %s'
- % status)
-
-
-class InvalidPayloadError(Exception):
- pass
-
-
-class BindingError(Exception):
- pass
-
diff --git a/fibratus/filament.py b/fibratus/filament.py
deleted file mode 100644
index 9d214f556..000000000
--- a/fibratus/filament.py
+++ /dev/null
@@ -1,321 +0,0 @@
-# Copyright 2015 by Nedim Sabic (RabbitStack)
-# All Rights Reserved.
-#
-# Licensed under the Apache License, Version 2.0 (the "License"); you may
-# not use this file except in compliance with the License. You may obtain
-# a copy of the License at
-#
-# http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
-# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
-# License for the specific language governing permissions and limitations
-# under the License.
-
-import inspect
-import traceback
-import os
-import sys
-from importlib.machinery import SourceFileLoader
-
-from apscheduler.executors.pool import ThreadPoolExecutor
-from apscheduler.schedulers.background import BackgroundScheduler
-from apscheduler.triggers.interval import IntervalTrigger
-
-from fibratus.common import DotD as ddict, Tabular
-from fibratus.common import panic
-from fibratus.errors import FilamentError, TermInitializationError
-from fibratus.term import AnsiTerm
-
-
-FILAMENTS_DIR = os.getenv('FILAMENTS_PATH', os.path.join(os.path.expanduser('~'), '.fibratus', 'filaments'))
-
-
-class OutputAccessor(object):
- """An accessor for the output meta variable.
-
- It represents an output accessor which is injected into
- every filament module.
- """
- def __init__(self, output):
- self._output = output
-
- def emit(self, body, **kwargs):
- self._output.emit(body, **kwargs)
-
-
-class Filament(object):
- """Filament initialization and execution engine.
-
- Filaments are lightweight Python modules which run
- on top of Fibratus. They are often used to enrich/extend the
- functionality of Fibratus by performing any type of logic
- (aggregations, groupings, filters, counters, etc) on the
- kernel event stream.
-
- """
- def __init__(self):
- """Builds a new instance of the filament.
-
- Attributes:
- ----------
-
- filament_module: module
- module which contains the filament logic
- """
- self._filament_module = None
- self._name = None
- self._filters = []
- self._cols = []
- self._tabular = None
- self._limit = 10
- self._interval = 1
- self._sort_by = None
- self._sort_desc = True
- self._logger = None
- self._ansi_term = AnsiTerm()
- self.scheduler = BackgroundScheduler()
-
- def load_filament(self, name):
- """Loads the filament module.
-
- Finds and loads the python module which
- holds the filament logic. It also looks up for
- some essential filament methods and raises an error
- if they can't be found.
-
- Parameters
- ----------
- name: str
- name of the filament to load
-
- """
- self._name = name
- Filament._assert_root_dir()
- filament_path = self._find_filament_path(name)
- if filament_path:
- loader = SourceFileLoader(name, filament_path)
- self._filament_module = loader.load_module()
- sys.path.append(FILAMENTS_DIR)
- doc = inspect.getdoc(self._filament_module)
- if not doc:
- raise FilamentError('Please provide a short '
- 'description for the filament')
-
- on_next_kevent = self._find_filament_func('on_next_kevent')
- if on_next_kevent:
- if self._num_args(on_next_kevent) != 1:
- raise FilamentError('Missing one argument on_next_kevent '
- 'method on filament')
- self._initialize_funcs()
- else:
- raise FilamentError('Missing required on_next_kevent '
- 'method on filament')
- else:
- raise FilamentError('%s filament not found' % name)
-
- def _initialize_funcs(self):
- """Setup the filament modules functions.
-
- Functions
- ---------
-
- set_filter: func
- accepts the comma separated list of kernel events
- for whose the filter should be applied
- set_interval: func
- establishes the fixed repeating interval in seconds
- columns: func
- configure the column set for the table
- add_row: func
- adds a new row to the table
- sort_by: func
- sorts the table by specific column
- """
-
- def set_filter(*args):
- self._filters = args
- self._filament_module.set_filter = set_filter
-
- def set_interval(interval):
- if not type(interval) is int:
- raise FilamentError('Interval must be an integer value')
- self._interval = interval
- self._filament_module.set_interval = set_interval
-
- def columns(cols):
- if not isinstance(cols, list):
- raise FilamentError('Columns must be a list, '
- '%s found' % type(cols))
- self._cols = cols
- self._tabular = Tabular(self._cols)
- self._tabular.padding_width = 10
- self._tabular.junction_char = '|'
-
- def add_row(row):
- if not isinstance(row, list):
- raise FilamentError('Expected list type for the row, found %s'
- % type(row))
- self._tabular.add_row(row)
-
- def sort_by(col, sort_desc=True):
- if len(self._cols) == 0:
- raise FilamentError('Expected at least 1 column but 0 found')
- if col not in self._cols:
- raise FilamentError('%s column does not exist' % col)
- self._sort_by = col
- self._sort_desc = sort_desc
-
- def limit(l):
- if len(self._cols) == 0:
- raise FilamentError('Expected at least 1 column but 0 found')
- if not type(l) is int:
- raise FilamentError('Limit must be an integer value')
- self._limit = l
-
- def title(text):
- self._tabular.title = text
-
- self._filament_module.columns = columns
- self._filament_module.title = title
- self._filament_module.sort_by = sort_by
- self._filament_module.limit = limit
- self._filament_module.add_row = add_row
- self._filament_module.render_tabular = self.render_tabular
-
- on_init = self._find_filament_func('on_init')
- if on_init and self._zero_args(on_init):
- self._filament_module.on_init()
- if self._find_filament_func('on_interval'):
- self.scheduler.add_executor(ThreadPoolExecutor(max_workers=4))
- self.scheduler.start()
-
- def on_interval():
- try:
- self._filament_module.on_interval()
- except Exception:
- self._logger.error('Unexpected error on interval elapsed %s'
- % traceback.format_exc())
- self.scheduler.add_job(on_interval,
- IntervalTrigger(),
- seconds=self._interval,
- max_instances=4,
- misfire_grace_time=60)
- if len(self._cols) > 0:
- try:
- self._ansi_term.setup_console()
- except TermInitializationError:
- panic('fibratus run: ERROR - console initialization failed')
-
- def do_output_accessors(self, outputs):
- """Creates the filament's output accessors.
-
- Parameters
- ----------
-
- outputs: dict
- outputs initialized from the configuration
- descriptor
- """
- for name, output in outputs.items():
- setattr(self._filament_module, name, OutputAccessor(output))
-
- def on_next_kevent(self, kevent):
- try:
- self._filament_module.on_next_kevent(ddict(kevent))
- except Exception as e:
- self._logger.error('Unexpected filament error %s' % e)
-
- def render_tabular(self):
- """Renders the table on the console.
- """
- if len(self._cols) > 0:
- tabular = self._tabular.get_string(start=1, end=self._limit)
- if self._sort_by:
- tabular = self._tabular.get_string(start=1, end=self._limit,
- sortby=self._sort_by,
- reversesort=self._sort_desc)
- self._tabular.clear_rows()
- self._ansi_term.write_output(tabular)
-
- def close(self):
- on_stop = self._find_filament_func('on_stop')
- if on_stop and self._zero_args(on_stop):
- self._filament_module.on_stop()
- if self.scheduler.running:
- self.scheduler.shutdown()
- self._ansi_term.restore_console()
-
- @classmethod
- def exists(cls, filament):
- Filament._assert_root_dir()
- return os.path.exists(os.path.join(FILAMENTS_DIR, '%s.py' % filament))
-
- @classmethod
- def list_filaments(cls):
- Filament._assert_root_dir()
- filaments = {}
- paths = [os.path.join(FILAMENTS_DIR, path) for path in os.listdir(FILAMENTS_DIR)
- if path.endswith('.py')]
- for path in paths:
- filament_name = os.path.basename(path)[:-3]
- loader = SourceFileLoader(filament_name, path)
- filament = loader.load_module()
- filaments[filament_name] = inspect.getdoc(filament)
- return filaments
-
- @classmethod
- def _assert_root_dir(cls):
- if not os.path.exists(FILAMENTS_DIR):
- panic('fibratus run: ERROR - %s path does not exist.' % FILAMENTS_DIR)
-
- @property
- def filters(self):
- return self._filters
-
- @property
- def logger(self):
- return self._logger
-
- @logger.setter
- def logger(self, logger):
- self._logger = logger
-
- @property
- def filament_module(self):
- return self._filament_module
-
- @property
- def name(self):
- return self._name
-
- def _find_filament_func(self, func_name):
- """Finds the function in the filament module.
-
- Parameters
- ----------
-
- func_name: str
- the name of the function
- """
- functions = inspect.getmembers(self._filament_module, predicate=inspect.isfunction)
- return next(iter([func for name, func in functions if name == func_name]), None)
-
- def _find_filament_path(self, filament_name):
- """Resolves the filament full path from the name
-
- Parameters
- ----------
-
- filament_name: str
- the name of the filament whose path if about to be resolved
- """
- return next(iter([os.path.join(FILAMENTS_DIR, filament) for filament in os.listdir(FILAMENTS_DIR)
- if filament.endswith('.py') and filament_name == filament[:-3]]), None)
-
- def _num_args(self, func):
- return len(inspect.getargspec(func).args)
-
- def _zero_args(self, func):
- return self._num_args(func) == 0
diff --git a/fibratus/fs.py b/fibratus/fs.py
deleted file mode 100644
index 841805328..000000000
--- a/fibratus/fs.py
+++ /dev/null
@@ -1,223 +0,0 @@
-# Copyright 2015 by Nedim Sabic (RabbitStack)
-# All Rights Reserved.
-#
-# Licensed under the Apache License, Version 2.0 (the "License"); you may
-# not use this file except in compliance with the License. You may obtain
-# a copy of the License at
-#
-# http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
-# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
-# License for the specific language governing permissions and limitations
-# under the License.
-from enum import Enum
-
-from fibratus.common import NA
-from fibratus.handle import HandleType
-from fibratus.kevent_types import *
-from fibratus.apidefs.fs import *
-
-
-class FileOps(Enum):
-
- # if the file already exists,
- # replace it with the given file
- # otherwise create the given file
- SUPERSEDE = 0
- # if the file already exists,
- # open it instead of creating a new file
- OPEN = 1
- # if the file already exists,
- # fail the request otherwise create the file
- CREATE = 2
- # if the file already exists,
- # open it, otherwise create the given file
- OPEN_IF = 3
- # if the file already exists,
- # open it and overwrite it,
- # otherwise fail the request
- OVERWRITE = 4
- # if the file already exists,
- # open it and overwrite it,
- # otherwise create the given file
- OVERWRITE_IF = 5
-
-
-class FileType(Enum):
-
- FILE = 0
- DIRECTORY = 1
- REPARSE_POINT = 2
- UNKNOWN = 3
-
-
-class FsIO(object):
-
- def __init__(self, kevent, handles):
- self._kevent = kevent
- self.file_pool = {}
- self.file_handles = {handle.obj: (handle.name, handle.handle_type, handle.handle)
- for handle in handles
- if handle.handle_type in [HandleType.FILE, HandleType.DIRECTORY]}
-
- def parse_fsio(self, ketype, kfsio):
- """Parses the file system related kevents.
-
- Parameters
- ----------
-
- ketype: tuple
- kevent type
- kfsio: dict
- kevent payload as forwarded from
- """
-
- # thread which is perfoming the op
- tid = kfsio.ttid
- pid = kfsio.process_id
- obj = kfsio.file_object
- self._kevent.tid = tid
- self._kevent.pid = pid
- # creates or opens a file or the I/O device.
- # The device can be a file, file stream, directory,
- # physical disk, volume, console buffer, tape drive,
- # communications resource, mailslot, or pipe.
- if ketype == CREATE_FILE:
- file = kfsio.open_path
- # the high 8 bits correspond to the value of the
- # `CreateDisposition` parameter and the low 24 bits
- # are the value of the `CreateOptions` parameter
- # of the `NtCreateFile` system call
- co = kfsio.create_options
-
- # extract the most significat 8 bits
- flags = (co >> 24) & ((1 << 8) - 1)
-
- op = FileOps.OPEN
- if flags == FILE_SUPERSEDE:
- op = FileOps.SUPERSEDE
- elif flags == FILE_OPEN:
- op = FileOps.OPEN
- elif flags == FILE_CREATE:
- op = FileOps.CREATE
- elif flags == FILE_OPEN_IF:
- op = FileOps.OPEN_IF
- elif flags == FILE_OVERWRITE:
- op = FileOps.OVERWRITE
- elif flags == FILE_OVERWRITE_IF:
- op = FileOps.OVERWRITE_IF
-
- # determine file descriptor type
- file_type = FileType.FILE
- if (co & FILE_DIRECTORY_FILE) == FILE_DIRECTORY_FILE:
- file_type = FileType.DIRECTORY
- elif (co & FILE_OPEN_REPARSE_POINT) == FILE_OPEN_REPARSE_POINT:
- file_type = FileType.REPARSE_POINT
-
- share_mask = self._resolve_share_mask(kfsio.share_access)
- params = {
- 'file': file,
- 'file_type': file_type.name,
- 'file_object': obj,
- 'tid': tid,
- 'pid': pid,
- 'operation': op.name,
- 'share_mask': share_mask
- }
- self._kevent.params = params
-
- # index by file object pointer
- # so we can query the pool
- # to resolve the file name
- self.file_pool[obj] = file
-
- elif ketype == DELETE_FILE or ketype == CLOSE_FILE:
- file = self._query_file_name(obj, True)
- params = {
- 'file': file,
- 'file_object': obj,
- 'pid': pid,
- 'tid': tid
- }
- self._kevent.params = params
- elif ketype == WRITE_FILE or ketype == READ_FILE:
- # the number of kb read/written
- io_size = kfsio.io_size / 1024
- file = self._query_file_name(obj)
- params = {
- 'file': file,
- 'file_object': obj,
- 'pid': pid,
- 'tid': tid,
- 'io_size': io_size
- }
- self._kevent.params = params
- elif ketype == RENAME_FILE:
- file = self._query_file_name(obj)
- params = {
- 'file': file,
- 'file_object': obj,
- 'pid': pid,
- 'tid': tid
- }
- self._kevent.params = params
- if NA not in file:
- self.file_pool[obj] = file
- elif ketype == SET_FILE_INFORMATION:
- file = self._query_file_name(obj)
- params = {
- 'file': file,
- 'file_object': obj,
- 'pid': pid,
- 'tid': tid,
- 'info_class': kfsio.info_class
- }
- self._kevent.params = params
-
- def _query_file_name(self, fobj, remove=False):
- if fobj in self.file_pool:
- return self.file_pool.pop(fobj) if remove \
- else self.file_pool[fobj]
- else:
- # couldn't find the file in the file pool,
- # query the file handles
- if fobj in self.file_handles:
- file, _, _ = self.file_handles.pop(fobj)
- if file and not remove:
- self.file_pool[fobj] = file
- return file if file else NA
- else:
- return NA
-
- def _resolve_share_mask(self, share_access):
- """Resolves the share mask.
-
- Resolves the type of share access that
- the caller would like to use in the file.
-
- For example, `FILE_SHARE_READ` would allow other
- threads to open the file for read access.
-
- :param str share_access: the value of the share access
- :return: str: resolved share mask
- """
-
- if share_access == FILE_SHARE_READ:
- return 'r--'
- elif share_access == FILE_SHARE_WRITE:
- return '-w-'
- elif share_access == FILE_SHARE_DELETE:
- return '--d'
- elif share_access == (FILE_SHARE_READ | FILE_SHARE_WRITE):
- return 'rw-'
- elif share_access == (FILE_SHARE_READ | FILE_SHARE_DELETE):
- return 'r-d'
- elif share_access == (FILE_SHARE_WRITE | FILE_SHARE_DELETE):
- return '-wd'
- elif share_access == (FILE_SHARE_READ | FILE_SHARE_WRITE |
- FILE_SHARE_DELETE):
- return 'rwd'
- else:
- return '---'
diff --git a/fibratus/handle.py b/fibratus/handle.py
deleted file mode 100644
index adf496e33..000000000
--- a/fibratus/handle.py
+++ /dev/null
@@ -1,268 +0,0 @@
-# Copyright 2015 by Nedim Sabic (RabbitStack)
-# All Rights Reserved.
-# http://rabbitstack.github.io
-
-# Licensed under the Apache License, Version 2.0 (the "License"); you may
-# not use this file except in compliance with the License. You may obtain
-# a copy of the License at
-#
-# http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
-# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
-# License for the specific language governing permissions and limitations
-# under the License.
-from _ctypes import POINTER, byref, addressof
-from ctypes import cast, c_ulong, c_wchar_p
-from ctypes.wintypes import HANDLE, ULONG
-from enum import Enum
-
-from fibratus.common import DotD as ddict
-from fibratus.apidefs.cdefs import STATUS_INFO_LENGTH_MISMATCH, STATUS_SUCCESS, ERROR_SUCCESS, \
- UNICODE_STRING
-from fibratus.apidefs.process import open_process, PROCESS_DUP_HANDLE, get_current_process
-from fibratus.apidefs.registry import MAX_BUFFER_SIZE
-from fibratus.apidefs.sys import zw_query_system_information, SYSTEM_HANDLE_INFORMATION_CLASS, \
- SYSTEM_HANDLE_INFORMATION, free, realloc, SYSTEM_HANDLE, malloc, duplicate_handle, nt_query_object, \
- PUBLIC_OBJECT_TYPE_INFORMATION, OBJECT_TYPE_INFORMATION, PUBLIC_OBJECT_NAME_INFORMATION, close_handle
-from fibratus.errors import HandleEnumError
-
-
-class HandleType(Enum):
- FILE = 0
- DIRECTORY = 1
- KEY = 2
- ALPC_PORT = 3
- SECTION = 4
- MUTANT = 5
- EVENT = 6
- DESKTOP = 7
- SEMAPHORE = 8
- TIMER = 9
- TOKEN = 10
- JOB = 11
-
-
-class HandleRepository(object):
- """Stores open handle objects.
- """
-
- def __init__(self):
- self._object_buff_size = 0x1000
- self._object_types = {}
- # the object handles with these
- # masks shouldn't be queried,
- # otherwise the call could hang
- # the main thread
- self._nasty_access_masks = [0x120189,
- 0x0012019f,
- 0x1A019F]
-
- self._handle_types = [name for name, _ in HandleType.__members__.items()]
- self._buffers = []
-
- def query_handles(self, pid=None):
- raw_handles = self._enum_handles(pid)
- current_ps = HANDLE(get_current_process())
- handles = []
- # find the object handles for the process
- for _, handle in raw_handles.items():
- ps_handle = open_process(PROCESS_DUP_HANDLE,
- False,
- handle.pid)
- if ps_handle:
- handle_copy = HANDLE()
- # to query the object handle
- # we need to duplicate it in
- # the address space of the current process
- status = duplicate_handle(ps_handle,
- handle.handle,
- current_ps,
- byref(handle_copy),
- 0, 0, 0)
- if status != ERROR_SUCCESS:
- # get the object type
- handle_type = self._query_handle(handle_copy,
- PUBLIC_OBJECT_TYPE_INFORMATION,
- OBJECT_TYPE_INFORMATION)
- if handle_type:
- handle_type = cast(handle_type.contents.type_name.buffer, c_wchar_p) \
- .value \
- .upper().replace(' ', '_')
- # query for object name
- # (file names, registry keys,
- # sections, ALPC ports, etc)
- # check the access mask to make
- # sure `NtQueryObject` won't hang
- if handle_type in self._handle_types and \
- handle.access_mask not in self._nasty_access_masks:
- handle_name = self._query_handle(handle_copy,
- PUBLIC_OBJECT_NAME_INFORMATION,
- UNICODE_STRING)
- if handle_name:
- handle_name = cast(handle_name.contents.buffer, c_wchar_p).value
- handle_info = HandleInfo(handle.handle,
- handle.obj,
- HandleType(HandleType.__getattr__(handle_type)),
- handle_name,
- handle.pid)
- handles.append(handle_info)
-
- close_handle(handle_copy)
- close_handle(ps_handle)
- return handles
-
- def free_buffers(self):
- for buff in self._buffers:
- free(buff)
-
- def _enum_handles(self, process_id=None):
- """Enumerates handle information.
-
- Enumerates handle info on
- the start of the kernel capture.
-
- Returns a dictionary of handle's
- information including the handle id,
- access mask, and the process which owns
- the handle.
- """
- buff_size = MAX_BUFFER_SIZE
- size = c_ulong()
- # allocate the initial buffer
- buff = malloc(buff_size)
- handles = {}
-
- while True:
- status = zw_query_system_information(SYSTEM_HANDLE_INFORMATION_CLASS,
- buff,
- buff_size,
- byref(size))
- if status == STATUS_INFO_LENGTH_MISMATCH:
- # the buffer is too small
- # increment the buffer size and try again
- buff_size += MAX_BUFFER_SIZE
- elif status == STATUS_SUCCESS:
- # cast the buffer to `SYSTEM_HANDLE_INFORMATION` struct
- # which contains an array of `SYSTEM_HANDLE` structures
- sys_handle_info = cast(buff, POINTER(SYSTEM_HANDLE_INFORMATION))
- sys_handle_info = sys_handle_info.contents
- handle_count = sys_handle_info.number_of_handles
-
- # resize the array size to the
- # actual number of file handles
- sys_handles = (SYSTEM_HANDLE * buff_size).from_address(addressof(sys_handle_info.handles))
-
- for i in range(handle_count):
- sys_handle = sys_handles[i]
- pid = sys_handle.process_id
- handle = sys_handle.handle
- obj = sys_handle.object
- obj_type_index = sys_handle.object_type_number
- access_mask = sys_handle.access_mask
- if process_id and process_id == pid:
- handles[obj] = ddict(pid=process_id,
- handle=handle,
- obj=obj,
- access_mask=access_mask,
- obj_type_index=obj_type_index)
- elif process_id is None:
- handles[obj] = ddict(pid=pid,
- handle=handle,
- obj=obj,
- access_mask=access_mask,
- obj_type_index=obj_type_index)
- break
- else:
- raise HandleEnumError(status)
- # reallocate the buffer
- buff = realloc(buff, buff_size)
- # free the buffer memory
- free(buff)
-
- return handles
-
- def _async_query_object(self):
- pass
-
- def _query_handle(self, handle, klass, object_info_type):
- """Gets the object handle info.
-
- Parameters
- ----------
-
-
- handle: HANDLE
- handle object
- klass: int
- the class of information to query
- object_info_type: Structure
- structure type which holds the handle info
- """
- buff = malloc(self._object_buff_size)
- rlen = ULONG()
- status = nt_query_object(handle,
- klass,
- buff,
- self._object_buff_size,
- byref(rlen))
- if status >= 0:
- info = cast(buff, POINTER(object_info_type))
- self._buffers.append(buff)
- return info
- else:
- # reallocate the buffer size
- # and try again
- buff = realloc(buff, rlen.value)
- status = nt_query_object(handle,
- klass,
- buff,
- self._object_buff_size,
- None)
- if status >= 0:
- info = cast(buff, POINTER(object_info_type))
- self._buffers.append(buff)
- return info
- else:
- free(buff)
- return None
-
-
-class HandleInfo():
- """Saves the handle meta data.
- """
-
- def __init__(self, handle, obj, handle_type, name, pid):
- self._handle = handle
- self._obj = obj
- self._handle_type = handle_type
- self._name = name
- self._pid = pid
-
- @property
- def name(self):
- return self._name
-
- @property
- def handle_type(self):
- return self._handle_type
-
- @property
- def obj(self):
- return self._obj
-
- @property
- def pid(self):
- return self._pid
-
- @property
- def handle(self):
- return self._handle
-
- def __str__(self):
- return '%s type: [%s] object address: [%s] handle id: [%s] pid: [%s]' % \
- (self._name, self._handle_type,
- hex(self._obj),
- self._handle,
- self._pid)
diff --git a/fibratus/image_meta.py b/fibratus/image_meta.py
deleted file mode 100644
index 4ff2e199a..000000000
--- a/fibratus/image_meta.py
+++ /dev/null
@@ -1,237 +0,0 @@
-# Copyright 2016 by Nedim Sabic (RabbitStack)
-# All Rights Reserved.
-#
-# Licensed under the Apache License, Version 2.0 (the "License"); you may
-# not use this file except in compliance with the License. You may obtain
-# a copy of the License at
-#
-# http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
-# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
-# License for the specific language governing permissions and limitations
-# under the License.
-import pefile
-from fibratus.common import DotD as ddict, underscore_dict_keys
-
-
-def __decode__(value):
- return value.decode('utf-8')
-
-
-def __from_idx__(string_table, idx):
- """Lookups the entry in the string table.
-
- Parameters
- ----------
- string_table: dict
- the string table
- idx: int
- index for the entry
- """
- _, v = string_table[idx]
- return __decode__(v)
-
-
-class ImageMetaRegistry(object):
-
- def __init__(self, enabled=True, imports=False, file_info=False):
- """Creates an instace of the image meta registry.
-
- Arguments
- ---------
-
- enabled: bool
- determines if image meta information should be added to the registry
- imports: bool
- it instructs the PE module to parse the directory entry import structure
- file_info: bool
- determines if file information meta data should be extracted from the PE
- """
- self.image_metas = {}
- self.imports = imports
- self.file_info = file_info
- self.enabled = enabled
- self.full_loaded = False
-
- def add_image_meta(self, path):
- """Registers image meta information.
-
- This method parses the PE (Portable Executable) binary format
- of the the image passed in the `path` parameter.
-
- It then extracts some basic headers present in the PE, as well
- as sections which form the binary image.
-
- Parameters
- ----------
-
- path: str
- the absolute path of the image file
- """
- if not self.enabled:
- return None
- try:
- if (path.endswith('exe') or
- path.endswith('dll') or
- path.endswith('sys')) and \
- path not in self.image_metas:
- pe = pefile.PE(path, fast_load=True)
- file_header = ddict(underscore_dict_keys(pe.FILE_HEADER.dump_dict()))
- # create image meta instance
- image_meta = ImageMeta(file_header.machine.value,
- file_header.time_date_stamp.value,
- file_header.number_of_sections.value)
- image_meta.sections = [dict(name=__decode__(ddict(se.dump_dict()).Name.Value),
- entropy=se.get_entropy(),
- md5=se.get_hash_md5(),
- sha1=se.get_hash_sha1(),
- sha256=se.get_hash_sha256(),
- sha512=se.get_hash_sha512())
- for se in pe.sections]
- # parse directory entry imports
- if self.imports:
- pe.full_load()
- self.full_loaded = True
- for module in self.__directory_entry_import__(pe):
- dll = __decode__(module.dll)
- imports = [__decode__(i.name)
- for i in module.imports
- if not i.import_by_ordinal]
- image_meta.imports[dll] = imports
- # parse the string table to extract
- # the copyright, company, description
- # and other attributes
- if self.file_info:
- if not self.full_loaded:
- pe.full_load()
- if self.__pe_has_version_info__(pe):
- file_info = pe.FileInfo
- if file_info and len(file_info) > 0:
- file_info = file_info[0]
- if self.__fi_has_string_table__(file_info):
- string_table = sorted(list(file_info.StringTable[0].entries.items()))
- # get file info entries from table index
- image_meta.org = __from_idx__(string_table, 0)
- image_meta.description = __from_idx__(string_table, 1)
- image_meta.version = __from_idx__(string_table, 2)
- image_meta.internal_name = __from_idx__(string_table, 3)
- image_meta.copyright = __from_idx__(string_table, 4)
-
- self.image_metas[path] = image_meta
-
- return image_meta
- except Exception:
- # ignore the exception for now
- # but consider logging it to file
- # in case it can provide hints for
- # troubleshooting purposes
- pass
-
- def get_image_meta(self, path):
- return self.image_metas[path] if path in self.image_metas else None
-
- def remove_image_meta(self, path):
- return self.image_metas.pop(path, None)
-
- def __pe_has_version_info__(self, pe):
- return hasattr(pe, 'VS_VERSIONINFO')
-
- def __fi_has_string_table__(self, file_info):
- return len(file_info.StringTable) > 0 and hasattr(file_info, 'StringTable')
-
- def __directory_entry_import__(self, pe):
- return getattr(pe, 'DIRECTORY_ENTRY_IMPORT') if hasattr(pe, 'DIRECTORY_ENTRY_IMPORT') else []
-
-
-class ImageMeta(object):
- """Container for a plethora of metadata extracted from the PE headers.
-
- Attributes
- ----------
- arch: str
- identifies the target architecture for which this image is compiled
- timestamp: str
- the date and time the image was created by the linker
- num_sections: int
- indicates the size of the section table
- sections: list
- information for every section found in the image
- """
- def __init__(self, arch, timestamp, num_sections):
- self._arch = 'x86-64' if arch == 34404 else 'x86'
- self._timestamp = timestamp
- self._num_sections = num_sections
- self._sections = []
- self._org = None
- self._description = None
- self._version = None
- self._internal_name = None
- self._copyright = None
-
- self._imports = {}
-
- @property
- def arch(self):
- return self._arch
-
- @property
- def timestamp(self):
- return self._timestamp
-
- @property
- def num_sections(self):
- return self._num_sections
-
- @property
- def org(self):
- return self._org
-
- @org.setter
- def org(self, org):
- self._org = org
-
- @property
- def description(self):
- return self._description
-
- @description.setter
- def description(self, description):
- self._description = description
-
- @property
- def version(self):
- return self._version
-
- @version.setter
- def version(self, version):
- self._version = version
-
- @property
- def internal_name(self):
- return self._internal_name
-
- @internal_name.setter
- def internal_name(self, internal_name):
- self._internal_name = internal_name
-
- @property
- def copyright(self):
- return self._copyright
-
- @copyright.setter
- def copyright(self, copyright):
- self._copyright = copyright
-
- @property
- def sections(self):
- return self._sections
-
- @sections.setter
- def sections(self, sections):
- self._sections = sections
-
- @property
- def imports(self):
- return self._imports
diff --git a/fibratus/kevent.py b/fibratus/kevent.py
deleted file mode 100644
index 5f7a76766..000000000
--- a/fibratus/kevent.py
+++ /dev/null
@@ -1,269 +0,0 @@
-# Copyright 2015 by Nedim Sabic (RabbitStack)
-# All Rights Reserved.
-#
-# Licensed under the Apache License, Version 2.0 (the "License"); you may
-# not use this file except in compliance with the License. You may obtain
-# a copy of the License at
-#
-# http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
-# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
-# License for the specific language governing permissions and limitations
-# under the License.
-
-from datetime import datetime
-from enum import Enum
-
-from fibratus.apidefs.process import open_thread, THREAD_QUERY_INFORMATION, get_process_id_of_thread
-from fibratus.apidefs.sys import close_handle
-from fibratus.common import DotD as ddict, NA
-
-
-class Category(Enum):
-
- REGISTRY = 0
- FILE = 1
- NET = 2
- PROCESS = 3
- THREAD = 4
- MM = 5
- CSWITCH = 6
- SYSCALL = 7
- DISK_IO = 8
- DLL = 9
- OTHER = 10
-
-
-class KEvents(object):
- """Available kernel event names.
- """
- CREATE_PROCESS = 'CreateProcess'
- CREATE_THREAD = 'CreateThread'
- TERMINATE_PROCESS = 'TerminateProcess'
- TERMINATE_THREAD = 'TerminateThread'
-
- REG_CREATE_KEY = 'RegCreateKey'
- REG_DELETE_KEY = 'RegDeleteKey'
- REG_DELETE_VALUE = 'RegDeleteValue'
- REG_OPEN_KEY = 'RegOpenKey'
- REG_SET_VALUE = 'RegSetValue'
- REG_QUERY_VALUE = 'RegQueryValue'
- REG_QUERY_KEY = 'RegQueryKey'
-
- CREATE_FILE = 'CreateFile'
- DELETE_FILE = 'DeleteFile'
- WRITE_FILE = 'WriteFile'
- READ_FILE = 'ReadFile'
- CLOSE_FILE = 'CloseFile'
- RENAME_FILE = 'RenameFile'
- SET_FILE_INFORMATION = 'SetFileInformation'
-
- SEND = 'Send'
- RECEIVE = 'Recv'
- ACCEPT = 'Accept'
- CONNECT = 'Connect'
- DISCONNECT = 'Disconnect'
- RECONNECT = 'Reconnect'
-
- LOAD_IMAGE = 'LoadImage'
- UNLOAD_IMAGE = 'UnloadImage'
-
- SYSCALL_ENTER = 'SyscallEnter'
- SYSCALL_EXIT = 'SyscallExit'
-
- CONTEXT_SWITCH = 'ContextSwitch'
-
- @classmethod
- def all(cls):
- return [cls.CREATE_PROCESS,
- cls.CREATE_THREAD,
- cls.TERMINATE_PROCESS,
- cls.TERMINATE_THREAD,
- cls.CREATE_FILE,
- cls.DELETE_FILE,
- cls.READ_FILE,
- cls.WRITE_FILE,
- cls.CLOSE_FILE,
- cls.RENAME_FILE,
- cls.SET_FILE_INFORMATION,
- cls.REG_QUERY_KEY,
- cls.REG_QUERY_VALUE,
- cls.REG_CREATE_KEY,
- cls.REG_DELETE_KEY,
- cls.REG_DELETE_VALUE,
- cls.REG_OPEN_KEY,
- cls.REG_SET_VALUE,
- cls.LOAD_IMAGE,
- cls.UNLOAD_IMAGE,
- cls.SEND,
- cls.RECEIVE,
- cls.ACCEPT,
- cls.CONNECT,
- cls.RECONNECT,
- cls.DISCONNECT,
- cls.CONTEXT_SWITCH]
-
- @classmethod
- def meta_info(cls):
- kevents = {
- KEvents.CREATE_PROCESS: (Category.PROCESS, 'Creates a new process and its primary thread', ),
- KEvents.CREATE_THREAD: (Category.THREAD, 'Creates a thread to execute within the virtual address space'
- ' of the calling process', ),
- KEvents.TERMINATE_PROCESS: (Category.PROCESS, 'Terminates the process and all of its threads', ),
- KEvents.TERMINATE_THREAD: (Category.THREAD, 'Terminates a thread', ),
- KEvents.CREATE_FILE: (Category.FILE, 'Creates or opens a file or I/O device', ),
- KEvents.DELETE_FILE: (Category.FILE, 'Deletes an existing file or directory', ),
- KEvents.READ_FILE: (Category.FILE, 'Reads data from the file or I/O device', ),
- KEvents.WRITE_FILE: (Category.FILE, 'Writes data to the file or I/O device', ),
- KEvents.CLOSE_FILE: (Category.FILE, 'Closes the file or I/O device', ),
- KEvents.SET_FILE_INFORMATION: (Category.FILE, 'Changes information for the specified file',),
- KEvents.RENAME_FILE: (Category.FILE, 'Renames a file or directory', ),
- KEvents.REG_QUERY_KEY: (Category.REGISTRY, 'Retrieves information about the registry key', ),
- KEvents.REG_OPEN_KEY: (Category.REGISTRY, 'Opens the registry key', ),
- KEvents.REG_CREATE_KEY: (Category.REGISTRY, 'Creates the registry key or open it if the key '
- 'already exists', ),
- KEvents.REG_DELETE_KEY: (Category.REGISTRY, 'Deletes a subkey and its values', ),
- KEvents.REG_QUERY_VALUE: (Category.REGISTRY, 'Retrieves the type and data of the value'
- ' associated with an open registry key', ),
- KEvents.REG_DELETE_VALUE: (Category.REGISTRY, 'Removes a value from the registry key', ),
- KEvents.REG_SET_VALUE: (Category.REGISTRY, 'Sets the data and type of a value under a registry key', ),
- KEvents.LOAD_IMAGE: (Category.DLL, 'Loads the module into the address space of the calling process', ),
- KEvents.UNLOAD_IMAGE: (Category.DLL, 'Frees the loaded module from the address space '
- 'of the calling process', ),
- KEvents.SEND: (Category.NET, 'Sends data on a connected socket', ),
- KEvents.RECEIVE: (Category.NET, 'Receives data from a connected socket', ),
- KEvents.ACCEPT: (Category.NET, 'Initiates the connection attempt from the remote or local TCP socket', ),
- KEvents.CONNECT: (Category.NET, 'Establishes the connection to a TCP socket', ),
- KEvents.RECONNECT: (Category.NET, 'Reconnects to a TCP socket', ),
- KEvents.DISCONNECT: (Category.NET, 'Closes the connection to a TCP socket', ),
-
- KEvents.CONTEXT_SWITCH: (Category.THREAD, 'Scheduler selects a new thread to execute',)}
- return kevents
-
-__kevents__ = KEvents.meta_info()
-
-
-class KEvent(object):
-
- def __init__(self, thread_registry):
- self._kid = 0
- self._ts = datetime.now()
- self._cpuid = 0
- self._name = None
- self._category = None
- self._params = {}
- self._tid = None
- self._pid = None
- self.thread_registry = thread_registry
-
- @property
- def name(self):
- return self._name
-
- @name.setter
- def name(self, name):
- self._name = name
- if name in __kevents__:
- cat, _ = __kevents__[name]
- self._category = cat.name
-
- @property
- def params(self):
- return self._params
-
- @params.setter
- def params(self, params):
- self._params = ddict(params)
-
- @property
- def ts(self):
- return self._ts
-
- @ts.setter
- def ts(self, ts):
- self._ts = datetime.strptime(ts, '%Y-%m-%d %H:%M:%S.%f')
-
- @property
- def cpuid(self):
- return self._cpuid
-
- @cpuid.setter
- def cpuid(self, cpuid):
- self._cpuid = cpuid
-
- @property
- def category(self):
- return self._category
-
- @property
- def pid(self):
- return self._pid
-
- @pid.setter
- def pid(self, pid):
- self._pid = pid
-
- @property
- def tid(self):
- return self._tid
-
- @tid.setter
- def tid(self, tid):
- self._tid = tid
-
- @property
- def kid(self):
- return self._kid
-
- @property
- def thread(self):
- return self._find_thread()
-
- def _find_thread(self):
- """Finds the current thread/process emitted by the kernel event.
- """
- if self._pid:
- # first lookup by process id
- # if the process doesn't exist
- # in the thread registry
- # then query by the thread id
- thread = self.thread_registry.get_thread(self._pid)
- if not thread and self._tid:
- thread = self.thread_registry.get_thread(self._tid)
- else:
- # we dont have the process id
- # try to find the thread from which
- # we can get the process
- thread = self.thread_registry.get_thread(self._tid)
- return thread
-
- def get_thread(self):
- """Gets the thread associated with the kernel event.
- """
- thread = self._find_thread()
- if thread:
- return thread.pid, thread.name
- else:
- # figure out the process id from thread
- # if the process can't be found in
- # the thread registry
- pid = NA
- if self._pid is None:
- if self._tid:
- # get the thread handle
- handle = open_thread(THREAD_QUERY_INFORMATION,
- False,
- self._tid)
- if handle:
- pid = get_process_id_of_thread(handle)
- close_handle(handle)
- else:
- pid = self._pid
- return pid, NA
-
- def inc_kid(self):
- self._kid += 1
-
-
diff --git a/fibratus/kevent_types.py b/fibratus/kevent_types.py
deleted file mode 100644
index 445712c99..000000000
--- a/fibratus/kevent_types.py
+++ /dev/null
@@ -1,239 +0,0 @@
-# Copyright 2015 by Nedim Sabic (RabbitStack)
-# http://rabbitstack.github.io
-# All Rights Reserved.
-#
-# Licensed under the Apache License, Version 2.0 (the "License"); you may
-# not use this file except in compliance with the License. You may obtain
-# a copy of the License at
-#
-# http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
-# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
-# License for the specific language governing permissions and limitations
-# under the License.
-from fibratus.errors import UnknownKeventTypeError
-from fibratus.kevent import KEvents
-
-
-# start process event
-CREATE_PROCESS = ('{3d6fa8d0-fe05-11d0-9dda-00c04fd7ba7c}', 1)
-# end process event
-TERMINATE_PROCESS = ('{3d6fa8d0-fe05-11d0-9dda-00c04fd7ba7c}', 2)
-# enum processes event
-ENUM_PROCESS = ('{3d6fa8d0-fe05-11d0-9dda-00c04fd7ba7c}', 3)
-# start thread event
-CREATE_THREAD = ('{3d6fa8d1-fe05-11d0-9dda-00c04fd7ba7c}', 1)
-# end thread event
-TERMINATE_THREAD = ('{3d6fa8d1-fe05-11d0-9dda-00c04fd7ba7c}', 2)
-# enum threads event
-ENUM_THREAD = ('{3d6fa8d1-fe05-11d0-9dda-00c04fd7ba7c}', 3)
-
-# create file event
-CREATE_FILE = ('{90cbdc39-4a3e-11d1-84f4-0000f80464e3}', 64)
-# delete file event
-DELETE_FILE = ('{90cbdc39-4a3e-11d1-84f4-0000f80464e3}', 70)
-# close file event generated when the file object is freed
-CLOSE_FILE = ('{90cbdc39-4a3e-11d1-84f4-0000f80464e3}', 66)
-# read file event
-READ_FILE = ('{90cbdc39-4a3e-11d1-84f4-0000f80464e3}', 67)
-# write file event
-WRITE_FILE = ('{90cbdc39-4a3e-11d1-84f4-0000f80464e3}', 68)
-# rename file event
-RENAME_FILE = ('{90cbdc39-4a3e-11d1-84f4-0000f80464e3}', 71)
-# enumerate directory event
-ENUM_DIRECTORY = ('{90cbdc39-4a3e-11d1-84f4-0000f80464e3}', 72)
-# set file information event
-SET_FILE_INFORMATION = ('{90cbdc39-4a3e-11d1-84f4-0000f80464e3}', 69)
-
-# disk read event
-DISK_IO_READ = ('{3d6fa8d4-fe05-11d0-9dda-00c04fd7ba7c}', 10)
-# disk write event
-DISK_IO_WRITE = ('{3d6fa8d4-fe05-11d0-9dda-00c04fd7ba7c}', 11)
-
-# create registry key event
-REG_CREATE_KEY = ('{ae53722e-c863-11d2-8659-00c04fa321a1}', 10)
-# create registry key event
-REG_DELETE_KEY = ('{ae53722e-c863-11d2-8659-00c04fa321a1}', 12)
-# delete registry value event
-REG_DELETE_VALUE = ('{ae53722e-c863-11d2-8659-00c04fa321a1}', 15)
-# registry open key
-REG_OPEN_KEY = ('{ae53722e-c863-11d2-8659-00c04fa321a1}', 11)
-# registry set value key event
-REG_SET_VALUE = ('{ae53722e-c863-11d2-8659-00c04fa321a1}', 14)
-# registry query value key event
-REG_QUERY_VALUE = ('{ae53722e-c863-11d2-8659-00c04fa321a1}', 16)
-# registry query value key event
-REG_QUERY_KEY = ('{ae53722e-c863-11d2-8659-00c04fa321a1}', 13)
-# create the key control block
-REG_CREATE_KCB = ('{ae53722e-c863-11d2-8659-00c04fa321a1}', 22)
-# delete the key control block
-REG_DELETE_KCB = ('{ae53722e-c863-11d2-8659-00c04fa321a1}', 23)
-
-# image load event generated when a DLL or executable file is loaded
-LOAD_IMAGE = ('{2cb15d1d-5fc1-11d2-abe1-00a0c911f518}', 10)
-# generated when a DLL or executable file is unloaded
-UNLOAD_IMAGE = ('{2cb15d1d-5fc1-11d2-abe1-00a0c911f518}', 2)
-# enumerates all loaded images
-ENUM_IMAGE = ('{2cb15d1d-5fc1-11d2-abe1-00a0c911f518}', 3)
-
-# virtual memory allocation event
-VIRTUAL_ALLOC = ('{3d6fa8d3-fe05-11d0-9dda-00c04fd7ba7c}', 98)
-# virtual memory free event
-VIRTUAL_FREE = ('{3d6fa8d3-fe05-11d0-9dda-00c04fd7ba7c}', 99)
-
-# system call enter event
-SYSCALL_ENTER = ('{ce1dbfb4-137e-4da6-87b0-3f59aa102cbc}', 51)
-# system call exit event
-SYSCALL_EXIT = ('{ce1dbfb4-137e-4da6-87b0-3f59aa102cbc}', 52)
-
-# context switch event
-CONTEXT_SWITCH = ('{3d6fa8d1-fe05-11d0-9dda-00c04fd7ba7c}', 36)
-
-# starts an incoming connection attempt on socket
-ACCEPT_SOCKET_TCPV4 = ('{9a280ac0-c8e0-11d1-84e2-00c04fb998a2}', 15)
-ACCEPT_SOCKET_TCPV6 = ('{9a280ac0-c8e0-11d1-84e2-00c04fb998a2}', 31)
-
-# sends data on a connected socket
-SEND_SOCKET_TCPV4 = ('{9a280ac0-c8e0-11d1-84e2-00c04fb998a2}', 10)
-SEND_SOCKET_UDPV4 = ('{bf3a50c5-a9c9-4988-a005-2df0b7c80f80}', 10)
-# establishes a connection to a specified socket
-CONNECT_SOCKET_TCPV4 = ('{9a280ac0-c8e0-11d1-84e2-00c04fb998a2}', 12)
-# disconnect event
-DISCONNECT_SOCKET_TCPV4 = ('{9a280ac0-c8e0-11d1-84e2-00c04fb998a2}', 13)
-# reconnect attempt event
-RECONNECT_SOCKET_TCPV4 = ('{9a280ac0-c8e0-11d1-84e2-00c04fb998a2}', 16)
-# receives data from a connected socket
-RECV_SOCKET_TCPV4 = ('{9a280ac0-c8e0-11d1-84e2-00c04fb998a2}', 11)
-RECV_SOCKET_UDPV4 = ('{bf3a50c5-a9c9-4988-a005-2df0b7c80f80}', 11)
-
-
-def kname_to_tuple(name):
-
- if name == KEvents.CREATE_PROCESS:
- return CREATE_PROCESS
- elif name == KEvents.TERMINATE_PROCESS:
- return TERMINATE_PROCESS
- elif name == KEvents.CREATE_THREAD:
- return CREATE_THREAD
- elif name == KEvents.TERMINATE_THREAD:
- return TERMINATE_THREAD
-
- elif name == KEvents.REG_CREATE_KEY:
- return REG_CREATE_KEY
- elif name == KEvents.REG_QUERY_KEY:
- return REG_QUERY_KEY
- elif name == KEvents.REG_OPEN_KEY:
- return REG_OPEN_KEY
- elif name == KEvents.REG_QUERY_VALUE:
- return REG_QUERY_VALUE
- elif name == KEvents.REG_SET_VALUE:
- return REG_SET_VALUE
- elif name == KEvents.REG_DELETE_KEY:
- return REG_DELETE_KEY
- elif name == KEvents.REG_DELETE_VALUE:
- return REG_DELETE_VALUE
-
- elif name == KEvents.CREATE_FILE:
- return CREATE_FILE
- elif name == KEvents.READ_FILE:
- return READ_FILE
- elif name == KEvents.WRITE_FILE:
- return WRITE_FILE
- elif name == KEvents.CLOSE_FILE:
- return CLOSE_FILE
- elif name == KEvents.DELETE_FILE:
- return DELETE_FILE
- elif name == KEvents.RENAME_FILE:
- return RENAME_FILE
- elif name == KEvents.SET_FILE_INFORMATION:
- return SET_FILE_INFORMATION
-
- elif name == KEvents.LOAD_IMAGE:
- return LOAD_IMAGE
- elif name == KEvents.UNLOAD_IMAGE:
- return UNLOAD_IMAGE
-
- elif name == KEvents.CONTEXT_SWITCH:
- return CONTEXT_SWITCH
-
- elif name == KEvents.SEND:
- return [SEND_SOCKET_UDPV4, SEND_SOCKET_TCPV4]
- elif name == KEvents.RECEIVE:
- return [RECV_SOCKET_UDPV4, RECV_SOCKET_TCPV4]
- elif name == KEvents.ACCEPT:
- return [ACCEPT_SOCKET_TCPV4, ACCEPT_SOCKET_TCPV6]
- elif name == KEvents.CONNECT:
- return CONNECT_SOCKET_TCPV4
- elif name == KEvents.RECONNECT:
- return RECONNECT_SOCKET_TCPV4
- elif name == KEvents.DISCONNECT:
- return DISCONNECT_SOCKET_TCPV4
- else:
- raise UnknownKeventTypeError(name)
-
-
-def ktuple_to_name(ktuple):
-
- if ktuple == CREATE_PROCESS:
- return KEvents.CREATE_PROCESS
- elif ktuple == CREATE_THREAD:
- return KEvents.CREATE_THREAD
- elif ktuple == TERMINATE_PROCESS:
- return KEvents.TERMINATE_PROCESS
- elif ktuple == TERMINATE_THREAD:
- return KEvents.TERMINATE_THREAD
-
- elif ktuple == REG_CREATE_KEY:
- return KEvents.REG_CREATE_KEY
- elif ktuple == REG_DELETE_KEY:
- return KEvents.REG_DELETE_KEY
- elif ktuple == REG_DELETE_VALUE:
- return KEvents.REG_DELETE_VALUE
- elif ktuple == REG_OPEN_KEY:
- return KEvents.REG_OPEN_KEY
- elif ktuple == REG_SET_VALUE:
- return KEvents.REG_SET_VALUE
- elif ktuple == REG_QUERY_VALUE:
- return KEvents.REG_QUERY_VALUE
- elif ktuple == REG_QUERY_KEY:
- return KEvents.REG_QUERY_KEY
-
- elif ktuple == CREATE_FILE:
- return KEvents.CREATE_FILE
- elif ktuple == DELETE_FILE:
- return KEvents.DELETE_FILE
- elif ktuple == CLOSE_FILE:
- return KEvents.CLOSE_FILE
- elif ktuple == WRITE_FILE:
- return KEvents.WRITE_FILE
- elif ktuple == READ_FILE:
- return KEvents.READ_FILE
- elif ktuple == RENAME_FILE:
- return KEvents.RENAME_FILE
- elif ktuple == SET_FILE_INFORMATION:
- return KEvents.SET_FILE_INFORMATION
-
- elif ktuple == LOAD_IMAGE:
- return KEvents.LOAD_IMAGE
- elif ktuple == UNLOAD_IMAGE:
- return KEvents.UNLOAD_IMAGE
-
- elif ktuple == CONTEXT_SWITCH:
- return KEvents.CONTEXT_SWITCH
-
- elif ktuple == SEND_SOCKET_UDPV4 or\
- ktuple == SEND_SOCKET_TCPV4:
- return KEvents.SEND
- elif ktuple == RECV_SOCKET_UDPV4 or\
- ktuple == RECV_SOCKET_TCPV4:
- return KEvents.RECEIVE
- elif ktuple == ACCEPT_SOCKET_TCPV4:
- return KEvents.ACCEPT
- elif ktuple == CONNECT_SOCKET_TCPV4:
- return KEvents.CONNECT
- elif ktuple == DISCONNECT_SOCKET_TCPV4:
- return KEvents.DISCONNECT
- elif ktuple == RECONNECT_SOCKET_TCPV4:
- return KEvents.RECONNECT
\ No newline at end of file
diff --git a/fibratus/output/aggregator.py b/fibratus/output/aggregator.py
deleted file mode 100644
index 2df2f9cc2..000000000
--- a/fibratus/output/aggregator.py
+++ /dev/null
@@ -1,49 +0,0 @@
-# Copyright 2016 by Nedim Sabic (RabbitStack)
-# All Rights Reserved.
-#
-# Licensed under the Apache License, Version 2.0 (the "License"); you may
-# not use this file except in compliance with the License. You may obtain
-# a copy of the License at
-#
-# http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
-# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
-# License for the specific language governing permissions and limitations
-# under the License.
-from fibratus.output.console import ConsoleOutput
-
-
-class OutputAggregator(object):
-
- def __init__(self, outputs):
- self.outputs = outputs
-
- def aggregate(self, kevent):
- """Emit the kernel stream via output sinks.
-
- For each output registered, invokes the `emit``
- method to send the kernel event info to the
- output sink.
-
- Parameters
- ----------
-
- kevent: KEvent
- an instance of the kernel event
- """
- for _, output in self.outputs.items():
- if isinstance(output, ConsoleOutput):
- output.emit(kevent)
- else:
- pid, proc = kevent.get_thread()
- body = {'id': kevent.kid,
- 'timestamp': kevent.ts.strftime('%Y-%m-%d %H:%M:%S.%f'),
- 'cpuid': kevent.cpuid,
- 'proc': proc,
- 'pid': pid,
- 'name': kevent.name,
- 'category': kevent.category,
- 'params': kevent.params}
- output.emit(body)
diff --git a/fibratus/output/amqp.py b/fibratus/output/amqp.py
deleted file mode 100644
index 4a0edbca1..000000000
--- a/fibratus/output/amqp.py
+++ /dev/null
@@ -1,104 +0,0 @@
-# Copyright 2016 by Nedim Sabic (RabbitStack)
-# All Rights Reserved.
-#
-# Licensed under the Apache License, Version 2.0 (the "License"); you may
-# not use this file except in compliance with the License. You may obtain
-# a copy of the License at
-#
-# http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
-# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
-# License for the specific language governing permissions and limitations
-# under the License.
-import json
-
-import pika
-
-from fibratus.errors import InvalidPayloadError
-from fibratus.output.base import Output
-
-
-class AmqpOutput(Output):
-
- def __init__(self, **kwargs):
- """Builds a new instance of the AMQP output adapter.
-
- Parameters
- ----------
-
- kwargs: dict
- AMQP configuration
- """
- Output.__init__(self)
- self._username = kwargs.pop('username', 'guest')
- self._password = kwargs.pop('password', 'guest')
-
- self._host = kwargs.pop('host', '127.0.0.1')
- self._port = kwargs.pop('port', 5672)
- self._vhost = kwargs.pop('vhost', '/')
- self._delivery_mode = kwargs.pop('delivery_mode', 1)
-
- credentials = pika.PlainCredentials(self._username, self._password)
- self._parameters = pika.ConnectionParameters(self._host,
- self._port,
- self._vhost,
- credentials)
-
- self._exchange = kwargs.pop('exchange', None)
- self._routingkey = kwargs.pop('routingkey', None)
-
- self._connection = None
- self._channel = None
-
- self._basic_props = pika.BasicProperties(content_type='text/json',
- delivery_mode=self._delivery_mode)
-
- def emit(self, body, **kwargs):
- if not self._connection:
- self._connection = pika.BlockingConnection(self._parameters)
- self._channel = self._connection.channel()
- # override the default exchange name
- # and the routing key used to send
- # the message to the AMQP broker
- self._routingkey = kwargs.pop('routingkey', self._routingkey)
- self._exchange = kwargs.pop('exchange', self._exchange)
-
- # the message body should be a dictionary
- if not isinstance(body, dict):
- raise InvalidPayloadError('invalid payload for AMQP message. '
- 'dict expected but %s found'
- % type(body))
- body = json.dumps(body)
- self._channel.basic_publish(self._exchange,
- self._routingkey,
- body, self._basic_props)
-
- @property
- def username(self):
- return self._username
-
- @property
- def host(self):
- return self._host
-
- @property
- def port(self):
- return self._port
-
- @property
- def vhost(self):
- return self._vhost
-
- @property
- def exchange(self):
- return self._exchange
-
- @property
- def routingkey(self):
- return self._routingkey
-
- @property
- def delivery_mode(self):
- return self._delivery_mode
diff --git a/fibratus/output/base.py b/fibratus/output/base.py
deleted file mode 100644
index 4aa4d9681..000000000
--- a/fibratus/output/base.py
+++ /dev/null
@@ -1,30 +0,0 @@
-# Copyright 2016 by Nedim Sabic (RabbitStack)
-# All Rights Reserved.
-#
-# Licensed under the Apache License, Version 2.0 (the "License"); you may
-# not use this file except in compliance with the License. You may obtain
-# a copy of the License at
-#
-# http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
-# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
-# License for the specific language governing permissions and limitations
-# under the License.
-
-from logbook import Logger, StreamHandler
-import sys
-
-
-class Output(object):
-
- def __init__(self):
- StreamHandler(sys.stdout).push_application()
- self.logger = Logger()
-
- def emit(self, body, **kwargs):
- raise NotImplementedError()
-
- def supports_batches(self):
- return False
diff --git a/fibratus/output/console.py b/fibratus/output/console.py
deleted file mode 100644
index 42e2b9fe8..000000000
--- a/fibratus/output/console.py
+++ /dev/null
@@ -1,97 +0,0 @@
-# Copyright 2016 by Nedim Sabic (RabbitStack)
-# All Rights Reserved.
-#
-# Licensed under the Apache License, Version 2.0 (the "License"); you may
-# not use this file except in compliance with the License. You may obtain
-# a copy of the License at
-#
-# http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
-# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
-# License for the specific language governing permissions and limitations
-# under the License.
-import json
-from _ctypes import byref
-
-from fibratus.apidefs.sys import get_std_handle, STD_OUTPUT_HANDLE, write_console_unicode, c_ulong
-from fibratus.output.base import Output
-
-RENDER_FORMAT = '%s %s %s %s (%s) - %s %s'
-
-
-class ConsoleOutput(Output):
-
- def __init__(self, **kwargs):
- Output.__init__(self)
-
- self._fmt = kwargs.pop('format', 'pretty')
- self._timestamp_pattern = kwargs.pop('timestamp_pattern', '%Y-%m-%d %H:%M:%S.%f')
- self._stdout_handle = get_std_handle(STD_OUTPUT_HANDLE)
-
- assert self._stdout_handle, 'could not acquire the standard output stream handle'
-
- def emit(self, kevent, **kwargs):
- """Renders the kevent to the standard output stream.
-
- Uses the default output format or JSON to render the
- kernel event to standard output stream.
-
- The default output format is as follows:
-
- id timestamp cpu process (process id) - kevent (parameters)
- -- --------- --- ------- ----------- ------- ------------
-
- Example:
-
- 160 13:27:27.554 0 wmiprvse.exe (1012) - CloseFile (file=C:\\WINDOWS\\SYSTEM32\\RSAENH.DLL, tid=2668)
-
- Parameters
- ----------
-
- kevent: KEvent
- the information regarding the kernel event
-
- kwargs: dict
- console adapter configuration
-
- """
- if isinstance(kevent, dict):
- kevt = json.dumps(kevent)
- else:
- pid, proc = kevent.get_thread()
- if 'pretty' in self._fmt:
- kevt = RENDER_FORMAT % (kevent.kid,
- kevent.ts.time(),
- kevent.cpuid,
- proc,
- pid,
- kevent.name,
- self._format_params(kevent.params))
- else:
- kevt = json.dumps(dict(id=kevent.kid,
- timestamp=kevent.ts.strftime(self._timestamp_pattern),
- cpuid=kevent.cpuid,
- proc=proc,
- pid=pid,
- name=kevent.name,
- params=kevent.params))
-
- kevt += '\n'
- # write the output on the standard output stream
- write_console_unicode(self._stdout_handle, kevt,
- len(kevt),
- byref(c_ulong()),
- None)
-
- def _format_params(self, kparams):
- """Transforms the kevent parameters.
-
- Apply the rendering format on the kevent payload
- to transform it into more convenient structure
- sorted by parameter keys.
- """
- fmt = ', '.join('%s=%s' % (k, kparams[k]) for k in sorted(kparams.keys())) \
- .replace('\"', '')
- return '(%s)' % fmt
diff --git a/fibratus/output/elasticsearch.py b/fibratus/output/elasticsearch.py
deleted file mode 100644
index 771f23445..000000000
--- a/fibratus/output/elasticsearch.py
+++ /dev/null
@@ -1,95 +0,0 @@
-# Copyright 2016 by Nedim Sabic (RabbitStack)
-# All Rights Reserved.
-#
-# Licensed under the Apache License, Version 2.0 (the "License"); you may
-# not use this file except in compliance with the License. You may obtain
-# a copy of the License at
-#
-# http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
-# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
-# License for the specific language governing permissions and limitations
-# under the License.
-
-import elasticsearch
-import elasticsearch.helpers
-
-from fibratus.errors import InvalidPayloadError
-from fibratus.output.base import Output
-from datetime import datetime
-
-class ElasticsearchOutput(Output):
-
- def __init__(self, **kwargs):
- """Creates an instance of the Elasticsearch output adapter.
-
- Parameters
- ----------
-
- kwargs: dict
- Elasticsearch cluster configuration
- """
- Output.__init__(self)
-
- hosts = kwargs.pop('hosts', [])
- self._hosts = [dict(host=host.split(':')[0], port=int(host.split(':')[1])) for host in hosts]
- self._index_name = kwargs.pop('index', None)
- self._index_type = kwargs.pop('index_type', 'fixed')
- self._daily_index_format = kwargs.pop('daily_index_format', '%Y.%m.%d')
- self._document_type = kwargs.pop('document', None)
- self._bulk = kwargs.pop('bulk', False)
- self._username = kwargs.pop('username', None)
- self._password = kwargs.pop('password', None)
- self._config = {}
- if self._username and self._password:
- self._config['http_auth'] = (self._username, self._password,)
- self._config['use_ssl'] = kwargs.pop('ssl', False)
- self._elasticsearch = None
-
- def emit(self, body, **kwargs):
- if not self._elasticsearch:
- self._elasticsearch = elasticsearch.Elasticsearch(self._hosts, **self._config)
- if self._bulk:
- if not isinstance(body, list):
- raise InvalidPayloadError('invalid payload for bulk indexing. '
- 'list expected but %s found'
- % type(body))
- else:
- if not isinstance(body, dict):
- raise InvalidPayloadError('invalid payload for document. '
- 'dict expected but %s found'
- % type(body))
-
- self._index_name = kwargs.pop('index', self._index_name)
-
- # build index name for daily index types
- if 'daily' in self._index_type:
- self._index_name = '%s-%s' % (self._index_name, datetime.now().strftime(self._daily_index_format))
-
- if self._bulk:
- actions = [dict(_index=self._index_name, _type=self._document_type, _source=b) for b in body]
- elasticsearch.helpers.bulk(self._elasticsearch, actions)
- else:
- self._elasticsearch.index(self._index_name, self._document_type, body=body)
-
- @property
- def hosts(self):
- return self._hosts
-
- @property
- def index_name(self):
- return self._index_name
-
- @property
- def index_type(self):
- return self._index_type
-
- @property
- def document_type(self):
- return self._document_type
-
- @property
- def bulk(self):
- return self._bulk
diff --git a/fibratus/output/fs.py b/fibratus/output/fs.py
deleted file mode 100644
index 10fe507c5..000000000
--- a/fibratus/output/fs.py
+++ /dev/null
@@ -1,55 +0,0 @@
-# Copyright 2017 by Nedim Sabic (RabbitStack)
-# All Rights Reserved.
-#
-# Licensed under the Apache License, Version 2.0 (the "License"); you may
-# not use this file except in compliance with the License. You may obtain
-# a copy of the License at
-#
-# http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
-# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
-# License for the specific language governing permissions and limitations
-# under the License.
-
-from fibratus.output.base import Output
-import io
-import os
-import time
-import json
-
-
-class FsOutput(Output):
- """File system output.
-
- Implementation of the output which writes the stream of
- kernel events to a file.
- """
-
- def __init__(self, **kwargs):
- Output.__init__(self)
- self._path = kwargs.pop('path', None)
- self._fmt = kwargs.pop('format', 'json')
- self._mode = kwargs.pop('mode', 'a')
-
- filename = os.path.join(self._path,
- '%s.fibra' % time.strftime('%x')
- .replace('/', '-'))
- self.stream = io.open(filename, self._mode)
-
- def emit(self, body, **kwargs):
- if 'json' in self._fmt:
- self.stream.write(json.dumps(body) + '\n')
-
- @property
- def path(self):
- return self._path
-
- @property
- def format(self):
- return self._fmt
-
- @property
- def mode(self):
- return self._mode
\ No newline at end of file
diff --git a/fibratus/output/smtp.py b/fibratus/output/smtp.py
deleted file mode 100644
index 612ead8e0..000000000
--- a/fibratus/output/smtp.py
+++ /dev/null
@@ -1,82 +0,0 @@
-# Copyright 2016 by Nedim Sabic (RabbitStack)
-# All Rights Reserved.
-#
-# Licensed under the Apache License, Version 2.0 (the "License"); you may
-# not use this file except in compliance with the License. You may obtain
-# a copy of the License at
-#
-# http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
-# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
-# License for the specific language governing permissions and limitations
-# under the License.
-
-import os
-import smtplib
-
-from fibratus.output.base import Output
-
-
-class SmtpOutput(Output):
-
- def __init__(self, **kwargs):
- """Constructs a new instance of the SMTP outbound adapter.
-
- Parameters
- ----------
-
- kwargs: dict
- SMTP server and account configuration
- """
- Output.__init__(self)
- self._host = kwargs.pop('host', None)
- self._port = kwargs.pop('port', 587)
- self._from = kwargs.pop('from', None)
- self._to = kwargs.pop('to', [])
- self._password = kwargs.pop('password', None) or \
- os.environ.get('SMTP_PASS')
- self._smtp = None
-
- def emit(self, body, **kwargs):
- if not self._smtp:
- self._smtp = smtplib.SMTP(self._host, self._port)
- self._smtp.ehlo()
- self._smtp.starttls()
- self._smtp.ehlo()
- subject = kwargs.pop('subject', '')
- message = self._compose_message(subject, body)
- # try to authenticate with the server
- # before attempting to send the message
- try:
- self._smtp.login(self._from, self._password)
- self._smtp.sendmail(self._from, self._to, message)
- except smtplib.SMTPAuthenticationError:
- self.logger.error('Invalid SMTP credentials for %s account'
- % self._from)
- finally:
- self._smtp.quit()
-
- def _compose_message(self, subject, body):
- return """From: %s\r\nTo: %s\r\nSubject: %s\r\n\
-
- %s
- """ % (self._from, ", ".join(self._to),
- subject, body)
-
- @property
- def host(self):
- return self._host
-
- @property
- def port(self):
- return self._port
-
- @property
- def sender(self):
- return self._from
-
- @property
- def to(self):
- return self._to
diff --git a/fibratus/registry.py b/fibratus/registry.py
deleted file mode 100644
index 9815a64b0..000000000
--- a/fibratus/registry.py
+++ /dev/null
@@ -1,294 +0,0 @@
-# Copyright 2015/2016 by Nedim Sabic (RabbitStack)
-# http://rabbitstack.github.io
-# All Rights Reserved.
-#
-# Licensed under the Apache License, Version 2.0 (the "License"); you may
-# not use this file except in compliance with the License. You may obtain
-# a copy of the License at
-#
-# http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
-# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
-# License for the specific language governing permissions and limitations
-# under the License.
-import os
-from ctypes import cast, byref
-
-from fibratus.common import NA
-from fibratus.handle import HandleType
-from fibratus.kevent_types import *
-from fibratus.apidefs.registry import *
-from fibratus.apidefs.sys import malloc, free
-
-
-class HiveParser(object):
-
- def __init__(self, kevent, thread_registry):
- self._kcblocks = {}
- self._kevent = kevent
- self.thread_registry = thread_registry
- self.hive_regexs = [
- r'(?i)(REGISTRY\\MACHINE\\SOFTWARE)(.*)',
- r'(?i)(REGISTRY\\MACHINE\\HARDWARE)(.*)',
- r'(?i)(REGISTRY\\MACHINE\\SECURITY)(.*)',
- r'(?i)(REGISTRY\\MACHINE\\SYSTEM)(.*)',
- r'(?i)(REGISTRY\\MACHINE\\SAM)(.*)',
- r'(?i)(REGISTRY\\USER\\.DEFAULT)(.*)',
- r'(?i)(REGISTRY\\USER\\S-.+?)\\(.*)',
- r'(?i)(REGISTRY\\USER)(.*)']
- self._reg_value_types = [v.value for v in ValueType]
-
- @property
- def kcblocks(self):
- return self._kcblocks
-
- def remove_kcb(self, key_handle):
- if key_handle in self._kcblocks:
- self._kcblocks.pop(key_handle)
-
- def add_kcb(self, kkcb):
- """Adds a key control block (KCB).
-
- Parameters
- ----------
-
- kkcb: dict
- metadata for the KCB
-
- """
- handle = kkcb.key_handle
- # index the KCB by key handle
- # we also save the process and
- # thread id which created the KCB
- kcb = Kcb(handle, kkcb.key_name,
- kkcb.index,
- kkcb.status,
- kkcb.thread_id,
- kkcb.process_id)
- self._kcblocks[handle] = kcb
-
- def parse_hive(self, ketype, regkevt):
- """Parses a hive from the registry kernel event.
-
- Hive is a logical group of keys, subkeys and values
- which are commonly called as nodes.
-
- Parameters
- ----------
-
- ketype: tuple
- kernel event type
- regkevt: dict
- kernel registry event payload as forwarded from the
- event stream collector
- """
- hive = NA
- key = regkevt.key_name
- status = regkevt.status
- tid = regkevt.thread_id
- pid = regkevt.process_id
- index = regkevt.index
-
- self._kevent.tid = tid
- self._kevent.pid = pid
-
- # if the node handle (KCB handle) is equal to 0
- # we have the full node name. Otherwise
- # we have to query the key control blocks
- # to found the full node name
- handle = regkevt.key_handle
- if handle == 0:
- # find the hive by applying
- # the regular expression
- hive, key = self._dissect_hive(key)
- else:
- if handle in self._kcblocks:
- # KCB found. Concatenate the
- # full node path
- kcb = self._kcblocks[handle]
- full_path = '%s\%s' % (kcb.key, key)
- hive, key = self._dissect_hive(full_path)
- else:
- # we missed the KCB creation
- # lookup the handles
- # to find the key name
- thread = self.thread_registry.get_thread(pid)
- if thread:
- key_handles = [kh for kh in thread.handles if kh.handle_type is not None and
- kh.handle_type == HandleType.KEY]
- for khandle in key_handles:
- if ketype in [REG_CREATE_KEY,
- REG_DELETE_KEY,
- REG_OPEN_KEY,
- REG_QUERY_KEY]:
- # try to find the match of the key name
- # from registry key handle name.
- # Replace the backslash to prevent
- # bogus escape exceptions
- khandle_name = khandle.name
- f = re.findall(r"%s" % key.replace('\\', '_'),
- khandle_name.replace('\\', '_'))
- if len(f) > 0:
- hive, key = self._dissect_hive(khandle_name)
- kcb = Kcb(handle,
- khandle_name,
- index,
- status,
- tid,
- pid)
- self._kcblocks[handle] = kcb
- break
-
- if hive == NA:
- # set the unknown hive and
- # the partial node name
- key = '..\%s' % key
-
- if ketype in [REG_CREATE_KEY,
- REG_DELETE_KEY,
- REG_OPEN_KEY,
- REG_QUERY_KEY]:
- params = {
- 'hive': hive,
- 'key': key,
- 'status': status,
- 'tid': tid,
- 'pid': pid
- }
- self._kevent.params = params
- elif ketype in [REG_SET_VALUE,
- REG_DELETE_VALUE,
- REG_QUERY_VALUE]:
- if ketype == REG_SET_VALUE or ketype == REG_QUERY_VALUE:
- # we have the hive and the subkey
- # including the registry value name
- # which means we are able to query the content
- # of the registry value
- if hive != NA and not key.startswith('..'):
- # resolve the root key name
- # from the registry hive
- hkey = self._hive_to_hkey(hive)
- subkey, value_name = os.path.split(key)
- # get the value data and value type
- # from the registry
- value, value_type = self._query_value(hkey,
- subkey,
- value_name)
- self._kevent.params = dict(hive=hive, key=key,
- value_type=value_type,
- value=value,
- status=status,
- tid=tid,
- pid=pid)
- else:
- self._kevent.params = dict(hive=hive, key=key,
- value_type=NA,
- value=NA, status=status,
- tid=tid, pid=pid)
-
- else:
- self._kevent.params = dict(hive=hive, key=key,
- status=status,
- tid=tid,
- pid=pid)
-
- def _query_value(self, hkey, subkey, value_name):
- """Get value content and value type from registry.
-
- Parameters
- ----------
-
- hkey: HKEY
- handle to registry root key
- subkey: str
- path representing the subkey
- value:
- the name of the value
- """
- if not hkey:
- return NA, NA
- value_type = c_ulong()
- buff = malloc(MAX_BUFFER_SIZE)
- buff_size = c_ulong(MAX_BUFFER_SIZE)
-
- status = reg_get_value(hkey, c_wchar_p(subkey),
- c_wchar_p(value_name),
- RRF_RT_ANY,
- byref(value_type),
- buff, byref(buff_size))
- if status == ERROR_SUCCESS:
- value = cast(buff, c_wchar_p).value
- value_type = value_type.value
- if value_type in self._reg_value_types:
- if value_type == ValueType.REG_BINARY.value:
- value = ''
- [value_type] = [v.name for v in ValueType if v.value == value_type]
- else:
- value_type = ValueType.REG_NONE.name
- free(buff)
- return value, value_type
- else:
- free(buff)
- return NA, NA
-
- def _dissect_hive(self, key_name):
- """Extracts the hive name and the subkey from the key path.
-
- Parameters
- ----------
-
- key_name: str
- key path from whom the hive
- can be resolved
- """
- for rx in self.hive_regexs:
- # for each regex match it
- # against key path
- m = re.search(rx, key_name)
- if m and len(m.groups()) > 0:
- hive = m.group(1).upper()
- # hive found, now try
- # to get the node path
- if len(m.groups()) > 1:
- node = m.group(2)
- if node:
- # because the hive contains the
- # child node of the registry subkey
- # we have to include it
- _, hive_child = os.path.split(hive)
- if not node.startswith('\\'):
- node = '\\%s' % node
- node = '%s%s' % (hive_child, node)
- return hive.replace('\\', '_'), node
- return hive.replace('\\', '_'), key_name
- return key_name, key_name
-
- def _hive_to_hkey(self, hive):
- if re.match(r'(?i).*MACHINE.*', hive):
- return HKEY_LOCAL_MACHINE
- elif re.match(r'(?i).*USER_S-.*|\.DEFAULT', hive):
- return HKEY_USERS
- else:
- return None
-
-
-class Kcb(object):
- """The container for the Key Control Block data.
- """
- def __init__(self, handle, key, index,
- status, tid, pid):
- self._handle = handle
- self._key = key
- self._index = index
- self._status = status
- self._thread_id = tid
- self._process_id = pid
-
- @property
- def key(self):
- return self._key
-
-
-
diff --git a/fibratus/tcpip/__init__.py b/fibratus/tcpip/__init__.py
deleted file mode 100644
index b4b9e2a2a..000000000
--- a/fibratus/tcpip/__init__.py
+++ /dev/null
@@ -1,14 +0,0 @@
-# Copyright 2016 by Nedim Sabic (RabbitStack)
-# All Rights Reserved.
-#
-# Licensed under the Apache License, Version 2.0 (the "License"); you may
-# not use this file except in compliance with the License. You may obtain
-# a copy of the License at
-#
-# http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
-# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
-# License for the specific language governing permissions and limitations
-# under the License.
\ No newline at end of file
diff --git a/fibratus/tcpip/ports.py b/fibratus/tcpip/ports.py
deleted file mode 100644
index 7e5885f28..000000000
--- a/fibratus/tcpip/ports.py
+++ /dev/null
@@ -1,11095 +0,0 @@
-# Copyright 2016 by Nedim Sabic (RabbitStack)
-# All Rights Reserved.
-#
-# Licensed under the Apache License, Version 2.0 (the "License"); you may
-# not use this file except in compliance with the License. You may obtain
-# a copy of the License at
-#
-# http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
-# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
-# License for the specific language governing permissions and limitations
-# under the License.
-
-IANA_PORTS_TCP = {
- 1: "tcpmux",
- 2: "compressnet",
- 3: "compressnet",
- 5: "rje",
- 7: "echo",
- 9: "discard",
- 11: "systat",
- 13: "daytime",
- 17: "qotd",
- 18: "msp",
- 19: "chargen",
- 20: "ftp-data",
- 21: "ftp",
- 22: "ssh",
- 23: "telnet",
- 25: "smtp",
- 27: "nsw-fe",
- 29: "msg-icp",
- 31: "msg-auth",
- 33: "dsp",
- 37: "time",
- 38: "rap",
- 39: "rlp",
- 41: "graphics",
- 42: "name",
- 43: "nicname",
- 44: "mpm-flags",
- 45: "mpm",
- 46: "mpm-snd",
- 47: "ni-ftp",
- 48: "auditd",
- 49: "tacacs",
- 50: "re-mail-ck",
- 52: "xns-time",
- 53: "domain",
- 54: "xns-ch",
- 55: "isi-gl",
- 56: "xns-auth",
- 58: "xns-mail",
- 61: "ni-mail",
- 62: "acas",
- 63: "whoispp",
- 64: "covia",
- 65: "tacacs-ds",
- 66: "sql-net",
- 67: "bootps",
- 68: "bootpc",
- 69: "tftp",
- 70: "gopher",
- 71: "netrjs-1",
- 72: "netrjs-2",
- 73: "netrjs-3",
- 74: "netrjs-4",
- 76: "deos",
- 78: "vettcp",
- 79: "finger",
- 80: "http",
- 82: "xfer",
- 83: "mit-ml-dev",
- 84: "ctf",
- 85: "mit-ml-dev",
- 86: "mfcobol",
- 88: "kerberos",
- 89: "su-mit-tg",
- 90: "dnsix",
- 91: "mit-dov",
- 92: "npp",
- 93: "dcp",
- 94: "objcall",
- 95: "supdup",
- 96: "dixie",
- 97: "swift-rvf",
- 98: "tacnews",
- 99: "metagram",
- 101: "hostname",
- 102: "iso-tsap",
- 103: "gppitnp",
- 104: "acr-nema",
- 105: "cso",
- 106: "3com-tsmux",
- 107: "rtelnet",
- 108: "snagas",
- 109: "pop2",
- 110: "pop3",
- 111: "sunrpc",
- 112: "mcidas",
- 113: "ident",
- 115: "sftp",
- 116: "ansanotify",
- 117: "uucp-path",
- 118: "sqlserv",
- 119: "nntp",
- 120: "cfdptkt",
- 121: "erpc",
- 122: "smakynet",
- 123: "ntp",
- 124: "ansatrader",
- 125: "locus-map",
- 126: "nxedit",
- 127: "locus-con",
- 128: "gss-xlicen",
- 129: "pwdgen",
- 130: "cisco-fna",
- 131: "cisco-tna",
- 132: "cisco-sys",
- 133: "statsrv",
- 134: "ingres-net",
- 135: "epmap",
- 136: "profile",
- 137: "netbios-ns",
- 138: "netbios-dgm",
- 139: "netbios-ssn",
- 140: "emfis-data",
- 141: "emfis-cntl",
- 142: "bl-idm",
- 143: "imap",
- 144: "uma",
- 145: "uaac",
- 146: "iso-tp0",
- 147: "iso-ip",
- 148: "jargon",
- 149: "aed-512",
- 150: "sql-net",
- 151: "hems",
- 152: "bftp",
- 153: "sgmp",
- 154: "netsc-prod",
- 155: "netsc-dev",
- 156: "sqlsrv",
- 157: "knet-cmp",
- 158: "pcmail-srv",
- 159: "nss-routing",
- 160: "sgmp-traps",
- 161: "snmp",
- 162: "snmptrap",
- 163: "cmip-man",
- 164: "cmip-agent",
- 165: "xns-courier",
- 166: "s-net",
- 167: "namp",
- 168: "rsvd",
- 169: "send",
- 170: "print-srv",
- 171: "multiplex",
- 172: "cl-1",
- 173: "xyplex-mux",
- 174: "mailq",
- 175: "vmnet",
- 176: "genrad-mux",
- 177: "xdmcp",
- 178: "nextstep",
- 179: "bgp",
- 180: "ris",
- 181: "unify",
- 182: "audit",
- 183: "ocbinder",
- 184: "ocserver",
- 185: "remote-kis",
- 186: "kis",
- 187: "aci",
- 188: "mumps",
- 189: "qft",
- 190: "gacp",
- 191: "prospero",
- 192: "osu-nms",
- 193: "srmp",
- 194: "irc",
- 195: "dn6-nlm-aud",
- 196: "dn6-smm-red",
- 197: "dls",
- 198: "dls-mon",
- 199: "smux",
- 200: "src",
- 201: "at-rtmp",
- 202: "at-nbp",
- 203: "at-3",
- 204: "at-echo",
- 205: "at-5",
- 206: "at-zis",
- 207: "at-7",
- 208: "at-8",
- 209: "qmtp",
- 210: "z39-50",
- 211: "914c-g",
- 212: "anet",
- 213: "ipx",
- 214: "vmpwscs",
- 215: "softpc",
- 216: "CAIlic",
- 217: "dbase",
- 218: "mpp",
- 219: "uarps",
- 220: "imap3",
- 221: "fln-spx",
- 222: "rsh-spx",
- 223: "cdc",
- 224: "masqdialer",
- 242: "direct",
- 243: "sur-meas",
- 244: "inbusiness",
- 245: "link",
- 246: "dsp3270",
- 247: "subntbcst-tftp",
- 248: "bhfhs",
- 256: "rap",
- 257: "set",
- 259: "esro-gen",
- 260: "openport",
- 261: "nsiiops",
- 262: "arcisdms",
- 263: "hdap",
- 264: "bgmp",
- 265: "x-bone-ctl",
- 266: "sst",
- 267: "td-service",
- 268: "td-replica",
- 269: "manet",
- 271: "pt-tls",
- 280: "http-mgmt",
- 281: "personal-link",
- 282: "cableport-ax",
- 283: "rescap",
- 284: "corerjd",
- 286: "fxp",
- 287: "k-block",
- 308: "novastorbakcup",
- 309: "entrusttime",
- 310: "bhmds",
- 311: "asip-webadmin",
- 312: "vslmp",
- 313: "magenta-logic",
- 314: "opalis-robot",
- 315: "dpsi",
- 316: "decauth",
- 317: "zannet",
- 318: "pkix-timestamp",
- 319: "ptp-event",
- 320: "ptp-general",
- 321: "pip",
- 322: "rtsps",
- 323: "rpki-rtr",
- 324: "rpki-rtr-tls",
- 333: "texar",
- 344: "pdap",
- 345: "pawserv",
- 346: "zserv",
- 347: "fatserv",
- 348: "csi-sgwp",
- 349: "mftp",
- 350: "matip-type-a",
- 351: "matip-type-b",
- 352: "dtag-ste-sb",
- 353: "ndsauth",
- 354: "bh611",
- 355: "datex-asn",
- 356: "cloanto-net-1",
- 357: "bhevent",
- 358: "shrinkwrap",
- 359: "nsrmp",
- 360: "scoi2odialog",
- 361: "semantix",
- 362: "srssend",
- 363: "rsvp-tunnel",
- 364: "aurora-cmgr",
- 365: "dtk",
- 366: "odmr",
- 367: "mortgageware",
- 368: "qbikgdp",
- 369: "rpc2portmap",
- 370: "codaauth2",
- 371: "clearcase",
- 372: "ulistproc",
- 373: "legent-1",
- 374: "legent-2",
- 375: "hassle",
- 376: "nip",
- 377: "tnETOS",
- 378: "dsETOS",
- 379: "is99c",
- 380: "is99s",
- 381: "hp-collector",
- 382: "hp-managed-node",
- 383: "hp-alarm-mgr",
- 384: "arns",
- 385: "ibm-app",
- 386: "asa",
- 387: "aurp",
- 388: "unidata-ldm",
- 389: "ldap",
- 390: "uis",
- 391: "synotics-relay",
- 392: "synotics-broker",
- 393: "meta5",
- 394: "embl-ndt",
- 395: "netcp",
- 396: "netware-ip",
- 397: "mptn",
- 398: "kryptolan",
- 399: "iso-tsap-c2",
- 400: "osb-sd",
- 401: "ups",
- 402: "genie",
- 403: "decap",
- 404: "nced",
- 405: "ncld",
- 406: "imsp",
- 407: "timbuktu",
- 408: "prm-sm",
- 409: "prm-nm",
- 410: "decladebug",
- 411: "rmt",
- 412: "synoptics-trap",
- 413: "smsp",
- 414: "infoseek",
- 415: "bnet",
- 416: "silverplatter",
- 417: "onmux",
- 418: "hyper-g",
- 419: "ariel1",
- 420: "smpte",
- 421: "ariel2",
- 422: "ariel3",
- 423: "opc-job-start",
- 424: "opc-job-track",
- 425: "icad-el",
- 426: "smartsdp",
- 427: "svrloc",
- 428: "ocs-cmu",
- 429: "ocs-amu",
- 430: "utmpsd",
- 431: "utmpcd",
- 432: "iasd",
- 433: "nnsp",
- 434: "mobileip-agent",
- 435: "mobilip-mn",
- 436: "dna-cml",
- 437: "comscm",
- 438: "dsfgw",
- 439: "dasp",
- 440: "sgcp",
- 441: "decvms-sysmgt",
- 442: "cvc-hostd",
- 443: "https",
- 444: "snpp",
- 445: "microsoft-ds",
- 446: "ddm-rdb",
- 447: "ddm-dfm",
- 448: "ddm-ssl",
- 449: "as-servermap",
- 450: "tserver",
- 451: "sfs-smp-net",
- 452: "sfs-config",
- 453: "creativeserver",
- 454: "contentserver",
- 455: "creativepartnr",
- 456: "macon-tcp",
- 457: "scohelp",
- 458: "appleqtc",
- 459: "ampr-rcmd",
- 460: "skronk",
- 461: "datasurfsrv",
- 462: "datasurfsrvsec",
- 463: "alpes",
- 464: "kpasswd",
- 465: "urd",
- 466: "digital-vrc",
- 467: "mylex-mapd",
- 468: "photuris",
- 469: "rcp",
- 470: "scx-proxy",
- 471: "mondex",
- 472: "ljk-login",
- 473: "hybrid-pop",
- 474: "tn-tl-w1",
- 475: "tcpnethaspsrv",
- 476: "tn-tl-fd1",
- 477: "ss7ns",
- 478: "spsc",
- 479: "iafserver",
- 480: "iafdbase",
- 481: "ph",
- 482: "bgs-nsi",
- 483: "ulpnet",
- 484: "integra-sme",
- 485: "powerburst",
- 486: "avian",
- 487: "saft",
- 488: "gss-http",
- 489: "nest-protocol",
- 490: "micom-pfs",
- 491: "go-login",
- 492: "ticf-1",
- 493: "ticf-2",
- 494: "pov-ray",
- 495: "intecourier",
- 496: "pim-rp-disc",
- 497: "retrospect",
- 498: "siam",
- 499: "iso-ill",
- 500: "isakmp",
- 501: "stmf",
- 502: "mbap",
- 503: "intrinsa",
- 504: "citadel",
- 505: "mailbox-lm",
- 506: "ohimsrv",
- 507: "crs",
- 508: "xvttp",
- 509: "snare",
- 510: "fcp",
- 511: "passgo",
- 512: "exec",
- 513: "login",
- 514: "shell",
- 515: "printer",
- 516: "videotex",
- 517: "talk",
- 518: "ntalk",
- 519: "utime",
- 520: "efs",
- 521: "ripng",
- 522: "ulp",
- 523: "ibm-db2",
- 524: "ncp",
- 525: "timed",
- 526: "tempo",
- 527: "stx",
- 528: "custix",
- 529: "irc-serv",
- 530: "courier",
- 531: "conference",
- 532: "netnews",
- 533: "netwall",
- 534: "windream",
- 535: "iiop",
- 536: "opalis-rdv",
- 537: "nmsp",
- 538: "gdomap",
- 539: "apertus-ldp",
- 540: "uucp",
- 541: "uucp-rlogin",
- 542: "commerce",
- 543: "klogin",
- 544: "kshell",
- 545: "appleqtcsrvr",
- 546: "dhcpv6-client",
- 547: "dhcpv6-server",
- 548: "afpovertcp",
- 549: "idfp",
- 550: "new-rwho",
- 551: "cybercash",
- 552: "devshr-nts",
- 553: "pirp",
- 554: "rtsp",
- 555: "dsf",
- 556: "remotefs",
- 557: "openvms-sysipc",
- 558: "sdnskmp",
- 559: "teedtap",
- 560: "rmonitor",
- 561: "monitor",
- 562: "chshell",
- 563: "nntps",
- 564: "9pfs",
- 565: "whoami",
- 566: "streettalk",
- 567: "banyan-rpc",
- 568: "ms-shuttle",
- 569: "ms-rome",
- 570: "meter",
- 571: "meter",
- 572: "sonar",
- 573: "banyan-vip",
- 574: "ftp-agent",
- 575: "vemmi",
- 576: "ipcd",
- 577: "vnas",
- 578: "ipdd",
- 579: "decbsrv",
- 580: "sntp-heartbeat",
- 581: "bdp",
- 582: "scc-security",
- 583: "philips-vc",
- 584: "keyserver",
- 586: "password-chg",
- 587: "submission",
- 588: "cal",
- 589: "eyelink",
- 590: "tns-cml",
- 591: "http-alt",
- 592: "eudora-set",
- 593: "http-rpc-epmap",
- 594: "tpip",
- 595: "cab-protocol",
- 596: "smsd",
- 597: "ptcnameservice",
- 598: "sco-websrvrmg3",
- 599: "acp",
- 600: "ipcserver",
- 601: "syslog-conn",
- 602: "xmlrpc-beep",
- 603: "idxp",
- 604: "tunnel",
- 605: "soap-beep",
- 606: "urm",
- 607: "nqs",
- 608: "sift-uft",
- 609: "npmp-trap",
- 610: "npmp-local",
- 611: "npmp-gui",
- 612: "hmmp-ind",
- 613: "hmmp-op",
- 614: "sshell",
- 615: "sco-inetmgr",
- 616: "sco-sysmgr",
- 617: "sco-dtmgr",
- 618: "dei-icda",
- 619: "compaq-evm",
- 620: "sco-websrvrmgr",
- 621: "escp-ip",
- 622: "collaborator",
- 623: "oob-ws-http",
- 624: "cryptoadmin",
- 625: "dec-dlm",
- 626: "asia",
- 627: "passgo-tivoli",
- 628: "qmqp",
- 629: "3com-amp3",
- 630: "rda",
- 631: "ipp",
- 632: "bmpp",
- 633: "servstat",
- 634: "ginad",
- 635: "rlzdbase",
- 636: "ldaps",
- 637: "lanserver",
- 638: "mcns-sec",
- 639: "msdp",
- 640: "entrust-sps",
- 641: "repcmd",
- 642: "esro-emsdp",
- 643: "sanity",
- 644: "dwr",
- 645: "pssc",
- 646: "ldp",
- 647: "dhcp-failover",
- 648: "rrp",
- 649: "cadview-3d",
- 650: "obex",
- 651: "ieee-mms",
- 652: "hello-port",
- 653: "repscmd",
- 654: "aodv",
- 655: "tinc",
- 656: "spmp",
- 657: "rmc",
- 658: "tenfold",
- 660: "mac-srvr-admin",
- 661: "hap",
- 662: "pftp",
- 663: "purenoise",
- 664: "oob-ws-https",
- 665: "sun-dr",
- 666: "mdqs",
- 667: "disclose",
- 668: "mecomm",
- 669: "meregister",
- 670: "vacdsm-sws",
- 671: "vacdsm-app",
- 672: "vpps-qua",
- 673: "cimplex",
- 674: "acap",
- 675: "dctp",
- 676: "vpps-via",
- 677: "vpp",
- 678: "ggf-ncp",
- 679: "mrm",
- 680: "entrust-aaas",
- 681: "entrust-aams",
- 682: "xfr",
- 683: "corba-iiop",
- 684: "corba-iiop-ssl",
- 685: "mdc-portmapper",
- 686: "hcp-wismar",
- 687: "asipregistry",
- 688: "realm-rusd",
- 689: "nmap",
- 690: "vatp",
- 691: "msexch-routing",
- 692: "hyperwave-isp",
- 693: "connendp",
- 694: "ha-cluster",
- 695: "ieee-mms-ssl",
- 696: "rushd",
- 697: "uuidgen",
- 698: "olsr",
- 699: "accessnetwork",
- 700: "epp",
- 701: "lmp",
- 702: "iris-beep",
- 704: "elcsd",
- 705: "agentx",
- 706: "silc",
- 707: "borland-dsj",
- 709: "entrust-kmsh",
- 710: "entrust-ash",
- 711: "cisco-tdp",
- 712: "tbrpf",
- 713: "iris-xpc",
- 714: "iris-xpcs",
- 715: "iris-lwz",
- 729: "netviewdm1",
- 730: "netviewdm2",
- 731: "netviewdm3",
- 741: "netgw",
- 742: "netrcs",
- 744: "flexlm",
- 747: "fujitsu-dev",
- 748: "ris-cm",
- 749: "kerberos-adm",
- 750: "rfile",
- 751: "pump",
- 752: "qrh",
- 753: "rrh",
- 754: "tell",
- 758: "nlogin",
- 759: "con",
- 760: "ns",
- 761: "rxe",
- 762: "quotad",
- 763: "cycleserv",
- 764: "omserv",
- 765: "webster",
- 767: "phonebook",
- 769: "vid",
- 770: "cadlock",
- 771: "rtip",
- 772: "cycleserv2",
- 773: "submit",
- 774: "rpasswd",
- 775: "entomb",
- 776: "wpages",
- 777: "multiling-http",
- 780: "wpgs",
- 800: "mdbs-daemon",
- 801: "device",
- 802: "mbap-s",
- 810: "fcp-udp",
- 828: "itm-mcell-s",
- 829: "pkix-3-ca-ra",
- 830: "netconf-ssh",
- 831: "netconf-beep",
- 832: "netconfsoaphttp",
- 833: "netconfsoapbeep",
- 847: "dhcp-failover2",
- 848: "gdoi",
- 860: "iscsi",
- 861: "owamp-control",
- 862: "twamp-control",
- 873: "rsync",
- 886: "iclcnet-locate",
- 887: "iclcnet-svinfo",
- 888: "accessbuilder",
- 900: "omginitialrefs",
- 901: "smpnameres",
- 902: "ideafarm-door",
- 903: "ideafarm-panic",
- 910: "kink",
- 911: "xact-backup",
- 912: "apex-mesh",
- 913: "apex-edge",
- 989: "ftps-data",
- 990: "ftps",
- 991: "nas",
- 992: "telnets",
- 993: "imaps",
- 995: "pop3s",
- 996: "vsinet",
- 997: "maitrd",
- 998: "busboy",
- 999: "garcon",
- 1000: "cadlock2",
- 1010: "surf",
- 1021: "exp1",
- 1022: "exp2",
- 1025: "blackjack",
- 1026: "cap",
- 1029: "solid-mux",
- 1033: "netinfo-local",
- 1034: "activesync",
- 1035: "mxxrlogin",
- 1036: "nsstp",
- 1037: "ams",
- 1038: "mtqp",
- 1039: "sbl",
- 1040: "netarx",
- 1041: "danf-ak2",
- 1042: "afrog",
- 1043: "boinc-client",
- 1044: "dcutility",
- 1045: "fpitp",
- 1046: "wfremotertm",
- 1047: "neod1",
- 1048: "neod2",
- 1049: "td-postman",
- 1050: "cma",
- 1051: "optima-vnet",
- 1052: "ddt",
- 1053: "remote-as",
- 1054: "brvread",
- 1055: "ansyslmd",
- 1056: "vfo",
- 1057: "startron",
- 1058: "nim",
- 1059: "nimreg",
- 1060: "polestar",
- 1061: "kiosk",
- 1062: "veracity",
- 1063: "kyoceranetdev",
- 1064: "jstel",
- 1065: "syscomlan",
- 1066: "fpo-fns",
- 1067: "instl-boots",
- 1068: "instl-bootc",
- 1069: "cognex-insight",
- 1070: "gmrupdateserv",
- 1071: "bsquare-voip",
- 1072: "cardax",
- 1073: "bridgecontrol",
- 1074: "warmspotMgmt",
- 1075: "rdrmshc",
- 1076: "dab-sti-c",
- 1077: "imgames",
- 1078: "avocent-proxy",
- 1079: "asprovatalk",
- 1080: "socks",
- 1081: "pvuniwien",
- 1082: "amt-esd-prot",
- 1083: "ansoft-lm-1",
- 1084: "ansoft-lm-2",
- 1085: "webobjects",
- 1086: "cplscrambler-lg",
- 1087: "cplscrambler-in",
- 1088: "cplscrambler-al",
- 1089: "ff-annunc",
- 1090: "ff-fms",
- 1091: "ff-sm",
- 1092: "obrpd",
- 1093: "proofd",
- 1094: "rootd",
- 1095: "nicelink",
- 1096: "cnrprotocol",
- 1097: "sunclustermgr",
- 1098: "rmiactivation",
- 1099: "rmiregistry",
- 1100: "mctp",
- 1101: "pt2-discover",
- 1102: "adobeserver-1",
- 1103: "adobeserver-2",
- 1104: "xrl",
- 1105: "ftranhc",
- 1106: "isoipsigport-1",
- 1107: "isoipsigport-2",
- 1108: "ratio-adp",
- 1110: "webadmstart",
- 1111: "lmsocialserver",
- 1112: "icp",
- 1113: "ltp-deepspace",
- 1114: "mini-sql",
- 1115: "ardus-trns",
- 1116: "ardus-cntl",
- 1117: "ardus-mtrns",
- 1118: "sacred",
- 1119: "bnetgame",
- 1120: "bnetfile",
- 1121: "rmpp",
- 1122: "availant-mgr",
- 1123: "murray",
- 1124: "hpvmmcontrol",
- 1125: "hpvmmagent",
- 1126: "hpvmmdata",
- 1127: "kwdb-commn",
- 1128: "saphostctrl",
- 1129: "saphostctrls",
- 1130: "casp",
- 1131: "caspssl",
- 1132: "kvm-via-ip",
- 1133: "dfn",
- 1134: "aplx",
- 1135: "omnivision",
- 1136: "hhb-gateway",
- 1137: "trim",
- 1138: "encrypted-admin",
- 1139: "evm",
- 1140: "autonoc",
- 1141: "mxomss",
- 1142: "edtools",
- 1143: "imyx",
- 1144: "fuscript",
- 1145: "x9-icue",
- 1146: "audit-transfer",
- 1147: "capioverlan",
- 1148: "elfiq-repl",
- 1149: "bvtsonar",
- 1150: "blaze",
- 1151: "unizensus",
- 1152: "winpoplanmess",
- 1153: "c1222-acse",
- 1154: "resacommunity",
- 1155: "nfa",
- 1156: "iascontrol-oms",
- 1157: "iascontrol",
- 1158: "dbcontrol-oms",
- 1159: "oracle-oms",
- 1160: "olsv",
- 1161: "health-polling",
- 1162: "health-trap",
- 1163: "sddp",
- 1164: "qsm-proxy",
- 1165: "qsm-gui",
- 1166: "qsm-remote",
- 1167: "cisco-ipsla",
- 1168: "vchat",
- 1169: "tripwire",
- 1170: "atc-lm",
- 1171: "atc-appserver",
- 1172: "dnap",
- 1173: "d-cinema-rrp",
- 1174: "fnet-remote-ui",
- 1175: "dossier",
- 1176: "indigo-server",
- 1177: "dkmessenger",
- 1178: "sgi-storman",
- 1179: "b2n",
- 1180: "mc-client",
- 1181: "3comnetman",
- 1182: "accelenet",
- 1183: "llsurfup-http",
- 1184: "llsurfup-https",
- 1185: "catchpole",
- 1186: "mysql-cluster",
- 1187: "alias",
- 1188: "hp-webadmin",
- 1189: "unet",
- 1190: "commlinx-avl",
- 1191: "gpfs",
- 1192: "caids-sensor",
- 1193: "fiveacross",
- 1194: "openvpn",
- 1195: "rsf-1",
- 1196: "netmagic",
- 1197: "carrius-rshell",
- 1198: "cajo-discovery",
- 1199: "dmidi",
- 1200: "scol",
- 1201: "nucleus-sand",
- 1202: "caiccipc",
- 1203: "ssslic-mgr",
- 1204: "ssslog-mgr",
- 1205: "accord-mgc",
- 1206: "anthony-data",
- 1207: "metasage",
- 1208: "seagull-ais",
- 1209: "ipcd3",
- 1210: "eoss",
- 1211: "groove-dpp",
- 1212: "lupa",
- 1213: "mpc-lifenet",
- 1214: "kazaa",
- 1215: "scanstat-1",
- 1216: "etebac5",
- 1217: "hpss-ndapi",
- 1218: "aeroflight-ads",
- 1219: "aeroflight-ret",
- 1220: "qt-serveradmin",
- 1221: "sweetware-apps",
- 1222: "nerv",
- 1223: "tgp",
- 1224: "vpnz",
- 1225: "slinkysearch",
- 1226: "stgxfws",
- 1227: "dns2go",
- 1228: "florence",
- 1229: "zented",
- 1230: "periscope",
- 1231: "menandmice-lpm",
- 1232: "first-defense",
- 1233: "univ-appserver",
- 1234: "search-agent",
- 1235: "mosaicsyssvc1",
- 1236: "bvcontrol",
- 1237: "tsdos390",
- 1238: "hacl-qs",
- 1239: "nmsd",
- 1240: "instantia",
- 1241: "nessus",
- 1242: "nmasoverip",
- 1243: "serialgateway",
- 1244: "isbconference1",
- 1245: "isbconference2",
- 1246: "payrouter",
- 1247: "visionpyramid",
- 1248: "hermes",
- 1249: "mesavistaco",
- 1250: "swldy-sias",
- 1251: "servergraph",
- 1252: "bspne-pcc",
- 1253: "q55-pcc",
- 1254: "de-noc",
- 1255: "de-cache-query",
- 1256: "de-server",
- 1257: "shockwave2",
- 1258: "opennl",
- 1259: "opennl-voice",
- 1260: "ibm-ssd",
- 1261: "mpshrsv",
- 1262: "qnts-orb",
- 1263: "dka",
- 1264: "prat",
- 1265: "dssiapi",
- 1266: "dellpwrappks",
- 1267: "epc",
- 1268: "propel-msgsys",
- 1269: "watilapp",
- 1270: "opsmgr",
- 1271: "excw",
- 1272: "cspmlockmgr",
- 1273: "emc-gateway",
- 1274: "t1distproc",
- 1275: "ivcollector",
- 1277: "miva-mqs",
- 1278: "dellwebadmin-1",
- 1279: "dellwebadmin-2",
- 1280: "pictrography",
- 1281: "healthd",
- 1282: "emperion",
- 1283: "productinfo",
- 1284: "iee-qfx",
- 1285: "neoiface",
- 1286: "netuitive",
- 1287: "routematch",
- 1288: "navbuddy",
- 1289: "jwalkserver",
- 1290: "winjaserver",
- 1291: "seagulllms",
- 1292: "dsdn",
- 1293: "pkt-krb-ipsec",
- 1294: "cmmdriver",
- 1295: "ehtp",
- 1296: "dproxy",
- 1297: "sdproxy",
- 1298: "lpcp",
- 1299: "hp-sci",
- 1300: "h323hostcallsc",
- 1301: "ci3-software-1",
- 1302: "ci3-software-2",
- 1303: "sftsrv",
- 1304: "boomerang",
- 1305: "pe-mike",
- 1306: "re-conn-proto",
- 1307: "pacmand",
- 1308: "odsi",
- 1309: "jtag-server",
- 1310: "husky",
- 1311: "rxmon",
- 1312: "sti-envision",
- 1313: "bmc-patroldb",
- 1314: "pdps",
- 1315: "els",
- 1316: "exbit-escp",
- 1317: "vrts-ipcserver",
- 1318: "krb5gatekeeper",
- 1319: "amx-icsp",
- 1320: "amx-axbnet",
- 1321: "pip",
- 1322: "novation",
- 1323: "brcd",
- 1324: "delta-mcp",
- 1325: "dx-instrument",
- 1326: "wimsic",
- 1327: "ultrex",
- 1328: "ewall",
- 1329: "netdb-export",
- 1330: "streetperfect",
- 1331: "intersan",
- 1332: "pcia-rxp-b",
- 1333: "passwrd-policy",
- 1334: "writesrv",
- 1335: "digital-notary",
- 1336: "ischat",
- 1337: "menandmice-dns",
- 1338: "wmc-log-svc",
- 1339: "kjtsiteserver",
- 1340: "naap",
- 1341: "qubes",
- 1342: "esbroker",
- 1343: "re101",
- 1344: "icap",
- 1345: "vpjp",
- 1346: "alta-ana-lm",
- 1347: "bbn-mmc",
- 1348: "bbn-mmx",
- 1349: "sbook",
- 1350: "editbench",
- 1351: "equationbuilder",
- 1352: "lotusnote",
- 1353: "relief",
- 1354: "XSIP-network",
- 1355: "intuitive-edge",
- 1356: "cuillamartin",
- 1357: "pegboard",
- 1358: "connlcli",
- 1359: "ftsrv",
- 1360: "mimer",
- 1361: "linx",
- 1362: "timeflies",
- 1363: "ndm-requester",
- 1364: "ndm-server",
- 1365: "adapt-sna",
- 1366: "netware-csp",
- 1367: "dcs",
- 1368: "screencast",
- 1369: "gv-us",
- 1370: "us-gv",
- 1371: "fc-cli",
- 1372: "fc-ser",
- 1373: "chromagrafx",
- 1374: "molly",
- 1375: "bytex",
- 1376: "ibm-pps",
- 1377: "cichlid",
- 1378: "elan",
- 1379: "dbreporter",
- 1380: "telesis-licman",
- 1381: "apple-licman",
- 1382: "udt-os",
- 1383: "gwha",
- 1384: "os-licman",
- 1385: "atex-elmd",
- 1386: "checksum",
- 1387: "cadsi-lm",
- 1388: "objective-dbc",
- 1389: "iclpv-dm",
- 1390: "iclpv-sc",
- 1391: "iclpv-sas",
- 1392: "iclpv-pm",
- 1393: "iclpv-nls",
- 1394: "iclpv-nlc",
- 1395: "iclpv-wsm",
- 1396: "dvl-activemail",
- 1397: "audio-activmail",
- 1398: "video-activmail",
- 1399: "cadkey-licman",
- 1400: "cadkey-tablet",
- 1401: "goldleaf-licman",
- 1402: "prm-sm-np",
- 1403: "prm-nm-np",
- 1404: "igi-lm",
- 1405: "ibm-res",
- 1406: "netlabs-lm",
- 1407: "dbsa-lm",
- 1408: "sophia-lm",
- 1409: "here-lm",
- 1410: "hiq",
- 1411: "af",
- 1412: "innosys",
- 1413: "innosys-acl",
- 1414: "ibm-mqseries",
- 1415: "dbstar",
- 1416: "novell-lu6-2",
- 1417: "timbuktu-srv1",
- 1418: "timbuktu-srv2",
- 1419: "timbuktu-srv3",
- 1420: "timbuktu-srv4",
- 1421: "gandalf-lm",
- 1422: "autodesk-lm",
- 1423: "essbase",
- 1424: "hybrid",
- 1425: "zion-lm",
- 1426: "sais",
- 1427: "mloadd",
- 1428: "informatik-lm",
- 1429: "nms",
- 1430: "tpdu",
- 1431: "rgtp",
- 1432: "blueberry-lm",
- 1433: "ms-sql-s",
- 1434: "ms-sql-m",
- 1435: "ibm-cics",
- 1436: "saism",
- 1437: "tabula",
- 1438: "eicon-server",
- 1439: "eicon-x25",
- 1440: "eicon-slp",
- 1441: "cadis-1",
- 1442: "cadis-2",
- 1443: "ies-lm",
- 1444: "marcam-lm",
- 1445: "proxima-lm",
- 1446: "ora-lm",
- 1447: "apri-lm",
- 1448: "oc-lm",
- 1449: "peport",
- 1450: "dwf",
- 1451: "infoman",
- 1452: "gtegsc-lm",
- 1453: "genie-lm",
- 1454: "interhdl-elmd",
- 1455: "esl-lm",
- 1456: "dca",
- 1457: "valisys-lm",
- 1458: "nrcabq-lm",
- 1459: "proshare1",
- 1460: "proshare2",
- 1461: "ibm-wrless-lan",
- 1462: "world-lm",
- 1463: "nucleus",
- 1464: "msl-lmd",
- 1465: "pipes",
- 1466: "oceansoft-lm",
- 1467: "csdmbase",
- 1468: "csdm",
- 1469: "aal-lm",
- 1470: "uaiact",
- 1471: "csdmbase",
- 1472: "csdm",
- 1473: "openmath",
- 1474: "telefinder",
- 1475: "taligent-lm",
- 1476: "clvm-cfg",
- 1477: "ms-sna-server",
- 1478: "ms-sna-base",
- 1479: "dberegister",
- 1480: "pacerforum",
- 1481: "airs",
- 1482: "miteksys-lm",
- 1483: "afs",
- 1484: "confluent",
- 1485: "lansource",
- 1486: "nms-topo-serv",
- 1487: "localinfosrvr",
- 1488: "docstor",
- 1489: "dmdocbroker",
- 1490: "insitu-conf",
- 1492: "stone-design-1",
- 1493: "netmap-lm",
- 1494: "ica",
- 1495: "cvc",
- 1496: "liberty-lm",
- 1497: "rfx-lm",
- 1498: "sybase-sqlany",
- 1499: "fhc",
- 1500: "vlsi-lm",
- 1501: "saiscm",
- 1502: "shivadiscovery",
- 1503: "imtc-mcs",
- 1504: "evb-elm",
- 1505: "funkproxy",
- 1506: "utcd",
- 1507: "symplex",
- 1508: "diagmond",
- 1509: "robcad-lm",
- 1510: "mvx-lm",
- 1511: "3l-l1",
- 1512: "wins",
- 1513: "fujitsu-dtc",
- 1514: "fujitsu-dtcns",
- 1515: "ifor-protocol",
- 1516: "vpad",
- 1517: "vpac",
- 1518: "vpvd",
- 1519: "vpvc",
- 1520: "atm-zip-office",
- 1521: "ncube-lm",
- 1522: "ricardo-lm",
- 1523: "cichild-lm",
- 1524: "ingreslock",
- 1525: "orasrv",
- 1526: "pdap-np",
- 1527: "tlisrv",
- 1529: "coauthor",
- 1530: "rap-service",
- 1531: "rap-listen",
- 1532: "miroconnect",
- 1533: "virtual-places",
- 1534: "micromuse-lm",
- 1535: "ampr-info",
- 1536: "ampr-inter",
- 1537: "sdsc-lm",
- 1538: "3ds-lm",
- 1539: "intellistor-lm",
- 1540: "rds",
- 1541: "rds2",
- 1542: "gridgen-elmd",
- 1543: "simba-cs",
- 1544: "aspeclmd",
- 1545: "vistium-share",
- 1546: "abbaccuray",
- 1547: "laplink",
- 1548: "axon-lm",
- 1549: "shivahose",
- 1550: "3m-image-lm",
- 1551: "hecmtl-db",
- 1552: "pciarray",
- 1553: "sna-cs",
- 1554: "caci-lm",
- 1555: "livelan",
- 1556: "veritas-pbx",
- 1557: "arbortext-lm",
- 1558: "xingmpeg",
- 1559: "web2host",
- 1560: "asci-val",
- 1561: "facilityview",
- 1562: "pconnectmgr",
- 1563: "cadabra-lm",
- 1564: "pay-per-view",
- 1565: "winddlb",
- 1566: "corelvideo",
- 1567: "jlicelmd",
- 1568: "tsspmap",
- 1569: "ets",
- 1570: "orbixd",
- 1571: "rdb-dbs-disp",
- 1572: "chip-lm",
- 1573: "itscomm-ns",
- 1574: "mvel-lm",
- 1575: "oraclenames",
- 1576: "moldflow-lm",
- 1577: "hypercube-lm",
- 1578: "jacobus-lm",
- 1579: "ioc-sea-lm",
- 1580: "tn-tl-r1",
- 1581: "mil-2045-47001",
- 1582: "msims",
- 1583: "simbaexpress",
- 1584: "tn-tl-fd2",
- 1585: "intv",
- 1586: "ibm-abtact",
- 1587: "pra-elmd",
- 1588: "triquest-lm",
- 1589: "vqp",
- 1590: "gemini-lm",
- 1591: "ncpm-pm",
- 1592: "commonspace",
- 1593: "mainsoft-lm",
- 1594: "sixtrak",
- 1595: "radio",
- 1596: "radio-sm",
- 1597: "orbplus-iiop",
- 1598: "picknfs",
- 1599: "simbaservices",
- 1600: "issd",
- 1601: "aas",
- 1602: "inspect",
- 1603: "picodbc",
- 1604: "icabrowser",
- 1605: "slp",
- 1606: "slm-api",
- 1607: "stt",
- 1608: "smart-lm",
- 1609: "isysg-lm",
- 1610: "taurus-wh",
- 1611: "ill",
- 1612: "netbill-trans",
- 1613: "netbill-keyrep",
- 1614: "netbill-cred",
- 1615: "netbill-auth",
- 1616: "netbill-prod",
- 1617: "nimrod-agent",
- 1618: "skytelnet",
- 1619: "xs-openstorage",
- 1620: "faxportwinport",
- 1621: "softdataphone",
- 1622: "ontime",
- 1623: "jaleosnd",
- 1624: "udp-sr-port",
- 1625: "svs-omagent",
- 1626: "shockwave",
- 1627: "t128-gateway",
- 1628: "lontalk-norm",
- 1629: "lontalk-urgnt",
- 1630: "oraclenet8cman",
- 1631: "visitview",
- 1632: "pammratc",
- 1633: "pammrpc",
- 1634: "loaprobe",
- 1635: "edb-server1",
- 1636: "isdc",
- 1637: "islc",
- 1638: "ismc",
- 1639: "cert-initiator",
- 1640: "cert-responder",
- 1641: "invision",
- 1642: "isis-am",
- 1643: "isis-ambc",
- 1644: "saiseh",
- 1645: "sightline",
- 1646: "sa-msg-port",
- 1647: "rsap",
- 1648: "concurrent-lm",
- 1649: "kermit",
- 1650: "nkd",
- 1651: "shiva-confsrvr",
- 1652: "xnmp",
- 1653: "alphatech-lm",
- 1654: "stargatealerts",
- 1655: "dec-mbadmin",
- 1656: "dec-mbadmin-h",
- 1657: "fujitsu-mmpdc",
- 1658: "sixnetudr",
- 1659: "sg-lm",
- 1660: "skip-mc-gikreq",
- 1661: "netview-aix-1",
- 1662: "netview-aix-2",
- 1663: "netview-aix-3",
- 1664: "netview-aix-4",
- 1665: "netview-aix-5",
- 1666: "netview-aix-6",
- 1667: "netview-aix-7",
- 1668: "netview-aix-8",
- 1669: "netview-aix-9",
- 1670: "netview-aix-10",
- 1671: "netview-aix-11",
- 1672: "netview-aix-12",
- 1673: "proshare-mc-1",
- 1674: "proshare-mc-2",
- 1675: "pdp",
- 1676: "netcomm1",
- 1677: "groupwise",
- 1678: "prolink",
- 1679: "darcorp-lm",
- 1680: "microcom-sbp",
- 1681: "sd-elmd",
- 1682: "lanyon-lantern",
- 1683: "ncpm-hip",
- 1684: "snaresecure",
- 1685: "n2nremote",
- 1686: "cvmon",
- 1687: "nsjtp-ctrl",
- 1688: "nsjtp-data",
- 1689: "firefox",
- 1690: "ng-umds",
- 1691: "empire-empuma",
- 1692: "sstsys-lm",
- 1693: "rrirtr",
- 1694: "rrimwm",
- 1695: "rrilwm",
- 1696: "rrifmm",
- 1697: "rrisat",
- 1698: "rsvp-encap-1",
- 1699: "rsvp-encap-2",
- 1700: "mps-raft",
- 1701: "l2f",
- 1702: "deskshare",
- 1703: "hb-engine",
- 1704: "bcs-broker",
- 1705: "slingshot",
- 1706: "jetform",
- 1707: "vdmplay",
- 1708: "gat-lmd",
- 1709: "centra",
- 1710: "impera",
- 1711: "pptconference",
- 1712: "registrar",
- 1713: "conferencetalk",
- 1714: "sesi-lm",
- 1715: "houdini-lm",
- 1716: "xmsg",
- 1717: "fj-hdnet",
- 1718: "h323gatedisc",
- 1719: "h323gatestat",
- 1720: "h323hostcall",
- 1721: "caicci",
- 1722: "hks-lm",
- 1723: "pptp",
- 1724: "csbphonemaster",
- 1725: "iden-ralp",
- 1726: "iberiagames",
- 1727: "winddx",
- 1728: "telindus",
- 1729: "citynl",
- 1730: "roketz",
- 1731: "msiccp",
- 1732: "proxim",
- 1733: "siipat",
- 1734: "cambertx-lm",
- 1735: "privatechat",
- 1736: "street-stream",
- 1737: "ultimad",
- 1738: "gamegen1",
- 1739: "webaccess",
- 1740: "encore",
- 1741: "cisco-net-mgmt",
- 1742: "3Com-nsd",
- 1743: "cinegrfx-lm",
- 1744: "ncpm-ft",
- 1745: "remote-winsock",
- 1746: "ftrapid-1",
- 1747: "ftrapid-2",
- 1748: "oracle-em1",
- 1749: "aspen-services",
- 1750: "sslp",
- 1751: "swiftnet",
- 1752: "lofr-lm",
- 1753: "predatar-comms",
- 1754: "oracle-em2",
- 1755: "ms-streaming",
- 1756: "capfast-lmd",
- 1757: "cnhrp",
- 1758: "tftp-mcast",
- 1759: "spss-lm",
- 1760: "www-ldap-gw",
- 1761: "cft-0",
- 1762: "cft-1",
- 1763: "cft-2",
- 1764: "cft-3",
- 1765: "cft-4",
- 1766: "cft-5",
- 1767: "cft-6",
- 1768: "cft-7",
- 1769: "bmc-net-adm",
- 1770: "bmc-net-svc",
- 1771: "vaultbase",
- 1772: "essweb-gw",
- 1773: "kmscontrol",
- 1774: "global-dtserv",
- 1775: "vdab",
- 1776: "femis",
- 1777: "powerguardian",
- 1778: "prodigy-intrnet",
- 1779: "pharmasoft",
- 1780: "dpkeyserv",
- 1781: "answersoft-lm",
- 1782: "hp-hcip",
- 1784: "finle-lm",
- 1785: "windlm",
- 1786: "funk-logger",
- 1787: "funk-license",
- 1788: "psmond",
- 1789: "hello",
- 1790: "nmsp",
- 1791: "ea1",
- 1792: "ibm-dt-2",
- 1793: "rsc-robot",
- 1794: "cera-bcm",
- 1795: "dpi-proxy",
- 1796: "vocaltec-admin",
- 1797: "uma",
- 1798: "etp",
- 1799: "netrisk",
- 1800: "ansys-lm",
- 1801: "msmq",
- 1802: "concomp1",
- 1803: "hp-hcip-gwy",
- 1804: "enl",
- 1805: "enl-name",
- 1806: "musiconline",
- 1807: "fhsp",
- 1808: "oracle-vp2",
- 1809: "oracle-vp1",
- 1810: "jerand-lm",
- 1811: "scientia-sdb",
- 1812: "radius",
- 1813: "radius-acct",
- 1814: "tdp-suite",
- 1815: "mmpft",
- 1816: "harp",
- 1817: "rkb-oscs",
- 1818: "etftp",
- 1819: "plato-lm",
- 1820: "mcagent",
- 1821: "donnyworld",
- 1822: "es-elmd",
- 1823: "unisys-lm",
- 1824: "metrics-pas",
- 1825: "direcpc-video",
- 1826: "ardt",
- 1827: "asi",
- 1828: "itm-mcell-u",
- 1829: "optika-emedia",
- 1830: "net8-cman",
- 1831: "myrtle",
- 1832: "tht-treasure",
- 1833: "udpradio",
- 1834: "ardusuni",
- 1835: "ardusmul",
- 1836: "ste-smsc",
- 1837: "csoft1",
- 1838: "talnet",
- 1839: "netopia-vo1",
- 1840: "netopia-vo2",
- 1841: "netopia-vo3",
- 1842: "netopia-vo4",
- 1843: "netopia-vo5",
- 1844: "direcpc-dll",
- 1845: "altalink",
- 1846: "tunstall-pnc",
- 1847: "slp-notify",
- 1848: "fjdocdist",
- 1849: "alpha-sms",
- 1850: "gsi",
- 1851: "ctcd",
- 1852: "virtual-time",
- 1853: "vids-avtp",
- 1854: "buddy-draw",
- 1855: "fiorano-rtrsvc",
- 1856: "fiorano-msgsvc",
- 1857: "datacaptor",
- 1858: "privateark",
- 1859: "gammafetchsvr",
- 1860: "sunscalar-svc",
- 1861: "lecroy-vicp",
- 1862: "mysql-cm-agent",
- 1863: "msnp",
- 1864: "paradym-31port",
- 1865: "entp",
- 1866: "swrmi",
- 1867: "udrive",
- 1868: "viziblebrowser",
- 1869: "transact",
- 1870: "sunscalar-dns",
- 1871: "canocentral0",
- 1872: "canocentral1",
- 1873: "fjmpjps",
- 1874: "fjswapsnp",
- 1875: "westell-stats",
- 1876: "ewcappsrv",
- 1877: "hp-webqosdb",
- 1878: "drmsmc",
- 1879: "nettgain-nms",
- 1880: "vsat-control",
- 1881: "ibm-mqseries2",
- 1882: "ecsqdmn",
- 1883: "ibm-mqisdp",
- 1884: "idmaps",
- 1885: "vrtstrapserver",
- 1886: "leoip",
- 1887: "filex-lport",
- 1888: "ncconfig",
- 1889: "unify-adapter",
- 1890: "wilkenlistener",
- 1891: "childkey-notif",
- 1892: "childkey-ctrl",
- 1893: "elad",
- 1894: "o2server-port",
- 1896: "b-novative-ls",
- 1897: "metaagent",
- 1898: "cymtec-port",
- 1899: "mc2studios",
- 1900: "ssdp",
- 1901: "fjicl-tep-a",
- 1902: "fjicl-tep-b",
- 1903: "linkname",
- 1904: "fjicl-tep-c",
- 1905: "sugp",
- 1906: "tpmd",
- 1907: "intrastar",
- 1908: "dawn",
- 1909: "global-wlink",
- 1910: "ultrabac",
- 1911: "mtp",
- 1912: "rhp-iibp",
- 1913: "armadp",
- 1914: "elm-momentum",
- 1915: "facelink",
- 1916: "persona",
- 1917: "noagent",
- 1918: "can-nds",
- 1919: "can-dch",
- 1920: "can-ferret",
- 1921: "noadmin",
- 1922: "tapestry",
- 1923: "spice",
- 1924: "xiip",
- 1925: "discovery-port",
- 1926: "egs",
- 1927: "videte-cipc",
- 1928: "emsd-port",
- 1929: "bandwiz-system",
- 1930: "driveappserver",
- 1931: "amdsched",
- 1932: "ctt-broker",
- 1933: "xmapi",
- 1934: "xaapi",
- 1935: "macromedia-fcs",
- 1936: "jetcmeserver",
- 1937: "jwserver",
- 1938: "jwclient",
- 1939: "jvserver",
- 1940: "jvclient",
- 1941: "dic-aida",
- 1942: "res",
- 1943: "beeyond-media",
- 1944: "close-combat",
- 1945: "dialogic-elmd",
- 1946: "tekpls",
- 1947: "sentinelsrm",
- 1948: "eye2eye",
- 1949: "ismaeasdaqlive",
- 1950: "ismaeasdaqtest",
- 1951: "bcs-lmserver",
- 1952: "mpnjsc",
- 1953: "rapidbase",
- 1954: "abr-api",
- 1955: "abr-secure",
- 1956: "vrtl-vmf-ds",
- 1957: "unix-status",
- 1958: "dxadmind",
- 1959: "simp-all",
- 1960: "nasmanager",
- 1961: "bts-appserver",
- 1962: "biap-mp",
- 1963: "webmachine",
- 1964: "solid-e-engine",
- 1965: "tivoli-npm",
- 1966: "slush",
- 1967: "sns-quote",
- 1968: "lipsinc",
- 1969: "lipsinc1",
- 1970: "netop-rc",
- 1971: "netop-school",
- 1972: "intersys-cache",
- 1973: "dlsrap",
- 1974: "drp",
- 1975: "tcoflashagent",
- 1976: "tcoregagent",
- 1977: "tcoaddressbook",
- 1978: "unisql",
- 1979: "unisql-java",
- 1980: "pearldoc-xact",
- 1981: "p2pq",
- 1982: "estamp",
- 1983: "lhtp",
- 1984: "bb",
- 1985: "hsrp",
- 1986: "licensedaemon",
- 1987: "tr-rsrb-p1",
- 1988: "tr-rsrb-p2",
- 1989: "tr-rsrb-p3",
- 1990: "stun-p1",
- 1991: "stun-p2",
- 1992: "stun-p3",
- 1993: "snmp-tcp-port",
- 1994: "stun-port",
- 1995: "perf-port",
- 1996: "tr-rsrb-port",
- 1997: "gdp-port",
- 1998: "x25-svc-port",
- 1999: "tcp-id-port",
- 2000: "cisco-sccp",
- 2001: "dc",
- 2002: "globe",
- 2003: "brutus",
- 2004: "mailbox",
- 2005: "berknet",
- 2006: "invokator",
- 2007: "dectalk",
- 2008: "conf",
- 2009: "news",
- 2010: "search",
- 2011: "raid-cc",
- 2012: "ttyinfo",
- 2013: "raid-am",
- 2014: "troff",
- 2015: "cypress",
- 2016: "bootserver",
- 2017: "cypress-stat",
- 2018: "terminaldb",
- 2019: "whosockami",
- 2020: "xinupageserver",
- 2021: "servexec",
- 2022: "down",
- 2023: "xinuexpansion3",
- 2024: "xinuexpansion4",
- 2025: "ellpack",
- 2026: "scrabble",
- 2027: "shadowserver",
- 2028: "submitserver",
- 2029: "hsrpv6",
- 2030: "device2",
- 2031: "mobrien-chat",
- 2032: "blackboard",
- 2033: "glogger",
- 2034: "scoremgr",
- 2035: "imsldoc",
- 2036: "e-dpnet",
- 2037: "applus",
- 2038: "objectmanager",
- 2039: "prizma",
- 2040: "lam",
- 2041: "interbase",
- 2042: "isis",
- 2043: "isis-bcast",
- 2044: "rimsl",
- 2045: "cdfunc",
- 2046: "sdfunc",
- 2047: "dls",
- 2048: "dls-monitor",
- 2049: "shilp",
- 2050: "av-emb-config",
- 2051: "epnsdp",
- 2052: "clearvisn",
- 2053: "lot105-ds-upd",
- 2054: "weblogin",
- 2055: "iop",
- 2056: "omnisky",
- 2057: "rich-cp",
- 2058: "newwavesearch",
- 2059: "bmc-messaging",
- 2060: "teleniumdaemon",
- 2061: "netmount",
- 2062: "icg-swp",
- 2063: "icg-bridge",
- 2064: "icg-iprelay",
- 2065: "dlsrpn",
- 2066: "aura",
- 2067: "dlswpn",
- 2068: "avauthsrvprtcl",
- 2069: "event-port",
- 2070: "ah-esp-encap",
- 2071: "acp-port",
- 2072: "msync",
- 2073: "gxs-data-port",
- 2074: "vrtl-vmf-sa",
- 2075: "newlixengine",
- 2076: "newlixconfig",
- 2077: "tsrmagt",
- 2078: "tpcsrvr",
- 2079: "idware-router",
- 2080: "autodesk-nlm",
- 2081: "kme-trap-port",
- 2082: "infowave",
- 2083: "radsec",
- 2084: "sunclustergeo",
- 2085: "ada-cip",
- 2086: "gnunet",
- 2087: "eli",
- 2088: "ip-blf",
- 2089: "sep",
- 2090: "lrp",
- 2091: "prp",
- 2092: "descent3",
- 2093: "nbx-cc",
- 2094: "nbx-au",
- 2095: "nbx-ser",
- 2096: "nbx-dir",
- 2097: "jetformpreview",
- 2098: "dialog-port",
- 2099: "h2250-annex-g",
- 2100: "amiganetfs",
- 2101: "rtcm-sc104",
- 2102: "zephyr-srv",
- 2103: "zephyr-clt",
- 2104: "zephyr-hm",
- 2105: "minipay",
- 2106: "mzap",
- 2107: "bintec-admin",
- 2108: "comcam",
- 2109: "ergolight",
- 2110: "umsp",
- 2111: "dsatp",
- 2112: "idonix-metanet",
- 2113: "hsl-storm",
- 2114: "newheights",
- 2115: "kdm",
- 2116: "ccowcmr",
- 2117: "mentaclient",
- 2118: "mentaserver",
- 2119: "gsigatekeeper",
- 2120: "qencp",
- 2121: "scientia-ssdb",
- 2122: "caupc-remote",
- 2123: "gtp-control",
- 2124: "elatelink",
- 2125: "lockstep",
- 2126: "pktcable-cops",
- 2127: "index-pc-wb",
- 2128: "net-steward",
- 2129: "cs-live",
- 2130: "xds",
- 2131: "avantageb2b",
- 2132: "solera-epmap",
- 2133: "zymed-zpp",
- 2134: "avenue",
- 2135: "gris",
- 2136: "appworxsrv",
- 2137: "connect",
- 2138: "unbind-cluster",
- 2139: "ias-auth",
- 2140: "ias-reg",
- 2141: "ias-admind",
- 2142: "tdmoip",
- 2143: "lv-jc",
- 2144: "lv-ffx",
- 2145: "lv-pici",
- 2146: "lv-not",
- 2147: "lv-auth",
- 2148: "veritas-ucl",
- 2149: "acptsys",
- 2150: "dynamic3d",
- 2151: "docent",
- 2152: "gtp-user",
- 2153: "ctlptc",
- 2154: "stdptc",
- 2155: "brdptc",
- 2156: "trp",
- 2157: "xnds",
- 2158: "touchnetplus",
- 2159: "gdbremote",
- 2160: "apc-2160",
- 2161: "apc-2161",
- 2162: "navisphere",
- 2163: "navisphere-sec",
- 2164: "ddns-v3",
- 2165: "x-bone-api",
- 2166: "iwserver",
- 2167: "raw-serial",
- 2168: "easy-soft-mux",
- 2169: "brain",
- 2170: "eyetv",
- 2171: "msfw-storage",
- 2172: "msfw-s-storage",
- 2173: "msfw-replica",
- 2174: "msfw-array",
- 2175: "airsync",
- 2176: "rapi",
- 2177: "qwave",
- 2178: "bitspeer",
- 2179: "vmrdp",
- 2180: "mc-gt-srv",
- 2181: "eforward",
- 2182: "cgn-stat",
- 2183: "cgn-config",
- 2184: "nvd",
- 2185: "onbase-dds",
- 2186: "gtaua",
- 2187: "ssmc",
- 2188: "radware-rpm",
- 2189: "radware-rpm-s",
- 2190: "tivoconnect",
- 2191: "tvbus",
- 2192: "asdis",
- 2193: "drwcs",
- 2197: "mnp-exchange",
- 2198: "onehome-remote",
- 2199: "onehome-help",
- 2200: "ici",
- 2201: "ats",
- 2202: "imtc-map",
- 2203: "b2-runtime",
- 2204: "b2-license",
- 2205: "jps",
- 2206: "hpocbus",
- 2207: "hpssd",
- 2208: "hpiod",
- 2209: "rimf-ps",
- 2210: "noaaport",
- 2211: "emwin",
- 2212: "leecoposserver",
- 2213: "kali",
- 2214: "rpi",
- 2215: "ipcore",
- 2216: "vtu-comms",
- 2217: "gotodevice",
- 2218: "bounzza",
- 2219: "netiq-ncap",
- 2220: "netiq",
- 2221: "rockwell-csp1",
- 2222: "EtherNet-IP-1",
- 2223: "rockwell-csp2",
- 2224: "efi-mg",
- 2225: "rcip-itu",
- 2226: "di-drm",
- 2227: "di-msg",
- 2228: "ehome-ms",
- 2229: "datalens",
- 2230: "queueadm",
- 2231: "wimaxasncp",
- 2232: "ivs-video",
- 2233: "infocrypt",
- 2234: "directplay",
- 2235: "sercomm-wlink",
- 2236: "nani",
- 2237: "optech-port1-lm",
- 2238: "aviva-sna",
- 2239: "imagequery",
- 2240: "recipe",
- 2241: "ivsd",
- 2242: "foliocorp",
- 2243: "magicom",
- 2244: "nmsserver",
- 2245: "hao",
- 2246: "pc-mta-addrmap",
- 2247: "antidotemgrsvr",
- 2248: "ums",
- 2249: "rfmp",
- 2250: "remote-collab",
- 2251: "dif-port",
- 2252: "njenet-ssl",
- 2253: "dtv-chan-req",
- 2254: "seispoc",
- 2255: "vrtp",
- 2256: "pcc-mfp",
- 2257: "simple-tx-rx",
- 2258: "rcts",
- 2260: "apc-2260",
- 2261: "comotionmaster",
- 2262: "comotionback",
- 2263: "ecwcfg",
- 2264: "apx500api-1",
- 2265: "apx500api-2",
- 2266: "mfserver",
- 2267: "ontobroker",
- 2268: "amt",
- 2269: "mikey",
- 2270: "starschool",
- 2271: "mmcals",
- 2272: "mmcal",
- 2273: "mysql-im",
- 2274: "pcttunnell",
- 2275: "ibridge-data",
- 2276: "ibridge-mgmt",
- 2277: "bluectrlproxy",
- 2278: "s3db",
- 2279: "xmquery",
- 2280: "lnvpoller",
- 2281: "lnvconsole",
- 2282: "lnvalarm",
- 2283: "lnvstatus",
- 2284: "lnvmaps",
- 2285: "lnvmailmon",
- 2286: "nas-metering",
- 2287: "dna",
- 2288: "netml",
- 2289: "dict-lookup",
- 2290: "sonus-logging",
- 2291: "eapsp",
- 2292: "mib-streaming",
- 2293: "npdbgmngr",
- 2294: "konshus-lm",
- 2295: "advant-lm",
- 2296: "theta-lm",
- 2297: "d2k-datamover1",
- 2298: "d2k-datamover2",
- 2299: "pc-telecommute",
- 2300: "cvmmon",
- 2301: "cpq-wbem",
- 2302: "binderysupport",
- 2303: "proxy-gateway",
- 2304: "attachmate-uts",
- 2305: "mt-scaleserver",
- 2306: "tappi-boxnet",
- 2307: "pehelp",
- 2308: "sdhelp",
- 2309: "sdserver",
- 2310: "sdclient",
- 2311: "messageservice",
- 2312: "wanscaler",
- 2313: "iapp",
- 2314: "cr-websystems",
- 2315: "precise-sft",
- 2316: "sent-lm",
- 2317: "attachmate-g32",
- 2318: "cadencecontrol",
- 2319: "infolibria",
- 2320: "siebel-ns",
- 2321: "rdlap",
- 2322: "ofsd",
- 2323: "3d-nfsd",
- 2324: "cosmocall",
- 2325: "ansysli",
- 2326: "idcp",
- 2327: "xingcsm",
- 2328: "netrix-sftm",
- 2329: "nvd",
- 2330: "tscchat",
- 2331: "agentview",
- 2332: "rcc-host",
- 2333: "snapp",
- 2334: "ace-client",
- 2335: "ace-proxy",
- 2336: "appleugcontrol",
- 2337: "ideesrv",
- 2338: "norton-lambert",
- 2339: "3com-webview",
- 2340: "wrs-registry",
- 2341: "xiostatus",
- 2342: "manage-exec",
- 2343: "nati-logos",
- 2344: "fcmsys",
- 2345: "dbm",
- 2346: "redstorm-join",
- 2347: "redstorm-find",
- 2348: "redstorm-info",
- 2349: "redstorm-diag",
- 2350: "psbserver",
- 2351: "psrserver",
- 2352: "pslserver",
- 2353: "pspserver",
- 2354: "psprserver",
- 2355: "psdbserver",
- 2356: "gxtelmd",
- 2357: "unihub-server",
- 2358: "futrix",
- 2359: "flukeserver",
- 2360: "nexstorindltd",
- 2361: "tl1",
- 2362: "digiman",
- 2363: "mediacntrlnfsd",
- 2364: "oi-2000",
- 2365: "dbref",
- 2366: "qip-login",
- 2367: "service-ctrl",
- 2368: "opentable",
- 2370: "l3-hbmon",
- 2371: "hp-rda",
- 2372: "lanmessenger",
- 2373: "remographlm",
- 2374: "hydra",
- 2375: "docker",
- 2376: "docker-s",
- 2379: "etcd-client",
- 2380: "etcd-server",
- 2381: "compaq-https",
- 2382: "ms-olap3",
- 2383: "ms-olap4",
- 2384: "sd-request",
- 2385: "sd-data",
- 2386: "virtualtape",
- 2387: "vsamredirector",
- 2388: "mynahautostart",
- 2389: "ovsessionmgr",
- 2390: "rsmtp",
- 2391: "3com-net-mgmt",
- 2392: "tacticalauth",
- 2393: "ms-olap1",
- 2394: "ms-olap2",
- 2395: "lan900-remote",
- 2396: "wusage",
- 2397: "ncl",
- 2398: "orbiter",
- 2399: "fmpro-fdal",
- 2400: "opequus-server",
- 2401: "cvspserver",
- 2402: "taskmaster2000",
- 2403: "taskmaster2000",
- 2404: "iec-104",
- 2405: "trc-netpoll",
- 2406: "jediserver",
- 2407: "orion",
- 2408: "railgun-webaccl",
- 2409: "sns-protocol",
- 2410: "vrts-registry",
- 2411: "netwave-ap-mgmt",
- 2412: "cdn",
- 2413: "orion-rmi-reg",
- 2414: "beeyond",
- 2415: "codima-rtp",
- 2416: "rmtserver",
- 2417: "composit-server",
- 2418: "cas",
- 2419: "attachmate-s2s",
- 2420: "dslremote-mgmt",
- 2421: "g-talk",
- 2422: "crmsbits",
- 2423: "rnrp",
- 2424: "kofax-svr",
- 2425: "fjitsuappmgr",
- 2427: "mgcp-gateway",
- 2428: "ott",
- 2429: "ft-role",
- 2430: "venus",
- 2431: "venus-se",
- 2432: "codasrv",
- 2433: "codasrv-se",
- 2434: "pxc-epmap",
- 2435: "optilogic",
- 2436: "topx",
- 2437: "unicontrol",
- 2438: "msp",
- 2439: "sybasedbsynch",
- 2440: "spearway",
- 2441: "pvsw-inet",
- 2442: "netangel",
- 2443: "powerclientcsf",
- 2444: "btpp2sectrans",
- 2445: "dtn1",
- 2446: "bues-service",
- 2447: "ovwdb",
- 2448: "hpppssvr",
- 2449: "ratl",
- 2450: "netadmin",
- 2451: "netchat",
- 2452: "snifferclient",
- 2453: "madge-ltd",
- 2454: "indx-dds",
- 2455: "wago-io-system",
- 2456: "altav-remmgt",
- 2457: "rapido-ip",
- 2458: "griffin",
- 2459: "community",
- 2460: "ms-theater",
- 2461: "qadmifoper",
- 2462: "qadmifevent",
- 2463: "lsi-raid-mgmt",
- 2464: "direcpc-si",
- 2465: "lbm",
- 2466: "lbf",
- 2467: "high-criteria",
- 2468: "qip-msgd",
- 2469: "mti-tcs-comm",
- 2470: "taskman-port",
- 2471: "seaodbc",
- 2472: "c3",
- 2473: "aker-cdp",
- 2474: "vitalanalysis",
- 2475: "ace-server",
- 2476: "ace-svr-prop",
- 2477: "ssm-cvs",
- 2478: "ssm-cssps",
- 2479: "ssm-els",
- 2480: "powerexchange",
- 2481: "giop",
- 2482: "giop-ssl",
- 2483: "ttc",
- 2484: "ttc-ssl",
- 2485: "netobjects1",
- 2486: "netobjects2",
- 2487: "pns",
- 2488: "moy-corp",
- 2489: "tsilb",
- 2490: "qip-qdhcp",
- 2491: "conclave-cpp",
- 2492: "groove",
- 2493: "talarian-mqs",
- 2494: "bmc-ar",
- 2495: "fast-rem-serv",
- 2496: "dirgis",
- 2497: "quaddb",
- 2498: "odn-castraq",
- 2499: "unicontrol",
- 2500: "rtsserv",
- 2501: "rtsclient",
- 2502: "kentrox-prot",
- 2503: "nms-dpnss",
- 2504: "wlbs",
- 2505: "ppcontrol",
- 2506: "jbroker",
- 2507: "spock",
- 2508: "jdatastore",
- 2509: "fjmpss",
- 2510: "fjappmgrbulk",
- 2511: "metastorm",
- 2512: "citrixima",
- 2513: "citrixadmin",
- 2514: "facsys-ntp",
- 2515: "facsys-router",
- 2516: "maincontrol",
- 2517: "call-sig-trans",
- 2518: "willy",
- 2519: "globmsgsvc",
- 2520: "pvsw",
- 2521: "adaptecmgr",
- 2522: "windb",
- 2523: "qke-llc-v3",
- 2524: "optiwave-lm",
- 2525: "ms-v-worlds",
- 2526: "ema-sent-lm",
- 2527: "iqserver",
- 2528: "ncr-ccl",
- 2529: "utsftp",
- 2530: "vrcommerce",
- 2531: "ito-e-gui",
- 2532: "ovtopmd",
- 2533: "snifferserver",
- 2534: "combox-web-acc",
- 2535: "madcap",
- 2536: "btpp2audctr1",
- 2537: "upgrade",
- 2538: "vnwk-prapi",
- 2539: "vsiadmin",
- 2540: "lonworks",
- 2541: "lonworks2",
- 2542: "udrawgraph",
- 2543: "reftek",
- 2544: "novell-zen",
- 2545: "sis-emt",
- 2546: "vytalvaultbrtp",
- 2547: "vytalvaultvsmp",
- 2548: "vytalvaultpipe",
- 2549: "ipass",
- 2550: "ads",
- 2551: "isg-uda-server",
- 2552: "call-logging",
- 2553: "efidiningport",
- 2554: "vcnet-link-v10",
- 2555: "compaq-wcp",
- 2556: "nicetec-nmsvc",
- 2557: "nicetec-mgmt",
- 2558: "pclemultimedia",
- 2559: "lstp",
- 2560: "labrat",
- 2561: "mosaixcc",
- 2562: "delibo",
- 2563: "cti-redwood",
- 2564: "hp-3000-telnet",
- 2565: "coord-svr",
- 2566: "pcs-pcw",
- 2567: "clp",
- 2568: "spamtrap",
- 2569: "sonuscallsig",
- 2570: "hs-port",
- 2571: "cecsvc",
- 2572: "ibp",
- 2573: "trustestablish",
- 2574: "blockade-bpsp",
- 2575: "hl7",
- 2576: "tclprodebugger",
- 2577: "scipticslsrvr",
- 2578: "rvs-isdn-dcp",
- 2579: "mpfoncl",
- 2580: "tributary",
- 2581: "argis-te",
- 2582: "argis-ds",
- 2583: "mon",
- 2584: "cyaserv",
- 2585: "netx-server",
- 2586: "netx-agent",
- 2587: "masc",
- 2588: "privilege",
- 2589: "quartus-tcl",
- 2590: "idotdist",
- 2591: "maytagshuffle",
- 2592: "netrek",
- 2593: "mns-mail",
- 2594: "dts",
- 2595: "worldfusion1",
- 2596: "worldfusion2",
- 2597: "homesteadglory",
- 2598: "citriximaclient",
- 2599: "snapd",
- 2600: "hpstgmgr",
- 2601: "discp-client",
- 2602: "discp-server",
- 2603: "servicemeter",
- 2604: "nsc-ccs",
- 2605: "nsc-posa",
- 2606: "netmon",
- 2607: "connection",
- 2608: "wag-service",
- 2609: "system-monitor",
- 2610: "versa-tek",
- 2611: "lionhead",
- 2612: "qpasa-agent",
- 2613: "smntubootstrap",
- 2614: "neveroffline",
- 2615: "firepower",
- 2616: "appswitch-emp",
- 2617: "cmadmin",
- 2618: "priority-e-com",
- 2619: "bruce",
- 2620: "lpsrecommender",
- 2621: "miles-apart",
- 2622: "metricadbc",
- 2623: "lmdp",
- 2624: "aria",
- 2625: "blwnkl-port",
- 2626: "gbjd816",
- 2627: "moshebeeri",
- 2628: "dict",
- 2629: "sitaraserver",
- 2630: "sitaramgmt",
- 2631: "sitaradir",
- 2632: "irdg-post",
- 2633: "interintelli",
- 2634: "pk-electronics",
- 2635: "backburner",
- 2636: "solve",
- 2637: "imdocsvc",
- 2638: "sybaseanywhere",
- 2639: "aminet",
- 2640: "sai-sentlm",
- 2641: "hdl-srv",
- 2642: "tragic",
- 2643: "gte-samp",
- 2644: "travsoft-ipx-t",
- 2645: "novell-ipx-cmd",
- 2646: "and-lm",
- 2647: "syncserver",
- 2648: "upsnotifyprot",
- 2649: "vpsipport",
- 2650: "eristwoguns",
- 2651: "ebinsite",
- 2652: "interpathpanel",
- 2653: "sonus",
- 2654: "corel-vncadmin",
- 2655: "unglue",
- 2656: "kana",
- 2657: "sns-dispatcher",
- 2658: "sns-admin",
- 2659: "sns-query",
- 2660: "gcmonitor",
- 2661: "olhost",
- 2662: "bintec-capi",
- 2663: "bintec-tapi",
- 2664: "patrol-mq-gm",
- 2665: "patrol-mq-nm",
- 2666: "extensis",
- 2667: "alarm-clock-s",
- 2668: "alarm-clock-c",
- 2669: "toad",
- 2670: "tve-announce",
- 2671: "newlixreg",
- 2672: "nhserver",
- 2673: "firstcall42",
- 2674: "ewnn",
- 2675: "ttc-etap",
- 2676: "simslink",
- 2677: "gadgetgate1way",
- 2678: "gadgetgate2way",
- 2679: "syncserverssl",
- 2680: "pxc-sapxom",
- 2681: "mpnjsomb",
- 2683: "ncdloadbalance",
- 2684: "mpnjsosv",
- 2685: "mpnjsocl",
- 2686: "mpnjsomg",
- 2687: "pq-lic-mgmt",
- 2688: "md-cg-http",
- 2689: "fastlynx",
- 2690: "hp-nnm-data",
- 2691: "itinternet",
- 2692: "admins-lms",
- 2694: "pwrsevent",
- 2695: "vspread",
- 2696: "unifyadmin",
- 2697: "oce-snmp-trap",
- 2698: "mck-ivpip",
- 2699: "csoft-plusclnt",
- 2700: "tqdata",
- 2701: "sms-rcinfo",
- 2702: "sms-xfer",
- 2703: "sms-chat",
- 2704: "sms-remctrl",
- 2705: "sds-admin",
- 2706: "ncdmirroring",
- 2707: "emcsymapiport",
- 2708: "banyan-net",
- 2709: "supermon",
- 2710: "sso-service",
- 2711: "sso-control",
- 2712: "aocp",
- 2713: "raventbs",
- 2714: "raventdm",
- 2715: "hpstgmgr2",
- 2716: "inova-ip-disco",
- 2717: "pn-requester",
- 2718: "pn-requester2",
- 2719: "scan-change",
- 2720: "wkars",
- 2721: "smart-diagnose",
- 2722: "proactivesrvr",
- 2723: "watchdog-nt",
- 2724: "qotps",
- 2725: "msolap-ptp2",
- 2726: "tams",
- 2727: "mgcp-callagent",
- 2728: "sqdr",
- 2729: "tcim-control",
- 2730: "nec-raidplus",
- 2731: "fyre-messanger",
- 2732: "g5m",
- 2733: "signet-ctf",
- 2734: "ccs-software",
- 2735: "netiq-mc",
- 2736: "radwiz-nms-srv",
- 2737: "srp-feedback",
- 2738: "ndl-tcp-ois-gw",
- 2739: "tn-timing",
- 2740: "alarm",
- 2741: "tsb",
- 2742: "tsb2",
- 2743: "murx",
- 2744: "honyaku",
- 2745: "urbisnet",
- 2746: "cpudpencap",
- 2747: "fjippol-swrly",
- 2748: "fjippol-polsvr",
- 2749: "fjippol-cnsl",
- 2750: "fjippol-port1",
- 2751: "fjippol-port2",
- 2752: "rsisysaccess",
- 2753: "de-spot",
- 2754: "apollo-cc",
- 2755: "expresspay",
- 2756: "simplement-tie",
- 2757: "cnrp",
- 2758: "apollo-status",
- 2759: "apollo-gms",
- 2760: "sabams",
- 2761: "dicom-iscl",
- 2762: "dicom-tls",
- 2763: "desktop-dna",
- 2764: "data-insurance",
- 2765: "qip-audup",
- 2766: "compaq-scp",
- 2767: "uadtc",
- 2768: "uacs",
- 2769: "exce",
- 2770: "veronica",
- 2771: "vergencecm",
- 2772: "auris",
- 2773: "rbakcup1",
- 2774: "rbakcup2",
- 2775: "smpp",
- 2776: "ridgeway1",
- 2777: "ridgeway2",
- 2778: "gwen-sonya",
- 2779: "lbc-sync",
- 2780: "lbc-control",
- 2781: "whosells",
- 2782: "everydayrc",
- 2783: "aises",
- 2784: "www-dev",
- 2785: "aic-np",
- 2786: "aic-oncrpc",
- 2787: "piccolo",
- 2788: "fryeserv",
- 2789: "media-agent",
- 2790: "plgproxy",
- 2791: "mtport-regist",
- 2792: "f5-globalsite",
- 2793: "initlsmsad",
- 2795: "livestats",
- 2796: "ac-tech",
- 2797: "esp-encap",
- 2798: "tmesis-upshot",
- 2799: "icon-discover",
- 2800: "acc-raid",
- 2801: "igcp",
- 2802: "veritas-tcp1",
- 2803: "btprjctrl",
- 2804: "dvr-esm",
- 2805: "wta-wsp-s",
- 2806: "cspuni",
- 2807: "cspmulti",
- 2808: "j-lan-p",
- 2809: "corbaloc",
- 2810: "netsteward",
- 2811: "gsiftp",
- 2812: "atmtcp",
- 2813: "llm-pass",
- 2814: "llm-csv",
- 2815: "lbc-measure",
- 2816: "lbc-watchdog",
- 2817: "nmsigport",
- 2818: "rmlnk",
- 2819: "fc-faultnotify",
- 2820: "univision",
- 2821: "vrts-at-port",
- 2822: "ka0wuc",
- 2823: "cqg-netlan",
- 2824: "cqg-netlan-1",
- 2826: "slc-systemlog",
- 2827: "slc-ctrlrloops",
- 2828: "itm-lm",
- 2829: "silkp1",
- 2830: "silkp2",
- 2831: "silkp3",
- 2832: "silkp4",
- 2833: "glishd",
- 2834: "evtp",
- 2835: "evtp-data",
- 2836: "catalyst",
- 2837: "repliweb",
- 2838: "starbot",
- 2839: "nmsigport",
- 2840: "l3-exprt",
- 2841: "l3-ranger",
- 2842: "l3-hawk",
- 2843: "pdnet",
- 2844: "bpcp-poll",
- 2845: "bpcp-trap",
- 2846: "aimpp-hello",
- 2847: "aimpp-port-req",
- 2848: "amt-blc-port",
- 2849: "fxp",
- 2850: "metaconsole",
- 2851: "webemshttp",
- 2852: "bears-01",
- 2853: "ispipes",
- 2854: "infomover",
- 2855: "msrp",
- 2856: "cesdinv",
- 2857: "simctlp",
- 2858: "ecnp",
- 2859: "activememory",
- 2860: "dialpad-voice1",
- 2861: "dialpad-voice2",
- 2862: "ttg-protocol",
- 2863: "sonardata",
- 2864: "astromed-main",
- 2865: "pit-vpn",
- 2866: "iwlistener",
- 2867: "esps-portal",
- 2868: "npep-messaging",
- 2869: "icslap",
- 2870: "daishi",
- 2871: "msi-selectplay",
- 2872: "radix",
- 2874: "dxmessagebase1",
- 2875: "dxmessagebase2",
- 2876: "sps-tunnel",
- 2877: "bluelance",
- 2878: "aap",
- 2879: "ucentric-ds",
- 2880: "synapse",
- 2881: "ndsp",
- 2882: "ndtp",
- 2883: "ndnp",
- 2884: "flashmsg",
- 2885: "topflow",
- 2886: "responselogic",
- 2887: "aironetddp",
- 2888: "spcsdlobby",
- 2889: "rsom",
- 2890: "cspclmulti",
- 2891: "cinegrfx-elmd",
- 2892: "snifferdata",
- 2893: "vseconnector",
- 2894: "abacus-remote",
- 2895: "natuslink",
- 2896: "ecovisiong6-1",
- 2897: "citrix-rtmp",
- 2898: "appliance-cfg",
- 2899: "powergemplus",
- 2900: "quicksuite",
- 2901: "allstorcns",
- 2902: "netaspi",
- 2903: "suitcase",
- 2904: "m2ua",
- 2905: "m3ua",
- 2906: "caller9",
- 2907: "webmethods-b2b",
- 2908: "mao",
- 2909: "funk-dialout",
- 2910: "tdaccess",
- 2911: "blockade",
- 2912: "epicon",
- 2913: "boosterware",
- 2914: "gamelobby",
- 2915: "tksocket",
- 2916: "elvin-server",
- 2917: "elvin-client",
- 2918: "kastenchasepad",
- 2919: "roboer",
- 2920: "roboeda",
- 2921: "cesdcdman",
- 2922: "cesdcdtrn",
- 2923: "wta-wsp-wtp-s",
- 2924: "precise-vip",
- 2926: "mobile-file-dl",
- 2927: "unimobilectrl",
- 2928: "redstone-cpss",
- 2929: "amx-webadmin",
- 2930: "amx-weblinx",
- 2931: "circle-x",
- 2932: "incp",
- 2933: "4-tieropmgw",
- 2934: "4-tieropmcli",
- 2935: "qtp",
- 2936: "otpatch",
- 2937: "pnaconsult-lm",
- 2938: "sm-pas-1",
- 2939: "sm-pas-2",
- 2940: "sm-pas-3",
- 2941: "sm-pas-4",
- 2942: "sm-pas-5",
- 2943: "ttnrepository",
- 2944: "megaco-h248",
- 2945: "h248-binary",
- 2946: "fjsvmpor",
- 2947: "gpsd",
- 2948: "wap-push",
- 2949: "wap-pushsecure",
- 2950: "esip",
- 2951: "ottp",
- 2952: "mpfwsas",
- 2953: "ovalarmsrv",
- 2954: "ovalarmsrv-cmd",
- 2955: "csnotify",
- 2956: "ovrimosdbman",
- 2957: "jmact5",
- 2958: "jmact6",
- 2959: "rmopagt",
- 2960: "dfoxserver",
- 2961: "boldsoft-lm",
- 2962: "iph-policy-cli",
- 2963: "iph-policy-adm",
- 2964: "bullant-srap",
- 2965: "bullant-rap",
- 2966: "idp-infotrieve",
- 2967: "ssc-agent",
- 2968: "enpp",
- 2969: "essp",
- 2970: "index-net",
- 2971: "netclip",
- 2972: "pmsm-webrctl",
- 2973: "svnetworks",
- 2974: "signal",
- 2975: "fjmpcm",
- 2976: "cns-srv-port",
- 2977: "ttc-etap-ns",
- 2978: "ttc-etap-ds",
- 2979: "h263-video",
- 2980: "wimd",
- 2981: "mylxamport",
- 2982: "iwb-whiteboard",
- 2983: "netplan",
- 2984: "hpidsadmin",
- 2985: "hpidsagent",
- 2986: "stonefalls",
- 2987: "identify",
- 2988: "hippad",
- 2989: "zarkov",
- 2990: "boscap",
- 2991: "wkstn-mon",
- 2992: "avenyo",
- 2993: "veritas-vis1",
- 2994: "veritas-vis2",
- 2995: "idrs",
- 2996: "vsixml",
- 2997: "rebol",
- 2998: "realsecure",
- 2999: "remoteware-un",
- 3000: "hbci",
- 3001: "origo-native",
- 3002: "exlm-agent",
- 3003: "cgms",
- 3004: "csoftragent",
- 3005: "geniuslm",
- 3006: "ii-admin",
- 3007: "lotusmtap",
- 3008: "midnight-tech",
- 3009: "pxc-ntfy",
- 3010: "gw",
- 3011: "trusted-web",
- 3012: "twsdss",
- 3013: "gilatskysurfer",
- 3014: "broker-service",
- 3015: "nati-dstp",
- 3016: "notify-srvr",
- 3017: "event-listener",
- 3018: "srvc-registry",
- 3019: "resource-mgr",
- 3020: "cifs",
- 3021: "agriserver",
- 3022: "csregagent",
- 3023: "magicnotes",
- 3024: "nds-sso",
- 3025: "arepa-raft",
- 3026: "agri-gateway",
- 3027: "LiebDevMgmt-C",
- 3028: "LiebDevMgmt-DM",
- 3029: "LiebDevMgmt-A",
- 3030: "arepa-cas",
- 3031: "eppc",
- 3032: "redwood-chat",
- 3033: "pdb",
- 3034: "osmosis-aeea",
- 3035: "fjsv-gssagt",
- 3036: "hagel-dump",
- 3037: "hp-san-mgmt",
- 3038: "santak-ups",
- 3039: "cogitate",
- 3040: "tomato-springs",
- 3041: "di-traceware",
- 3042: "journee",
- 3043: "brp",
- 3044: "epp",
- 3045: "responsenet",
- 3046: "di-ase",
- 3047: "hlserver",
- 3048: "pctrader",
- 3049: "nsws",
- 3050: "gds-db",
- 3051: "galaxy-server",
- 3052: "apc-3052",
- 3053: "dsom-server",
- 3054: "amt-cnf-prot",
- 3055: "policyserver",
- 3056: "cdl-server",
- 3057: "goahead-fldup",
- 3058: "videobeans",
- 3059: "qsoft",
- 3060: "interserver",
- 3061: "cautcpd",
- 3062: "ncacn-ip-tcp",
- 3063: "ncadg-ip-udp",
- 3064: "rprt",
- 3065: "slinterbase",
- 3066: "netattachsdmp",
- 3067: "fjhpjp",
- 3068: "ls3bcast",
- 3069: "ls3",
- 3070: "mgxswitch",
- 3071: "csd-mgmt-port",
- 3072: "csd-monitor",
- 3073: "vcrp",
- 3074: "xbox",
- 3075: "orbix-locator",
- 3076: "orbix-config",
- 3077: "orbix-loc-ssl",
- 3078: "orbix-cfg-ssl",
- 3079: "lv-frontpanel",
- 3080: "stm-pproc",
- 3081: "tl1-lv",
- 3082: "tl1-raw",
- 3083: "tl1-telnet",
- 3084: "itm-mccs",
- 3085: "pcihreq",
- 3086: "jdl-dbkitchen",
- 3087: "asoki-sma",
- 3088: "xdtp",
- 3089: "ptk-alink",
- 3090: "stss",
- 3091: "1ci-smcs",
- 3093: "rapidmq-center",
- 3094: "rapidmq-reg",
- 3095: "panasas",
- 3096: "ndl-aps",
- 3098: "umm-port",
- 3099: "chmd",
- 3100: "opcon-xps",
- 3101: "hp-pxpib",
- 3102: "slslavemon",
- 3103: "autocuesmi",
- 3104: "autocuelog",
- 3105: "cardbox",
- 3106: "cardbox-http",
- 3107: "business",
- 3108: "geolocate",
- 3109: "personnel",
- 3110: "sim-control",
- 3111: "wsynch",
- 3112: "ksysguard",
- 3113: "cs-auth-svr",
- 3114: "ccmad",
- 3115: "mctet-master",
- 3116: "mctet-gateway",
- 3117: "mctet-jserv",
- 3118: "pkagent",
- 3119: "d2000kernel",
- 3120: "d2000webserver",
- 3121: "pcmk-remote",
- 3122: "vtr-emulator",
- 3123: "edix",
- 3124: "beacon-port",
- 3125: "a13-an",
- 3127: "ctx-bridge",
- 3128: "ndl-aas",
- 3129: "netport-id",
- 3130: "icpv2",
- 3131: "netbookmark",
- 3132: "ms-rule-engine",
- 3133: "prism-deploy",
- 3134: "ecp",
- 3135: "peerbook-port",
- 3136: "grubd",
- 3137: "rtnt-1",
- 3138: "rtnt-2",
- 3139: "incognitorv",
- 3140: "ariliamulti",
- 3141: "vmodem",
- 3142: "rdc-wh-eos",
- 3143: "seaview",
- 3144: "tarantella",
- 3145: "csi-lfap",
- 3146: "bears-02",
- 3147: "rfio",
- 3148: "nm-game-admin",
- 3149: "nm-game-server",
- 3150: "nm-asses-admin",
- 3151: "nm-assessor",
- 3152: "feitianrockey",
- 3153: "s8-client-port",
- 3154: "ccmrmi",
- 3155: "jpegmpeg",
- 3156: "indura",
- 3157: "e3consultants",
- 3158: "stvp",
- 3159: "navegaweb-port",
- 3160: "tip-app-server",
- 3161: "doc1lm",
- 3162: "sflm",
- 3163: "res-sap",
- 3164: "imprs",
- 3165: "newgenpay",
- 3166: "sossecollector",
- 3167: "nowcontact",
- 3168: "poweronnud",
- 3169: "serverview-as",
- 3170: "serverview-asn",
- 3171: "serverview-gf",
- 3172: "serverview-rm",
- 3173: "serverview-icc",
- 3174: "armi-server",
- 3175: "t1-e1-over-ip",
- 3176: "ars-master",
- 3177: "phonex-port",
- 3178: "radclientport",
- 3179: "h2gf-w-2m",
- 3180: "mc-brk-srv",
- 3181: "bmcpatrolagent",
- 3182: "bmcpatrolrnvu",
- 3183: "cops-tls",
- 3184: "apogeex-port",
- 3185: "smpppd",
- 3186: "iiw-port",
- 3187: "odi-port",
- 3188: "brcm-comm-port",
- 3189: "pcle-infex",
- 3190: "csvr-proxy",
- 3191: "csvr-sslproxy",
- 3192: "firemonrcc",
- 3193: "spandataport",
- 3194: "magbind",
- 3195: "ncu-1",
- 3196: "ncu-2",
- 3197: "embrace-dp-s",
- 3198: "embrace-dp-c",
- 3199: "dmod-workspace",
- 3200: "tick-port",
- 3201: "cpq-tasksmart",
- 3202: "intraintra",
- 3203: "netwatcher-mon",
- 3204: "netwatcher-db",
- 3205: "isns",
- 3206: "ironmail",
- 3207: "vx-auth-port",
- 3208: "pfu-prcallback",
- 3209: "netwkpathengine",
- 3210: "flamenco-proxy",
- 3211: "avsecuremgmt",
- 3212: "surveyinst",
- 3213: "neon24x7",
- 3214: "jmq-daemon-1",
- 3215: "jmq-daemon-2",
- 3216: "ferrari-foam",
- 3217: "unite",
- 3218: "smartpackets",
- 3219: "wms-messenger",
- 3220: "xnm-ssl",
- 3221: "xnm-clear-text",
- 3222: "glbp",
- 3223: "digivote",
- 3224: "aes-discovery",
- 3225: "fcip-port",
- 3226: "isi-irp",
- 3227: "dwnmshttp",
- 3228: "dwmsgserver",
- 3229: "global-cd-port",
- 3230: "sftdst-port",
- 3231: "vidigo",
- 3232: "mdtp",
- 3233: "whisker",
- 3234: "alchemy",
- 3235: "mdap-port",
- 3236: "apparenet-ts",
- 3237: "apparenet-tps",
- 3238: "apparenet-as",
- 3239: "apparenet-ui",
- 3240: "triomotion",
- 3241: "sysorb",
- 3242: "sdp-id-port",
- 3243: "timelot",
- 3244: "onesaf",
- 3245: "vieo-fe",
- 3246: "dvt-system",
- 3247: "dvt-data",
- 3248: "procos-lm",
- 3249: "ssp",
- 3250: "hicp",
- 3251: "sysscanner",
- 3252: "dhe",
- 3253: "pda-data",
- 3254: "pda-sys",
- 3255: "semaphore",
- 3256: "cpqrpm-agent",
- 3257: "cpqrpm-server",
- 3258: "ivecon-port",
- 3259: "epncdp2",
- 3260: "iscsi-target",
- 3261: "winshadow",
- 3262: "necp",
- 3263: "ecolor-imager",
- 3264: "ccmail",
- 3265: "altav-tunnel",
- 3266: "ns-cfg-server",
- 3267: "ibm-dial-out",
- 3268: "msft-gc",
- 3269: "msft-gc-ssl",
- 3270: "verismart",
- 3271: "csoft-prev",
- 3272: "user-manager",
- 3273: "sxmp",
- 3274: "ordinox-server",
- 3275: "samd",
- 3276: "maxim-asics",
- 3277: "awg-proxy",
- 3278: "lkcmserver",
- 3279: "admind",
- 3280: "vs-server",
- 3281: "sysopt",
- 3282: "datusorb",
- 3283: "Apple Remote Desktop (Net Assistant)",
- 3284: "4talk",
- 3285: "plato",
- 3286: "e-net",
- 3287: "directvdata",
- 3288: "cops",
- 3289: "enpc",
- 3290: "caps-lm",
- 3291: "sah-lm",
- 3292: "cart-o-rama",
- 3293: "fg-fps",
- 3294: "fg-gip",
- 3295: "dyniplookup",
- 3296: "rib-slm",
- 3297: "cytel-lm",
- 3298: "deskview",
- 3299: "pdrncs",
- 3302: "mcs-fastmail",
- 3303: "opsession-clnt",
- 3304: "opsession-srvr",
- 3305: "odette-ftp",
- 3306: "mysql",
- 3307: "opsession-prxy",
- 3308: "tns-server",
- 3309: "tns-adv",
- 3310: "dyna-access",
- 3311: "mcns-tel-ret",
- 3312: "appman-server",
- 3313: "uorb",
- 3314: "uohost",
- 3315: "cdid",
- 3316: "aicc-cmi",
- 3317: "vsaiport",
- 3318: "ssrip",
- 3319: "sdt-lmd",
- 3320: "officelink2000",
- 3321: "vnsstr",
- 3326: "sftu",
- 3327: "bbars",
- 3328: "egptlm",
- 3329: "hp-device-disc",
- 3330: "mcs-calypsoicf",
- 3331: "mcs-messaging",
- 3332: "mcs-mailsvr",
- 3333: "dec-notes",
- 3334: "directv-web",
- 3335: "directv-soft",
- 3336: "directv-tick",
- 3337: "directv-catlg",
- 3338: "anet-b",
- 3339: "anet-l",
- 3340: "anet-m",
- 3341: "anet-h",
- 3342: "webtie",
- 3343: "ms-cluster-net",
- 3344: "bnt-manager",
- 3345: "influence",
- 3346: "trnsprntproxy",
- 3347: "phoenix-rpc",
- 3348: "pangolin-laser",
- 3349: "chevinservices",
- 3350: "findviatv",
- 3351: "btrieve",
- 3352: "ssql",
- 3353: "fatpipe",
- 3354: "suitjd",
- 3355: "ordinox-dbase",
- 3356: "upnotifyps",
- 3357: "adtech-test",
- 3358: "mpsysrmsvr",
- 3359: "wg-netforce",
- 3360: "kv-server",
- 3361: "kv-agent",
- 3362: "dj-ilm",
- 3363: "nati-vi-server",
- 3364: "creativeserver",
- 3365: "contentserver",
- 3366: "creativepartnr",
- 3372: "tip2",
- 3373: "lavenir-lm",
- 3374: "cluster-disc",
- 3375: "vsnm-agent",
- 3376: "cdbroker",
- 3377: "cogsys-lm",
- 3378: "wsicopy",
- 3379: "socorfs",
- 3380: "sns-channels",
- 3381: "geneous",
- 3382: "fujitsu-neat",
- 3383: "esp-lm",
- 3384: "hp-clic",
- 3385: "qnxnetman",
- 3386: "gprs-data",
- 3387: "backroomnet",
- 3388: "cbserver",
- 3389: "ms-wbt-server",
- 3390: "dsc",
- 3391: "savant",
- 3392: "efi-lm",
- 3393: "d2k-tapestry1",
- 3394: "d2k-tapestry2",
- 3395: "dyna-lm",
- 3396: "printer-agent",
- 3397: "cloanto-lm",
- 3398: "mercantile",
- 3399: "csms",
- 3400: "csms2",
- 3401: "filecast",
- 3402: "fxaengine-net",
- 3405: "nokia-ann-ch1",
- 3406: "nokia-ann-ch2",
- 3407: "ldap-admin",
- 3408: "BESApi",
- 3409: "networklens",
- 3410: "networklenss",
- 3411: "biolink-auth",
- 3412: "xmlblaster",
- 3413: "svnet",
- 3414: "wip-port",
- 3415: "bcinameservice",
- 3416: "commandport",
- 3417: "csvr",
- 3418: "rnmap",
- 3419: "softaudit",
- 3420: "ifcp-port",
- 3421: "bmap",
- 3422: "rusb-sys-port",
- 3423: "xtrm",
- 3424: "xtrms",
- 3425: "agps-port",
- 3426: "arkivio",
- 3427: "websphere-snmp",
- 3428: "twcss",
- 3429: "gcsp",
- 3430: "ssdispatch",
- 3431: "ndl-als",
- 3432: "osdcp",
- 3433: "opnet-smp",
- 3434: "opencm",
- 3435: "pacom",
- 3436: "gc-config",
- 3437: "autocueds",
- 3438: "spiral-admin",
- 3439: "hri-port",
- 3440: "ans-console",
- 3441: "connect-client",
- 3442: "connect-server",
- 3443: "ov-nnm-websrv",
- 3444: "denali-server",
- 3445: "monp",
- 3446: "3comfaxrpc",
- 3447: "directnet",
- 3448: "dnc-port",
- 3449: "hotu-chat",
- 3450: "castorproxy",
- 3451: "asam",
- 3452: "sabp-signal",
- 3453: "pscupd",
- 3454: "mira",
- 3455: "prsvp",
- 3456: "vat",
- 3457: "vat-control",
- 3458: "d3winosfi",
- 3459: "integral",
- 3460: "edm-manager",
- 3461: "edm-stager",
- 3462: "edm-std-notify",
- 3463: "edm-adm-notify",
- 3464: "edm-mgr-sync",
- 3465: "edm-mgr-cntrl",
- 3466: "workflow",
- 3467: "rcst",
- 3468: "ttcmremotectrl",
- 3469: "pluribus",
- 3470: "jt400",
- 3471: "jt400-ssl",
- 3472: "jaugsremotec-1",
- 3473: "jaugsremotec-2",
- 3474: "ttntspauto",
- 3475: "genisar-port",
- 3476: "nppmp",
- 3477: "ecomm",
- 3478: "stun",
- 3479: "twrpc",
- 3480: "plethora",
- 3481: "cleanerliverc",
- 3482: "vulture",
- 3483: "slim-devices",
- 3484: "gbs-stp",
- 3485: "celatalk",
- 3486: "ifsf-hb-port",
- 3487: "ltctcp",
- 3488: "fs-rh-srv",
- 3489: "dtp-dia",
- 3490: "colubris",
- 3491: "swr-port",
- 3492: "tvdumtray-port",
- 3493: "nut",
- 3494: "ibm3494",
- 3495: "seclayer-tcp",
- 3496: "seclayer-tls",
- 3497: "ipether232port",
- 3498: "dashpas-port",
- 3499: "sccip-media",
- 3500: "rtmp-port",
- 3501: "isoft-p2p",
- 3502: "avinstalldisc",
- 3503: "lsp-ping",
- 3504: "ironstorm",
- 3505: "ccmcomm",
- 3506: "apc-3506",
- 3507: "nesh-broker",
- 3508: "interactionweb",
- 3509: "vt-ssl",
- 3510: "xss-port",
- 3511: "webmail-2",
- 3512: "aztec",
- 3513: "arcpd",
- 3514: "must-p2p",
- 3515: "must-backplane",
- 3516: "smartcard-port",
- 3517: "802-11-iapp",
- 3518: "artifact-msg",
- 3519: "nvmsgd",
- 3520: "galileolog",
- 3521: "mc3ss",
- 3522: "nssocketport",
- 3523: "odeumservlink",
- 3524: "ecmport",
- 3525: "eisport",
- 3526: "starquiz-port",
- 3527: "beserver-msg-q",
- 3528: "jboss-iiop",
- 3529: "jboss-iiop-ssl",
- 3530: "gf",
- 3531: "joltid",
- 3532: "raven-rmp",
- 3533: "raven-rdp",
- 3534: "urld-port",
- 3535: "ms-la",
- 3536: "snac",
- 3537: "ni-visa-remote",
- 3538: "ibm-diradm",
- 3539: "ibm-diradm-ssl",
- 3540: "pnrp-port",
- 3541: "voispeed-port",
- 3542: "hacl-monitor",
- 3543: "qftest-lookup",
- 3544: "teredo",
- 3545: "camac",
- 3547: "symantec-sim",
- 3548: "interworld",
- 3549: "tellumat-nms",
- 3550: "ssmpp",
- 3551: "apcupsd",
- 3552: "taserver",
- 3553: "rbr-discovery",
- 3554: "questnotify",
- 3555: "razor",
- 3556: "sky-transport",
- 3557: "personalos-001",
- 3558: "mcp-port",
- 3559: "cctv-port",
- 3560: "iniserve-port",
- 3561: "bmc-onekey",
- 3562: "sdbproxy",
- 3563: "watcomdebug",
- 3564: "esimport",
- 3565: "m2pa",
- 3566: "quest-data-hub",
- 3567: "enc-eps",
- 3568: "enc-tunnel-sec",
- 3569: "mbg-ctrl",
- 3570: "mccwebsvr-port",
- 3571: "megardsvr-port",
- 3572: "megaregsvrport",
- 3573: "tag-ups-1",
- 3574: "dmaf-server",
- 3575: "ccm-port",
- 3576: "cmc-port",
- 3577: "config-port",
- 3578: "data-port",
- 3579: "ttat3lb",
- 3580: "nati-svrloc",
- 3581: "kfxaclicensing",
- 3582: "press",
- 3583: "canex-watch",
- 3584: "u-dbap",
- 3585: "emprise-lls",
- 3586: "emprise-lsc",
- 3587: "p2pgroup",
- 3588: "sentinel",
- 3589: "isomair",
- 3590: "wv-csp-sms",
- 3591: "gtrack-server",
- 3592: "gtrack-ne",
- 3593: "bpmd",
- 3594: "mediaspace",
- 3595: "shareapp",
- 3596: "iw-mmogame",
- 3597: "a14",
- 3598: "a15",
- 3599: "quasar-server",
- 3600: "trap-daemon",
- 3601: "visinet-gui",
- 3602: "infiniswitchcl",
- 3603: "int-rcv-cntrl",
- 3604: "bmc-jmx-port",
- 3605: "comcam-io",
- 3606: "splitlock",
- 3607: "precise-i3",
- 3608: "trendchip-dcp",
- 3609: "cpdi-pidas-cm",
- 3610: "echonet",
- 3611: "six-degrees",
- 3612: "hp-dataprotect",
- 3613: "alaris-disc",
- 3614: "sigma-port",
- 3615: "start-network",
- 3616: "cd3o-protocol",
- 3617: "sharp-server",
- 3618: "aairnet-1",
- 3619: "aairnet-2",
- 3620: "ep-pcp",
- 3621: "ep-nsp",
- 3622: "ff-lr-port",
- 3623: "haipe-discover",
- 3624: "dist-upgrade",
- 3625: "volley",
- 3626: "bvcdaemon-port",
- 3627: "jamserverport",
- 3628: "ept-machine",
- 3629: "escvpnet",
- 3630: "cs-remote-db",
- 3631: "cs-services",
- 3632: "distcc",
- 3633: "wacp",
- 3634: "hlibmgr",
- 3635: "sdo",
- 3636: "servistaitsm",
- 3637: "scservp",
- 3638: "ehp-backup",
- 3639: "xap-ha",
- 3640: "netplay-port1",
- 3641: "netplay-port2",
- 3642: "juxml-port",
- 3643: "audiojuggler",
- 3644: "ssowatch",
- 3645: "cyc",
- 3646: "xss-srv-port",
- 3647: "splitlock-gw",
- 3648: "fjcp",
- 3649: "nmmp",
- 3650: "prismiq-plugin",
- 3651: "xrpc-registry",
- 3652: "vxcrnbuport",
- 3653: "tsp",
- 3654: "vaprtm",
- 3655: "abatemgr",
- 3656: "abatjss",
- 3657: "immedianet-bcn",
- 3658: "ps-ams",
- 3659: "apple-sasl",
- 3660: "can-nds-ssl",
- 3661: "can-ferret-ssl",
- 3662: "pserver",
- 3663: "dtp",
- 3664: "ups-engine",
- 3665: "ent-engine",
- 3666: "eserver-pap",
- 3667: "infoexch",
- 3668: "dell-rm-port",
- 3669: "casanswmgmt",
- 3670: "smile",
- 3671: "efcp",
- 3672: "lispworks-orb",
- 3673: "mediavault-gui",
- 3674: "wininstall-ipc",
- 3675: "calltrax",
- 3676: "va-pacbase",
- 3677: "roverlog",
- 3678: "ipr-dglt",
- 3679: "Escale (Newton Dock)",
- 3680: "npds-tracker",
- 3681: "bts-x73",
- 3682: "cas-mapi",
- 3683: "bmc-ea",
- 3684: "faxstfx-port",
- 3685: "dsx-agent",
- 3686: "tnmpv2",
- 3687: "simple-push",
- 3688: "simple-push-s",
- 3689: "daap",
- 3690: "svn",
- 3691: "magaya-network",
- 3692: "intelsync",
- 3695: "bmc-data-coll",
- 3696: "telnetcpcd",
- 3697: "nw-license",
- 3698: "sagectlpanel",
- 3699: "kpn-icw",
- 3700: "lrs-paging",
- 3701: "netcelera",
- 3702: "ws-discovery",
- 3703: "adobeserver-3",
- 3704: "adobeserver-4",
- 3705: "adobeserver-5",
- 3706: "rt-event",
- 3707: "rt-event-s",
- 3708: "sun-as-iiops",
- 3709: "ca-idms",
- 3710: "portgate-auth",
- 3711: "edb-server2",
- 3712: "sentinel-ent",
- 3713: "tftps",
- 3714: "delos-dms",
- 3715: "anoto-rendezv",
- 3716: "wv-csp-sms-cir",
- 3717: "wv-csp-udp-cir",
- 3718: "opus-services",
- 3719: "itelserverport",
- 3720: "ufastro-instr",
- 3721: "xsync",
- 3722: "xserveraid",
- 3723: "sychrond",
- 3724: "blizwow",
- 3725: "na-er-tip",
- 3726: "array-manager",
- 3727: "e-mdu",
- 3728: "e-woa",
- 3729: "fksp-audit",
- 3730: "client-ctrl",
- 3731: "smap",
- 3732: "m-wnn",
- 3733: "multip-msg",
- 3734: "synel-data",
- 3735: "pwdis",
- 3736: "rs-rmi",
- 3737: "xpanel",
- 3738: "versatalk",
- 3739: "launchbird-lm",
- 3740: "heartbeat",
- 3741: "wysdma",
- 3742: "cst-port",
- 3743: "ipcs-command",
- 3744: "sasg",
- 3745: "gw-call-port",
- 3746: "linktest",
- 3747: "linktest-s",
- 3748: "webdata",
- 3749: "cimtrak",
- 3750: "cbos-ip-port",
- 3751: "gprs-cube",
- 3752: "vipremoteagent",
- 3753: "nattyserver",
- 3754: "timestenbroker",
- 3755: "sas-remote-hlp",
- 3756: "canon-capt",
- 3757: "grf-port",
- 3758: "apw-registry",
- 3759: "exapt-lmgr",
- 3760: "adtempusclient",
- 3761: "gsakmp",
- 3762: "gbs-smp",
- 3763: "xo-wave",
- 3764: "mni-prot-rout",
- 3765: "rtraceroute",
- 3766: "sitewatch-s",
- 3767: "listmgr-port",
- 3768: "rblcheckd",
- 3769: "haipe-otnk",
- 3770: "cindycollab",
- 3771: "paging-port",
- 3772: "ctp",
- 3773: "ctdhercules",
- 3774: "zicom",
- 3775: "ispmmgr",
- 3776: "dvcprov-port",
- 3777: "jibe-eb",
- 3778: "c-h-it-port",
- 3779: "cognima",
- 3780: "nnp",
- 3781: "abcvoice-port",
- 3782: "iso-tp0s",
- 3783: "bim-pem",
- 3784: "bfd-control",
- 3785: "bfd-echo",
- 3786: "upstriggervsw",
- 3787: "fintrx",
- 3788: "isrp-port",
- 3789: "remotedeploy",
- 3790: "quickbooksrds",
- 3791: "tvnetworkvideo",
- 3792: "sitewatch",
- 3793: "dcsoftware",
- 3794: "jaus",
- 3795: "myblast",
- 3796: "spw-dialer",
- 3797: "idps",
- 3798: "minilock",
- 3799: "radius-dynauth",
- 3800: "pwgpsi",
- 3801: "ibm-mgr",
- 3802: "vhd",
- 3803: "soniqsync",
- 3804: "iqnet-port",
- 3805: "tcpdataserver",
- 3806: "wsmlb",
- 3807: "spugna",
- 3808: "sun-as-iiops-ca",
- 3809: "apocd",
- 3810: "wlanauth",
- 3811: "amp",
- 3812: "neto-wol-server",
- 3813: "rap-ip",
- 3814: "neto-dcs",
- 3815: "lansurveyorxml",
- 3816: "sunlps-http",
- 3817: "tapeware",
- 3818: "crinis-hb",
- 3819: "epl-slp",
- 3820: "scp",
- 3821: "pmcp",
- 3822: "acp-discovery",
- 3823: "acp-conduit",
- 3824: "acp-policy",
- 3825: "ffserver",
- 3826: "warmux",
- 3827: "netmpi",
- 3828: "neteh",
- 3829: "neteh-ext",
- 3830: "cernsysmgmtagt",
- 3831: "dvapps",
- 3832: "xxnetserver",
- 3833: "aipn-auth",
- 3834: "spectardata",
- 3835: "spectardb",
- 3836: "markem-dcp",
- 3837: "mkm-discovery",
- 3838: "sos",
- 3839: "amx-rms",
- 3840: "flirtmitmir",
- 3841: "shiprush-db-svr",
- 3842: "nhci",
- 3843: "quest-agent",
- 3844: "rnm",
- 3845: "v-one-spp",
- 3846: "an-pcp",
- 3847: "msfw-control",
- 3848: "item",
- 3849: "spw-dnspreload",
- 3850: "qtms-bootstrap",
- 3851: "spectraport",
- 3852: "sse-app-config",
- 3853: "sscan",
- 3854: "stryker-com",
- 3855: "opentrac",
- 3856: "informer",
- 3857: "trap-port",
- 3858: "trap-port-mom",
- 3859: "nav-port",
- 3860: "sasp",
- 3861: "winshadow-hd",
- 3862: "giga-pocket",
- 3863: "asap-tcp",
- 3864: "asap-tcp-tls",
- 3865: "xpl",
- 3866: "dzdaemon",
- 3867: "dzoglserver",
- 3868: "diameter",
- 3869: "ovsam-mgmt",
- 3870: "ovsam-d-agent",
- 3871: "avocent-adsap",
- 3872: "oem-agent",
- 3873: "fagordnc",
- 3874: "sixxsconfig",
- 3875: "pnbscada",
- 3876: "dl-agent",
- 3877: "xmpcr-interface",
- 3878: "fotogcad",
- 3879: "appss-lm",
- 3880: "igrs",
- 3881: "idac",
- 3882: "msdts1",
- 3883: "vrpn",
- 3884: "softrack-meter",
- 3885: "topflow-ssl",
- 3886: "nei-management",
- 3887: "ciphire-data",
- 3888: "ciphire-serv",
- 3889: "dandv-tester",
- 3890: "ndsconnect",
- 3891: "rtc-pm-port",
- 3892: "pcc-image-port",
- 3893: "cgi-starapi",
- 3894: "syam-agent",
- 3895: "syam-smc",
- 3896: "sdo-tls",
- 3897: "sdo-ssh",
- 3898: "senip",
- 3899: "itv-control",
- 3900: "udt-os",
- 3901: "nimsh",
- 3902: "nimaux",
- 3903: "charsetmgr",
- 3904: "omnilink-port",
- 3905: "mupdate",
- 3906: "topovista-data",
- 3907: "imoguia-port",
- 3908: "hppronetman",
- 3909: "surfcontrolcpa",
- 3910: "prnrequest",
- 3911: "prnstatus",
- 3912: "gbmt-stars",
- 3913: "listcrt-port",
- 3914: "listcrt-port-2",
- 3915: "agcat",
- 3916: "wysdmc",
- 3917: "aftmux",
- 3918: "pktcablemmcops",
- 3919: "hyperip",
- 3920: "exasoftport1",
- 3921: "herodotus-net",
- 3922: "sor-update",
- 3923: "symb-sb-port",
- 3924: "mpl-gprs-port",
- 3925: "zmp",
- 3926: "winport",
- 3927: "natdataservice",
- 3928: "netboot-pxe",
- 3929: "smauth-port",
- 3930: "syam-webserver",
- 3931: "msr-plugin-port",
- 3932: "dyn-site",
- 3933: "plbserve-port",
- 3934: "sunfm-port",
- 3935: "sdp-portmapper",
- 3936: "mailprox",
- 3937: "dvbservdsc",
- 3938: "dbcontrol-agent",
- 3939: "aamp",
- 3940: "xecp-node",
- 3941: "homeportal-web",
- 3942: "srdp",
- 3943: "tig",
- 3944: "sops",
- 3945: "emcads",
- 3946: "backupedge",
- 3947: "ccp",
- 3948: "apdap",
- 3949: "drip",
- 3950: "namemunge",
- 3951: "pwgippfax",
- 3952: "i3-sessionmgr",
- 3953: "xmlink-connect",
- 3954: "adrep",
- 3955: "p2pcommunity",
- 3956: "gvcp",
- 3957: "mqe-broker",
- 3958: "mqe-agent",
- 3959: "treehopper",
- 3960: "bess",
- 3961: "proaxess",
- 3962: "sbi-agent",
- 3963: "thrp",
- 3964: "sasggprs",
- 3965: "ati-ip-to-ncpe",
- 3966: "bflckmgr",
- 3967: "ppsms",
- 3968: "ianywhere-dbns",
- 3969: "landmarks",
- 3970: "lanrevagent",
- 3971: "lanrevserver",
- 3972: "iconp",
- 3973: "progistics",
- 3974: "citysearch",
- 3975: "airshot",
- 3976: "opswagent",
- 3977: "opswmanager",
- 3978: "secure-cfg-svr",
- 3979: "smwan",
- 3980: "acms",
- 3981: "starfish",
- 3982: "eis",
- 3983: "eisp",
- 3984: "mapper-nodemgr",
- 3985: "mapper-mapethd",
- 3986: "mapper-ws-ethd",
- 3987: "centerline",
- 3988: "dcs-config",
- 3989: "bv-queryengine",
- 3990: "bv-is",
- 3991: "bv-smcsrv",
- 3992: "bv-ds",
- 3993: "bv-agent",
- 3995: "iss-mgmt-ssl",
- 3996: "abcsoftware",
- 3997: "agentsease-db",
- 3998: "dnx",
- 3999: "nvcnet",
- 4000: "terabase",
- 4001: "newoak",
- 4002: "pxc-spvr-ft",
- 4003: "pxc-splr-ft",
- 4004: "pxc-roid",
- 4005: "pxc-pin",
- 4006: "pxc-spvr",
- 4007: "pxc-splr",
- 4008: "netcheque",
- 4009: "chimera-hwm",
- 4010: "samsung-unidex",
- 4011: "altserviceboot",
- 4012: "pda-gate",
- 4013: "acl-manager",
- 4014: "taiclock",
- 4015: "talarian-mcast1",
- 4016: "talarian-mcast2",
- 4017: "talarian-mcast3",
- 4018: "talarian-mcast4",
- 4019: "talarian-mcast5",
- 4020: "trap",
- 4021: "nexus-portal",
- 4022: "dnox",
- 4023: "esnm-zoning",
- 4024: "tnp1-port",
- 4025: "partimage",
- 4026: "as-debug",
- 4027: "bxp",
- 4028: "dtserver-port",
- 4029: "ip-qsig",
- 4030: "jdmn-port",
- 4031: "suucp",
- 4032: "vrts-auth-port",
- 4033: "sanavigator",
- 4034: "ubxd",
- 4035: "wap-push-http",
- 4036: "wap-push-https",
- 4037: "ravehd",
- 4038: "fazzt-ptp",
- 4039: "fazzt-admin",
- 4040: "yo-main",
- 4041: "houston",
- 4042: "ldxp",
- 4043: "nirp",
- 4044: "ltp",
- 4045: "npp",
- 4046: "acp-proto",
- 4047: "ctp-state",
- 4049: "wafs",
- 4050: "cisco-wafs",
- 4051: "cppdp",
- 4052: "interact",
- 4053: "ccu-comm-1",
- 4054: "ccu-comm-2",
- 4055: "ccu-comm-3",
- 4056: "lms",
- 4057: "wfm",
- 4058: "kingfisher",
- 4059: "dlms-cosem",
- 4060: "dsmeter-iatc",
- 4061: "ice-location",
- 4062: "ice-slocation",
- 4063: "ice-router",
- 4064: "ice-srouter",
- 4065: "avanti-cdp",
- 4066: "pmas",
- 4067: "idp",
- 4068: "ipfltbcst",
- 4069: "minger",
- 4070: "tripe",
- 4071: "aibkup",
- 4072: "zieto-sock",
- 4073: "iRAPP",
- 4074: "cequint-cityid",
- 4075: "perimlan",
- 4076: "seraph",
- 4078: "cssp",
- 4079: "santools",
- 4080: "lorica-in",
- 4081: "lorica-in-sec",
- 4082: "lorica-out",
- 4083: "lorica-out-sec",
- 4085: "ezmessagesrv",
- 4087: "applusservice",
- 4088: "npsp",
- 4089: "opencore",
- 4090: "omasgport",
- 4091: "ewinstaller",
- 4092: "ewdgs",
- 4093: "pvxpluscs",
- 4094: "sysrqd",
- 4095: "xtgui",
- 4096: "bre",
- 4097: "patrolview",
- 4098: "drmsfsd",
- 4099: "dpcp",
- 4100: "igo-incognito",
- 4101: "brlp-0",
- 4102: "brlp-1",
- 4103: "brlp-2",
- 4104: "brlp-3",
- 4105: "shofar",
- 4106: "synchronite",
- 4107: "j-ac",
- 4108: "accel",
- 4109: "izm",
- 4110: "g2tag",
- 4111: "xgrid",
- 4112: "apple-vpns-rp",
- 4113: "aipn-reg",
- 4114: "jomamqmonitor",
- 4115: "cds",
- 4116: "smartcard-tls",
- 4117: "hillrserv",
- 4118: "netscript",
- 4119: "assuria-slm",
- 4121: "e-builder",
- 4122: "fprams",
- 4123: "z-wave",
- 4124: "tigv2",
- 4125: "opsview-envoy",
- 4126: "ddrepl",
- 4127: "unikeypro",
- 4128: "nufw",
- 4129: "nuauth",
- 4130: "fronet",
- 4131: "stars",
- 4132: "nuts-dem",
- 4133: "nuts-bootp",
- 4134: "nifty-hmi",
- 4135: "cl-db-attach",
- 4136: "cl-db-request",
- 4137: "cl-db-remote",
- 4138: "nettest",
- 4139: "thrtx",
- 4140: "cedros-fds",
- 4141: "oirtgsvc",
- 4142: "oidocsvc",
- 4143: "oidsr",
- 4145: "vvr-control",
- 4146: "tgcconnect",
- 4147: "vrxpservman",
- 4148: "hhb-handheld",
- 4149: "agslb",
- 4150: "PowerAlert-nsa",
- 4151: "menandmice-noh",
- 4152: "idig-mux",
- 4153: "mbl-battd",
- 4154: "atlinks",
- 4155: "bzr",
- 4156: "stat-results",
- 4157: "stat-scanner",
- 4158: "stat-cc",
- 4159: "nss",
- 4160: "jini-discovery",
- 4161: "omscontact",
- 4162: "omstopology",
- 4163: "silverpeakpeer",
- 4164: "silverpeakcomm",
- 4165: "altcp",
- 4166: "joost",
- 4167: "ddgn",
- 4168: "pslicser",
- 4169: "iadt",
- 4170: "d-cinema-csp",
- 4171: "ml-svnet",
- 4172: "pcoip",
- 4174: "smcluster",
- 4175: "bccp",
- 4176: "tl-ipcproxy",
- 4177: "wello",
- 4178: "storman",
- 4179: "MaxumSP",
- 4180: "httpx",
- 4181: "macbak",
- 4182: "pcptcpservice",
- 4183: "gmmp",
- 4184: "universe-suite",
- 4185: "wcpp",
- 4186: "boxbackupstore",
- 4187: "csc-proxy",
- 4188: "vatata",
- 4189: "pcep",
- 4190: "sieve",
- 4192: "azeti",
- 4193: "pvxplusio",
- 4199: "eims-admin",
- 4300: "corelccam",
- 4301: "d-data",
- 4302: "d-data-control",
- 4303: "srcp",
- 4304: "owserver",
- 4305: "batman",
- 4306: "pinghgl",
- 4307: "visicron-vs",
- 4308: "compx-lockview",
- 4309: "dserver",
- 4310: "mirrtex",
- 4311: "p6ssmc",
- 4312: "pscl-mgt",
- 4313: "perrla",
- 4314: "choiceview-agt",
- 4316: "choiceview-clt",
- 4320: "fdt-rcatp",
- 4321: "rwhois",
- 4322: "trim-event",
- 4323: "trim-ice",
- 4324: "balour",
- 4325: "geognosisman",
- 4326: "geognosis",
- 4327: "jaxer-web",
- 4328: "jaxer-manager",
- 4329: "publiqare-sync",
- 4330: "dey-sapi",
- 4331: "ktickets-rest",
- 4333: "ahsp",
- 4340: "gaia",
- 4341: "lisp-data",
- 4342: "lisp-cons",
- 4343: "unicall",
- 4344: "vinainstall",
- 4345: "m4-network-as",
- 4346: "elanlm",
- 4347: "lansurveyor",
- 4348: "itose",
- 4349: "fsportmap",
- 4350: "net-device",
- 4351: "plcy-net-svcs",
- 4352: "pjlink",
- 4353: "f5-iquery",
- 4354: "qsnet-trans",
- 4355: "qsnet-workst",
- 4356: "qsnet-assist",
- 4357: "qsnet-cond",
- 4358: "qsnet-nucl",
- 4359: "omabcastltkm",
- 4360: "matrix-vnet",
- 4368: "wxbrief",
- 4369: "epmd",
- 4370: "elpro-tunnel",
- 4371: "l2c-control",
- 4372: "l2c-data",
- 4373: "remctl",
- 4374: "psi-ptt",
- 4375: "tolteces",
- 4376: "bip",
- 4377: "cp-spxsvr",
- 4378: "cp-spxdpy",
- 4379: "ctdb",
- 4389: "xandros-cms",
- 4390: "wiegand",
- 4391: "apwi-imserver",
- 4392: "apwi-rxserver",
- 4393: "apwi-rxspooler",
- 4395: "omnivisionesx",
- 4396: "fly",
- 4400: "ds-srv",
- 4401: "ds-srvr",
- 4402: "ds-clnt",
- 4403: "ds-user",
- 4404: "ds-admin",
- 4405: "ds-mail",
- 4406: "ds-slp",
- 4407: "nacagent",
- 4408: "slscc",
- 4409: "netcabinet-com",
- 4410: "itwo-server",
- 4411: "found",
- 4425: "netrockey6",
- 4426: "beacon-port-2",
- 4427: "drizzle",
- 4428: "omviserver",
- 4429: "omviagent",
- 4430: "rsqlserver",
- 4431: "wspipe",
- 4432: "l-acoustics",
- 4433: "vop",
- 4442: "saris",
- 4443: "pharos",
- 4444: "krb524",
- 4445: "upnotifyp",
- 4446: "n1-fwp",
- 4447: "n1-rmgmt",
- 4448: "asc-slmd",
- 4449: "privatewire",
- 4450: "camp",
- 4451: "ctisystemmsg",
- 4452: "ctiprogramload",
- 4453: "nssalertmgr",
- 4454: "nssagentmgr",
- 4455: "prchat-user",
- 4456: "prchat-server",
- 4457: "prRegister",
- 4458: "mcp",
- 4484: "hpssmgmt",
- 4485: "assyst-dr",
- 4486: "icms",
- 4487: "prex-tcp",
- 4488: "awacs-ice",
- 4500: "ipsec-nat-t",
- 4535: "ehs",
- 4536: "ehs-ssl",
- 4537: "wssauthsvc",
- 4538: "swx-gate",
- 4545: "worldscores",
- 4546: "sf-lm",
- 4547: "lanner-lm",
- 4548: "synchromesh",
- 4549: "aegate",
- 4550: "gds-adppiw-db",
- 4551: "ieee-mih",
- 4552: "menandmice-mon",
- 4553: "icshostsvc",
- 4554: "msfrs",
- 4555: "rsip",
- 4556: "dtn-bundle",
- 4559: "hylafax",
- 4563: "amahi-anywhere",
- 4566: "kwtc",
- 4567: "tram",
- 4568: "bmc-reporting",
- 4569: "iax",
- 4570: "deploymentmap",
- 4590: "rid",
- 4591: "l3t-at-an",
- 4593: "ipt-anri-anri",
- 4594: "ias-session",
- 4595: "ias-paging",
- 4596: "ias-neighbor",
- 4597: "a21-an-1xbs",
- 4598: "a16-an-an",
- 4599: "a17-an-an",
- 4600: "piranha1",
- 4601: "piranha2",
- 4602: "mtsserver",
- 4603: "menandmice-upg",
- 4604: "irp",
- 4658: "playsta2-app",
- 4659: "playsta2-lob",
- 4660: "smaclmgr",
- 4661: "kar2ouche",
- 4662: "oms",
- 4663: "noteit",
- 4664: "ems",
- 4665: "contclientms",
- 4666: "eportcomm",
- 4667: "mmacomm",
- 4668: "mmaeds",
- 4669: "eportcommdata",
- 4670: "light",
- 4671: "acter",
- 4672: "rfa",
- 4673: "cxws",
- 4674: "appiq-mgmt",
- 4675: "dhct-status",
- 4676: "dhct-alerts",
- 4677: "bcs",
- 4678: "traversal",
- 4679: "mgesupervision",
- 4680: "mgemanagement",
- 4681: "parliant",
- 4682: "finisar",
- 4683: "spike",
- 4684: "rfid-rp1",
- 4685: "autopac",
- 4686: "msp-os",
- 4687: "nst",
- 4688: "mobile-p2p",
- 4689: "altovacentral",
- 4690: "prelude",
- 4691: "mtn",
- 4692: "conspiracy",
- 4700: "netxms-agent",
- 4701: "netxms-mgmt",
- 4702: "netxms-sync",
- 4703: "npqes-test",
- 4704: "assuria-ins",
- 4725: "truckstar",
- 4727: "fcis",
- 4728: "capmux",
- 4730: "gearman",
- 4731: "remcap",
- 4733: "resorcs",
- 4737: "ipdr-sp",
- 4738: "solera-lpn",
- 4739: "ipfix",
- 4740: "ipfixs",
- 4741: "lumimgrd",
- 4742: "sicct",
- 4743: "openhpid",
- 4744: "ifsp",
- 4745: "fmp",
- 4749: "profilemac",
- 4750: "ssad",
- 4751: "spocp",
- 4752: "snap",
- 4753: "simon",
- 4784: "bfd-multi-ctl",
- 4786: "smart-install",
- 4787: "sia-ctrl-plane",
- 4788: "xmcp",
- 4800: "iims",
- 4801: "iwec",
- 4802: "ilss",
- 4803: "notateit",
- 4827: "htcp",
- 4837: "varadero-0",
- 4838: "varadero-1",
- 4839: "varadero-2",
- 4840: "opcua-tcp",
- 4841: "quosa",
- 4842: "gw-asv",
- 4843: "opcua-tls",
- 4844: "gw-log",
- 4845: "wcr-remlib",
- 4846: "contamac-icm",
- 4847: "wfc",
- 4848: "appserv-http",
- 4849: "appserv-https",
- 4850: "sun-as-nodeagt",
- 4851: "derby-repli",
- 4867: "unify-debug",
- 4868: "phrelay",
- 4869: "phrelaydbg",
- 4870: "cc-tracking",
- 4871: "wired",
- 4876: "tritium-can",
- 4877: "lmcs",
- 4879: "wsdl-event",
- 4880: "hislip",
- 4883: "wmlserver",
- 4884: "hivestor",
- 4885: "abbs",
- 4894: "lyskom",
- 4899: "radmin-port",
- 4900: "hfcs",
- 4901: "flr-agent",
- 4902: "magiccontrol",
- 4912: "lutap",
- 4913: "lutcp",
- 4914: "bones",
- 4915: "frcs",
- 4940: "eq-office-4940",
- 4941: "eq-office-4941",
- 4942: "eq-office-4942",
- 4949: "munin",
- 4950: "sybasesrvmon",
- 4951: "pwgwims",
- 4952: "sagxtsds",
- 4953: "dbsyncarbiter",
- 4969: "ccss-qmm",
- 4970: "ccss-qsm",
- 4984: "webyast",
- 4985: "gerhcs",
- 4986: "mrip",
- 4987: "smar-se-port1",
- 4988: "smar-se-port2",
- 4989: "parallel",
- 4990: "busycal",
- 4991: "vrt",
- 4999: "hfcs-manager",
- 5000: "commplex-main",
- 5001: "commplex-link",
- 5002: "rfe",
- 5003: "fmpro-internal",
- 5004: "avt-profile-1",
- 5005: "avt-profile-2",
- 5006: "wsm-server",
- 5007: "wsm-server-ssl",
- 5008: "synapsis-edge",
- 5009: "winfs",
- 5010: "telelpathstart",
- 5011: "telelpathattack",
- 5012: "nsp",
- 5013: "fmpro-v6",
- 5015: "fmwp",
- 5020: "zenginkyo-1",
- 5021: "zenginkyo-2",
- 5022: "mice",
- 5023: "htuilsrv",
- 5024: "scpi-telnet",
- 5025: "scpi-raw",
- 5026: "strexec-d",
- 5027: "strexec-s",
- 5028: "qvr",
- 5029: "infobright",
- 5030: "surfpass",
- 5032: "signacert-agent",
- 5042: "asnaacceler8db",
- 5043: "swxadmin",
- 5044: "lxi-evntsvc",
- 5045: "osp",
- 5048: "texai",
- 5049: "ivocalize",
- 5050: "mmcc",
- 5051: "ita-agent",
- 5052: "ita-manager",
- 5053: "rlm",
- 5054: "rlm-admin",
- 5055: "unot",
- 5056: "intecom-ps1",
- 5057: "intecom-ps2",
- 5059: "sds",
- 5060: "sip",
- 5061: "sips",
- 5062: "na-localise",
- 5063: "csrpc",
- 5064: "ca-1",
- 5065: "ca-2",
- 5066: "stanag-5066",
- 5067: "authentx",
- 5068: "bitforestsrv",
- 5069: "i-net-2000-npr",
- 5070: "vtsas",
- 5071: "powerschool",
- 5072: "ayiya",
- 5073: "tag-pm",
- 5074: "alesquery",
- 5075: "pvaccess",
- 5080: "onscreen",
- 5081: "sdl-ets",
- 5082: "qcp",
- 5083: "qfp",
- 5084: "llrp",
- 5085: "encrypted-llrp",
- 5086: "aprigo-cs",
- 5087: "biotic",
- 5093: "sentinel-lm",
- 5094: "hart-ip",
- 5099: "sentlm-srv2srv",
- 5100: "socalia",
- 5101: "talarian-tcp",
- 5102: "oms-nonsecure",
- 5103: "actifio-c2c",
- 5106: "actifioudsagent",
- 5111: "taep-as-svc",
- 5112: "pm-cmdsvr",
- 5114: "ev-services",
- 5115: "autobuild",
- 5117: "gradecam",
- 5120: "barracuda-bbs",
- 5133: "nbt-pc",
- 5134: "ppactivation",
- 5135: "erp-scale",
- 5137: "ctsd",
- 5145: "rmonitor-secure",
- 5146: "social-alarm",
- 5150: "atmp",
- 5151: "esri-sde",
- 5152: "sde-discovery",
- 5153: "toruxserver",
- 5154: "bzflag",
- 5155: "asctrl-agent",
- 5156: "rugameonline",
- 5157: "mediat",
- 5161: "snmpssh",
- 5162: "snmpssh-trap",
- 5163: "sbackup",
- 5164: "vpa",
- 5165: "ife-icorp",
- 5166: "winpcs",
- 5167: "scte104",
- 5168: "scte30",
- 5172: "pcoip-mgmt",
- 5190: "aol",
- 5191: "aol-1",
- 5192: "aol-2",
- 5193: "aol-3",
- 5194: "cpscomm",
- 5195: "ampl-lic",
- 5196: "ampl-tableproxy",
- 5200: "targus-getdata",
- 5201: "targus-getdata1",
- 5202: "targus-getdata2",
- 5203: "targus-getdata3",
- 5209: "nomad",
- 5215: "noteza",
- 5221: "3exmp",
- 5222: "xmpp-client",
- 5223: "hpvirtgrp",
- 5224: "hpvirtctrl",
- 5225: "hp-server",
- 5226: "hp-status",
- 5227: "perfd",
- 5228: "hpvroom",
- 5229: "jaxflow",
- 5230: "jaxflow-data",
- 5231: "crusecontrol",
- 5232: "csedaemon",
- 5233: "enfs",
- 5234: "eenet",
- 5235: "galaxy-network",
- 5236: "padl2sim",
- 5237: "mnet-discovery",
- 5245: "downtools",
- 5248: "caacws",
- 5249: "caaclang2",
- 5250: "soagateway",
- 5251: "caevms",
- 5252: "movaz-ssc",
- 5253: "kpdp",
- 5264: "3com-njack-1",
- 5265: "3com-njack-2",
- 5269: "xmpp-server",
- 5270: "cartographerxmp",
- 5271: "cuelink",
- 5272: "pk",
- 5280: "xmpp-bosh",
- 5281: "undo-lm",
- 5282: "transmit-port",
- 5298: "presence",
- 5299: "nlg-data",
- 5300: "hacl-hb",
- 5301: "hacl-gs",
- 5302: "hacl-cfg",
- 5303: "hacl-probe",
- 5304: "hacl-local",
- 5305: "hacl-test",
- 5306: "sun-mc-grp",
- 5307: "sco-aip",
- 5308: "cfengine",
- 5309: "jprinter",
- 5310: "outlaws",
- 5312: "permabit-cs",
- 5313: "rrdp",
- 5314: "opalis-rbt-ipc",
- 5315: "hacl-poll",
- 5316: "hpbladems",
- 5317: "hpdevms",
- 5318: "pkix-cmc",
- 5320: "bsfserver-zn",
- 5321: "bsfsvr-zn-ssl",
- 5343: "kfserver",
- 5344: "xkotodrcp",
- 5349: "stuns",
- 5352: "dns-llq",
- 5353: "mdns",
- 5354: "mdnsresponder",
- 5355: "llmnr",
- 5356: "ms-smlbiz",
- 5357: "wsdapi",
- 5358: "wsdapi-s",
- 5359: "ms-alerter",
- 5360: "ms-sideshow",
- 5361: "ms-s-sideshow",
- 5362: "serverwsd2",
- 5363: "net-projection",
- 5397: "stresstester",
- 5398: "elektron-admin",
- 5399: "securitychase",
- 5400: "excerpt",
- 5401: "excerpts",
- 5402: "mftp",
- 5403: "hpoms-ci-lstn",
- 5404: "hpoms-dps-lstn",
- 5405: "netsupport",
- 5406: "systemics-sox",
- 5407: "foresyte-clear",
- 5408: "foresyte-sec",
- 5409: "salient-dtasrv",
- 5410: "salient-usrmgr",
- 5411: "actnet",
- 5412: "continuus",
- 5413: "wwiotalk",
- 5414: "statusd",
- 5415: "ns-server",
- 5416: "sns-gateway",
- 5417: "sns-agent",
- 5418: "mcntp",
- 5419: "dj-ice",
- 5420: "cylink-c",
- 5421: "netsupport2",
- 5422: "salient-mux",
- 5423: "virtualuser",
- 5424: "beyond-remote",
- 5425: "br-channel",
- 5426: "devbasic",
- 5427: "sco-peer-tta",
- 5428: "telaconsole",
- 5429: "base",
- 5430: "radec-corp",
- 5431: "park-agent",
- 5432: "postgresql",
- 5433: "pyrrho",
- 5434: "sgi-arrayd",
- 5435: "sceanics",
- 5443: "spss",
- 5445: "smbdirect",
- 5453: "surebox",
- 5454: "apc-5454",
- 5455: "apc-5455",
- 5456: "apc-5456",
- 5461: "silkmeter",
- 5462: "ttl-publisher",
- 5463: "ttlpriceproxy",
- 5464: "quailnet",
- 5465: "netops-broker",
- 5500: "fcp-addr-srvr1",
- 5501: "fcp-addr-srvr2",
- 5502: "fcp-srvr-inst1",
- 5503: "fcp-srvr-inst2",
- 5504: "fcp-cics-gw1",
- 5505: "checkoutdb",
- 5506: "amc",
- 5553: "sgi-eventmond",
- 5554: "sgi-esphttp",
- 5555: "personal-agent",
- 5556: "freeciv",
- 5557: "farenet",
- 5566: "westec-connect",
- 5567: "enc-eps-mc-sec",
- 5568: "sdt",
- 5569: "rdmnet-ctrl",
- 5573: "sdmmp",
- 5574: "lsi-bobcat",
- 5575: "ora-oap",
- 5579: "fdtracks",
- 5580: "tmosms0",
- 5581: "tmosms1",
- 5582: "fac-restore",
- 5583: "tmo-icon-sync",
- 5584: "bis-web",
- 5585: "bis-sync",
- 5586: "att-mt-sms",
- 5597: "ininmessaging",
- 5598: "mctfeed",
- 5599: "esinstall",
- 5600: "esmmanager",
- 5601: "esmagent",
- 5602: "a1-msc",
- 5603: "a1-bs",
- 5604: "a3-sdunode",
- 5605: "a4-sdunode",
- 5618: "efr",
- 5627: "ninaf",
- 5628: "htrust",
- 5629: "symantec-sfdb",
- 5630: "precise-comm",
- 5631: "pcanywheredata",
- 5632: "pcanywherestat",
- 5633: "beorl",
- 5634: "xprtld",
- 5635: "sfmsso",
- 5636: "sfm-db-server",
- 5637: "cssc",
- 5638: "flcrs",
- 5639: "ics",
- 5646: "vfmobile",
- 5670: "filemq",
- 5671: "amqps",
- 5672: "amqp",
- 5673: "jms",
- 5674: "hyperscsi-port",
- 5675: "v5ua",
- 5676: "raadmin",
- 5677: "questdb2-lnchr",
- 5678: "rrac",
- 5679: "dccm",
- 5680: "auriga-router",
- 5681: "ncxcp",
- 5688: "ggz",
- 5689: "qmvideo",
- 5693: "rbsystem",
- 5696: "kmip",
- 5713: "proshareaudio",
- 5714: "prosharevideo",
- 5715: "prosharedata",
- 5716: "prosharerequest",
- 5717: "prosharenotify",
- 5718: "dpm",
- 5719: "dpm-agent",
- 5720: "ms-licensing",
- 5721: "dtpt",
- 5722: "msdfsr",
- 5723: "omhs",
- 5724: "omsdk",
- 5725: "ms-ilm",
- 5726: "ms-ilm-sts",
- 5727: "asgenf",
- 5728: "io-dist-data",
- 5729: "openmail",
- 5730: "unieng",
- 5741: "ida-discover1",
- 5742: "ida-discover2",
- 5743: "watchdoc-pod",
- 5744: "watchdoc",
- 5745: "fcopy-server",
- 5746: "fcopys-server",
- 5747: "tunatic",
- 5748: "tunalyzer",
- 5750: "rscd",
- 5755: "openmailg",
- 5757: "x500ms",
- 5766: "openmailns",
- 5767: "s-openmail",
- 5768: "openmailpxy",
- 5769: "spramsca",
- 5770: "spramsd",
- 5771: "netagent",
- 5777: "dali-port",
- 5780: "vts-rpc",
- 5781: "3par-evts",
- 5782: "3par-mgmt",
- 5783: "3par-mgmt-ssl",
- 5785: "3par-rcopy",
- 5793: "xtreamx",
- 5813: "icmpd",
- 5814: "spt-automation",
- 5841: "shiprush-d-ch",
- 5842: "reversion",
- 5859: "wherehoo",
- 5863: "ppsuitemsg",
- 5868: "diameters",
- 5883: "jute",
- 5900: "rfb",
- 5910: "cm",
- 5911: "cpdlc",
- 5912: "fis",
- 5913: "ads-c",
- 5963: "indy",
- 5968: "mppolicy-v5",
- 5969: "mppolicy-mgr",
- 5984: "couchdb",
- 5985: "wsman",
- 5986: "wsmans",
- 5987: "wbem-rmi",
- 5988: "wbem-http",
- 5989: "wbem-https",
- 5990: "wbem-exp-https",
- 5991: "nuxsl",
- 5992: "consul-insight",
- 5999: "cvsup",
- 6064: "ndl-ahp-svc",
- 6065: "winpharaoh",
- 6066: "ewctsp",
- 6068: "gsmp-ancp",
- 6069: "trip",
- 6070: "messageasap",
- 6071: "ssdtp",
- 6072: "diagnose-proc",
- 6073: "directplay8",
- 6074: "max",
- 6075: "dpm-acm",
- 6076: "msft-dpm-cert",
- 6077: "iconstructsrv",
- 6084: "reload-config",
- 6085: "konspire2b",
- 6086: "pdtp",
- 6087: "ldss",
- 6088: "doglms",
- 6099: "raxa-mgmt",
- 6100: "synchronet-db",
- 6101: "synchronet-rtc",
- 6102: "synchronet-upd",
- 6103: "rets",
- 6104: "dbdb",
- 6105: "primaserver",
- 6106: "mpsserver",
- 6107: "etc-control",
- 6108: "sercomm-scadmin",
- 6109: "globecast-id",
- 6110: "softcm",
- 6111: "spc",
- 6112: "dtspcd",
- 6113: "dayliteserver",
- 6114: "wrspice",
- 6115: "xic",
- 6116: "xtlserv",
- 6117: "daylitetouch",
- 6121: "spdy",
- 6122: "bex-webadmin",
- 6123: "backup-express",
- 6124: "pnbs",
- 6130: "damewaremobgtwy",
- 6133: "nbt-wol",
- 6140: "pulsonixnls",
- 6141: "meta-corp",
- 6142: "aspentec-lm",
- 6143: "watershed-lm",
- 6144: "statsci1-lm",
- 6145: "statsci2-lm",
- 6146: "lonewolf-lm",
- 6147: "montage-lm",
- 6148: "ricardo-lm",
- 6149: "tal-pod",
- 6159: "efb-aci",
- 6160: "ecmp",
- 6161: "patrol-ism",
- 6162: "patrol-coll",
- 6163: "pscribe",
- 6200: "lm-x",
- 6222: "radmind",
- 6241: "jeol-nsdtp-1",
- 6242: "jeol-nsdtp-2",
- 6243: "jeol-nsdtp-3",
- 6244: "jeol-nsdtp-4",
- 6251: "tl1-raw-ssl",
- 6252: "tl1-ssh",
- 6253: "crip",
- 6267: "gld",
- 6268: "grid",
- 6269: "grid-alt",
- 6300: "bmc-grx",
- 6301: "bmc-ctd-ldap",
- 6306: "ufmp",
- 6315: "scup",
- 6316: "abb-escp",
- 6317: "nav-data-cmd",
- 6320: "repsvc",
- 6321: "emp-server1",
- 6322: "emp-server2",
- 6324: "hrd-ncs",
- 6325: "dt-mgmtsvc",
- 6326: "dt-vra",
- 6343: "sflow",
- 6344: "streletz",
- 6346: "gnutella-svc",
- 6347: "gnutella-rtr",
- 6350: "adap",
- 6355: "pmcs",
- 6360: "metaedit-mu",
- 6370: "metaedit-se",
- 6382: "metatude-mds",
- 6389: "clariion-evr01",
- 6390: "metaedit-ws",
- 6417: "faxcomservice",
- 6418: "syserverremote",
- 6419: "svdrp",
- 6420: "nim-vdrshell",
- 6421: "nim-wan",
- 6432: "pgbouncer",
- 6442: "tarp",
- 6443: "sun-sr-https",
- 6444: "sge-qmaster",
- 6445: "sge-execd",
- 6446: "mysql-proxy",
- 6455: "skip-cert-recv",
- 6456: "skip-cert-send",
- 6471: "lvision-lm",
- 6480: "sun-sr-http",
- 6481: "servicetags",
- 6482: "ldoms-mgmt",
- 6483: "SunVTS-RMI",
- 6484: "sun-sr-jms",
- 6485: "sun-sr-iiop",
- 6486: "sun-sr-iiops",
- 6487: "sun-sr-iiop-aut",
- 6488: "sun-sr-jmx",
- 6489: "sun-sr-admin",
- 6500: "boks",
- 6501: "boks-servc",
- 6502: "boks-servm",
- 6503: "boks-clntd",
- 6505: "badm-priv",
- 6506: "badm-pub",
- 6507: "bdir-priv",
- 6508: "bdir-pub",
- 6509: "mgcs-mfp-port",
- 6510: "mcer-port",
- 6513: "netconf-tls",
- 6514: "syslog-tls",
- 6515: "elipse-rec",
- 6543: "lds-distrib",
- 6544: "lds-dump",
- 6547: "apc-6547",
- 6548: "apc-6548",
- 6549: "apc-6549",
- 6550: "fg-sysupdate",
- 6551: "sum",
- 6558: "xdsxdm",
- 6566: "sane-port",
- 6568: "canit-store",
- 6579: "affiliate",
- 6580: "parsec-master",
- 6581: "parsec-peer",
- 6582: "parsec-game",
- 6583: "joaJewelSuite",
- 6600: "mshvlm",
- 6601: "mstmg-sstp",
- 6602: "wsscomfrmwk",
- 6619: "odette-ftps",
- 6620: "kftp-data",
- 6621: "kftp",
- 6622: "mcftp",
- 6623: "ktelnet",
- 6624: "datascaler-db",
- 6625: "datascaler-ctl",
- 6626: "wago-service",
- 6627: "nexgen",
- 6628: "afesc-mc",
- 6632: "mxodbc-connect",
- 6640: "ovsdb",
- 6653: "openflow",
- 6655: "pcs-sf-ui-man",
- 6656: "emgmsg",
- 6670: "vocaltec-gold",
- 6671: "p4p-portal",
- 6672: "vision-server",
- 6673: "vision-elmd",
- 6678: "vfbp",
- 6679: "osaut",
- 6687: "clever-ctrace",
- 6688: "clever-tcpip",
- 6689: "tsa",
- 6697: "ircs-u",
- 6701: "kti-icad-srvr",
- 6702: "e-design-net",
- 6703: "e-design-web",
- 6714: "ibprotocol",
- 6715: "fibotrader-com",
- 6716: "printercare-cc",
- 6767: "bmc-perf-agent",
- 6768: "bmc-perf-mgrd",
- 6769: "adi-gxp-srvprt",
- 6770: "plysrv-http",
- 6771: "plysrv-https",
- 6777: "ntz-tracker",
- 6778: "ntz-p2p-storage",
- 6785: "dgpf-exchg",
- 6786: "smc-jmx",
- 6787: "smc-admin",
- 6788: "smc-http",
- 6789: "smc-https",
- 6790: "hnmp",
- 6791: "hnm",
- 6801: "acnet",
- 6817: "pentbox-sim",
- 6831: "ambit-lm",
- 6841: "netmo-default",
- 6842: "netmo-http",
- 6850: "iccrushmore",
- 6868: "acctopus-cc",
- 6888: "muse",
- 6901: "jetstream",
- 6935: "ethoscan",
- 6936: "xsmsvc",
- 6946: "bioserver",
- 6951: "otlp",
- 6961: "jmact3",
- 6962: "jmevt2",
- 6963: "swismgr1",
- 6964: "swismgr2",
- 6965: "swistrap",
- 6966: "swispol",
- 6969: "acmsoda",
- 6997: "MobilitySrv",
- 6998: "iatp-highpri",
- 6999: "iatp-normalpri",
- 7000: "afs3-fileserver",
- 7001: "afs3-callback",
- 7002: "afs3-prserver",
- 7003: "afs3-vlserver",
- 7004: "afs3-kaserver",
- 7005: "afs3-volser",
- 7006: "afs3-errors",
- 7007: "afs3-bos",
- 7008: "afs3-update",
- 7009: "afs3-rmtsys",
- 7010: "ups-onlinet",
- 7011: "talon-disc",
- 7012: "talon-engine",
- 7013: "microtalon-dis",
- 7014: "microtalon-com",
- 7015: "talon-webserver",
- 7018: "fisa-svc",
- 7019: "doceri-ctl",
- 7020: "dpserve",
- 7021: "dpserveadmin",
- 7022: "ctdp",
- 7023: "ct2nmcs",
- 7024: "vmsvc",
- 7025: "vmsvc-2",
- 7030: "op-probe",
- 7031: "iposplanet",
- 7070: "arcp",
- 7071: "iwg1",
- 7073: "martalk",
- 7080: "empowerid",
- 7099: "lazy-ptop",
- 7100: "font-service",
- 7101: "elcn",
- 7121: "virprot-lm",
- 7128: "scenidm",
- 7129: "scenccs",
- 7161: "cabsm-comm",
- 7162: "caistoragemgr",
- 7163: "cacsambroker",
- 7164: "fsr",
- 7165: "doc-server",
- 7166: "aruba-server",
- 7167: "casrmagent",
- 7168: "cnckadserver",
- 7169: "ccag-pib",
- 7170: "nsrp",
- 7171: "drm-production",
- 7172: "metalbend",
- 7173: "zsecure",
- 7174: "clutild",
- 7200: "fodms",
- 7201: "dlip",
- 7227: "ramp",
- 7228: "citrixupp",
- 7229: "citrixuppg",
- 7236: "display",
- 7237: "pads",
- 7262: "cnap",
- 7272: "watchme-7272",
- 7273: "oma-rlp",
- 7274: "oma-rlp-s",
- 7275: "oma-ulp",
- 7276: "oma-ilp",
- 7277: "oma-ilp-s",
- 7278: "oma-dcdocbs",
- 7279: "ctxlic",
- 7280: "itactionserver1",
- 7281: "itactionserver2",
- 7282: "mzca-action",
- 7283: "genstat",
- 7365: "lcm-server",
- 7391: "mindfilesys",
- 7392: "mrssrendezvous",
- 7393: "nfoldman",
- 7394: "fse",
- 7395: "winqedit",
- 7397: "hexarc",
- 7400: "rtps-discovery",
- 7401: "rtps-dd-ut",
- 7402: "rtps-dd-mt",
- 7410: "ionixnetmon",
- 7411: "daqstream",
- 7421: "mtportmon",
- 7426: "pmdmgr",
- 7427: "oveadmgr",
- 7428: "ovladmgr",
- 7429: "opi-sock",
- 7430: "xmpv7",
- 7431: "pmd",
- 7437: "faximum",
- 7443: "oracleas-https",
- 7471: "sttunnel",
- 7473: "rise",
- 7474: "neo4j",
- 7491: "telops-lmd",
- 7500: "silhouette",
- 7501: "ovbus",
- 7508: "adcp",
- 7509: "acplt",
- 7510: "ovhpas",
- 7511: "pafec-lm",
- 7542: "saratoga",
- 7543: "atul",
- 7544: "nta-ds",
- 7545: "nta-us",
- 7546: "cfs",
- 7547: "cwmp",
- 7548: "tidp",
- 7549: "nls-tl",
- 7560: "sncp",
- 7563: "cfw",
- 7566: "vsi-omega",
- 7569: "dell-eql-asm",
- 7570: "aries-kfinder",
- 7574: "coherence",
- 7588: "sun-lm",
- 7624: "indi",
- 7626: "simco",
- 7627: "soap-http",
- 7628: "zen-pawn",
- 7629: "xdas",
- 7630: "hawk",
- 7631: "tesla-sys-msg",
- 7633: "pmdfmgt",
- 7648: "cuseeme",
- 7672: "imqstomp",
- 7673: "imqstomps",
- 7674: "imqtunnels",
- 7675: "imqtunnel",
- 7676: "imqbrokerd",
- 7677: "sun-user-https",
- 7680: "pando-pub",
- 7689: "collaber",
- 7697: "klio",
- 7700: "em7-secom",
- 7707: "sync-em7",
- 7708: "scinet",
- 7720: "medimageportal",
- 7724: "nsdeepfreezectl",
- 7725: "nitrogen",
- 7726: "freezexservice",
- 7727: "trident-data",
- 7734: "smip",
- 7738: "aiagent",
- 7741: "scriptview",
- 7742: "msss",
- 7743: "sstp-1",
- 7744: "raqmon-pdu",
- 7747: "prgp",
- 7777: "cbt",
- 7778: "interwise",
- 7779: "vstat",
- 7781: "accu-lmgr",
- 7786: "minivend",
- 7787: "popup-reminders",
- 7789: "office-tools",
- 7794: "q3ade",
- 7797: "pnet-conn",
- 7798: "pnet-enc",
- 7799: "altbsdp",
- 7800: "asr",
- 7801: "ssp-client",
- 7810: "rbt-wanopt",
- 7845: "apc-7845",
- 7846: "apc-7846",
- 7847: "csoauth",
- 7869: "mobileanalyzer",
- 7870: "rbt-smc",
- 7871: "mdm",
- 7878: "owms",
- 7880: "pss",
- 7887: "ubroker",
- 7900: "mevent",
- 7901: "tnos-sp",
- 7902: "tnos-dp",
- 7903: "tnos-dps",
- 7913: "qo-secure",
- 7932: "t2-drm",
- 7933: "t2-brm",
- 7962: "generalsync",
- 7967: "supercell",
- 7979: "micromuse-ncps",
- 7980: "quest-vista",
- 7981: "sossd-collect",
- 7982: "sossd-agent",
- 7997: "pushns",
- 7999: "irdmi2",
- 8000: "irdmi",
- 8001: "vcom-tunnel",
- 8002: "teradataordbms",
- 8003: "mcreport",
- 8005: "mxi",
- 8008: "http-alt",
- 8019: "qbdb",
- 8020: "intu-ec-svcdisc",
- 8021: "intu-ec-client",
- 8022: "oa-system",
- 8025: "ca-audit-da",
- 8026: "ca-audit-ds",
- 8032: "pro-ed",
- 8033: "mindprint",
- 8034: "vantronix-mgmt",
- 8040: "ampify",
- 8042: "fs-agent",
- 8043: "fs-server",
- 8044: "fs-mgmt",
- 8051: "rocrail",
- 8052: "senomix01",
- 8053: "senomix02",
- 8054: "senomix03",
- 8055: "senomix04",
- 8056: "senomix05",
- 8057: "senomix06",
- 8058: "senomix07",
- 8059: "senomix08",
- 8066: "toad-bi-appsrvr",
- 8074: "gadugadu",
- 8080: "http-alt",
- 8081: "sunproxyadmin",
- 8082: "us-cli",
- 8083: "us-srv",
- 8086: "d-s-n",
- 8087: "simplifymedia",
- 8088: "radan-http",
- 8091: "jamlink",
- 8097: "sac",
- 8100: "xprint-server",
- 8101: "ldoms-migr",
- 8102: "kz-migr",
- 8115: "mtl8000-matrix",
- 8116: "cp-cluster",
- 8117: "purityrpc",
- 8118: "privoxy",
- 8121: "apollo-data",
- 8122: "apollo-admin",
- 8128: "paycash-online",
- 8129: "paycash-wbp",
- 8130: "indigo-vrmi",
- 8131: "indigo-vbcp",
- 8132: "dbabble",
- 8148: "isdd",
- 8153: "quantastor",
- 8160: "patrol",
- 8161: "patrol-snmp",
- 8162: "lpar2rrd",
- 8181: "intermapper",
- 8182: "vmware-fdm",
- 8183: "proremote",
- 8184: "itach",
- 8191: "limnerpressure",
- 8192: "spytechphone",
- 8194: "blp1",
- 8195: "blp2",
- 8199: "vvr-data",
- 8200: "trivnet1",
- 8201: "trivnet2",
- 8204: "lm-perfworks",
- 8205: "lm-instmgr",
- 8206: "lm-dta",
- 8207: "lm-sserver",
- 8208: "lm-webwatcher",
- 8230: "rexecj",
- 8243: "synapse-nhttps",
- 8276: "pando-sec",
- 8280: "synapse-nhttp",
- 8292: "blp3",
- 8293: "hiperscan-id",
- 8294: "blp4",
- 8300: "tmi",
- 8301: "amberon",
- 8313: "hub-open-net",
- 8320: "tnp-discover",
- 8321: "tnp",
- 8351: "server-find",
- 8376: "cruise-enum",
- 8377: "cruise-swroute",
- 8378: "cruise-config",
- 8379: "cruise-diags",
- 8380: "cruise-update",
- 8383: "m2mservices",
- 8400: "cvd",
- 8401: "sabarsd",
- 8402: "abarsd",
- 8403: "admind",
- 8404: "svcloud",
- 8405: "svbackup",
- 8415: "dlpx-sp",
- 8416: "espeech",
- 8417: "espeech-rtp",
- 8442: "cybro-a-bus",
- 8443: "pcsync-https",
- 8444: "pcsync-http",
- 8445: "copy",
- 8450: "npmp",
- 8457: "nexentamv",
- 8470: "cisco-avp",
- 8471: "pim-port",
- 8472: "otv",
- 8473: "vp2p",
- 8474: "noteshare",
- 8500: "fmtp",
- 8501: "cmtp-mgt",
- 8502: "ftnmtp",
- 8554: "rtsp-alt",
- 8555: "d-fence",
- 8567: "enc-tunnel",
- 8600: "asterix",
- 8610: "canon-mfnp",
- 8611: "canon-bjnp1",
- 8612: "canon-bjnp2",
- 8613: "canon-bjnp3",
- 8614: "canon-bjnp4",
- 8615: "imink",
- 8665: "monetra",
- 8666: "monetra-admin",
- 8675: "msi-cps-rm",
- 8686: "sun-as-jmxrmi",
- 8688: "openremote-ctrl",
- 8699: "vnyx",
- 8711: "nvc",
- 8733: "ibus",
- 8750: "dey-keyneg",
- 8763: "mc-appserver",
- 8764: "openqueue",
- 8765: "ultraseek-http",
- 8766: "amcs",
- 8770: "dpap",
- 8778: "uec",
- 8786: "msgclnt",
- 8787: "msgsrvr",
- 8793: "acd-pm",
- 8800: "sunwebadmin",
- 8804: "truecm",
- 8873: "dxspider",
- 8880: "cddbp-alt",
- 8881: "galaxy4d",
- 8883: "secure-mqtt",
- 8888: "ddi-tcp-1",
- 8889: "ddi-tcp-2",
- 8890: "ddi-tcp-3",
- 8891: "ddi-tcp-4",
- 8892: "ddi-tcp-5",
- 8893: "ddi-tcp-6",
- 8894: "ddi-tcp-7",
- 8899: "ospf-lite",
- 8900: "jmb-cds1",
- 8901: "jmb-cds2",
- 8910: "manyone-http",
- 8911: "manyone-xml",
- 8912: "wcbackup",
- 8913: "dragonfly",
- 8937: "twds",
- 8953: "ub-dns-control",
- 8954: "cumulus-admin",
- 8989: "sunwebadmins",
- 8990: "http-wmap",
- 8991: "https-wmap",
- 8998: "canto-roboflow",
- 8999: "bctp",
- 9000: "cslistener",
- 9001: "etlservicemgr",
- 9002: "dynamid",
- 9008: "ogs-server",
- 9009: "pichat",
- 9010: "sdr",
- 9020: "tambora",
- 9021: "panagolin-ident",
- 9022: "paragent",
- 9023: "swa-1",
- 9024: "swa-2",
- 9025: "swa-3",
- 9026: "swa-4",
- 9050: "versiera",
- 9051: "fio-cmgmt",
- 9080: "glrpc",
- 9083: "emc-pp-mgmtsvc",
- 9084: "aurora",
- 9085: "ibm-rsyscon",
- 9086: "net2display",
- 9087: "classic",
- 9088: "sqlexec",
- 9089: "sqlexec-ssl",
- 9090: "websm",
- 9091: "xmltec-xmlmail",
- 9092: "XmlIpcRegSvc",
- 9093: "copycat",
- 9100: "hp-pdl-datastr",
- 9101: "bacula-dir",
- 9102: "bacula-fd",
- 9103: "bacula-sd",
- 9104: "peerwire",
- 9105: "xadmin",
- 9106: "astergate",
- 9107: "astergatefax",
- 9119: "mxit",
- 9122: "grcmp",
- 9123: "grcp",
- 9131: "dddp",
- 9160: "apani1",
- 9161: "apani2",
- 9162: "apani3",
- 9163: "apani4",
- 9164: "apani5",
- 9191: "sun-as-jpda",
- 9200: "wap-wsp",
- 9201: "wap-wsp-wtp",
- 9202: "wap-wsp-s",
- 9203: "wap-wsp-wtp-s",
- 9204: "wap-vcard",
- 9205: "wap-vcal",
- 9206: "wap-vcard-s",
- 9207: "wap-vcal-s",
- 9208: "rjcdb-vcards",
- 9209: "almobile-system",
- 9210: "oma-mlp",
- 9211: "oma-mlp-s",
- 9212: "serverviewdbms",
- 9213: "serverstart",
- 9214: "ipdcesgbs",
- 9215: "insis",
- 9216: "acme",
- 9217: "fsc-port",
- 9222: "teamcoherence",
- 9255: "mon",
- 9278: "pegasus",
- 9279: "pegasus-ctl",
- 9280: "pgps",
- 9281: "swtp-port1",
- 9282: "swtp-port2",
- 9283: "callwaveiam",
- 9284: "visd",
- 9285: "n2h2server",
- 9287: "cumulus",
- 9292: "armtechdaemon",
- 9293: "storview",
- 9294: "armcenterhttp",
- 9295: "armcenterhttps",
- 9300: "vrace",
- 9306: "sphinxql",
- 9312: "sphinxapi",
- 9318: "secure-ts",
- 9321: "guibase",
- 9343: "mpidcmgr",
- 9344: "mphlpdmc",
- 9346: "ctechlicensing",
- 9374: "fjdmimgr",
- 9380: "boxp",
- 9387: "d2dconfig",
- 9388: "d2ddatatrans",
- 9389: "adws",
- 9390: "otp",
- 9396: "fjinvmgr",
- 9397: "mpidcagt",
- 9400: "sec-t4net-srv",
- 9401: "sec-t4net-clt",
- 9402: "sec-pc2fax-srv",
- 9418: "git",
- 9443: "tungsten-https",
- 9444: "wso2esb-console",
- 9445: "mindarray-ca",
- 9450: "sntlkeyssrvr",
- 9500: "ismserver",
- 9535: "mngsuite",
- 9536: "laes-bf",
- 9555: "trispen-sra",
- 9592: "ldgateway",
- 9593: "cba8",
- 9594: "msgsys",
- 9595: "pds",
- 9596: "mercury-disc",
- 9597: "pd-admin",
- 9598: "vscp",
- 9599: "robix",
- 9600: "micromuse-ncpw",
- 9612: "streamcomm-ds",
- 9614: "iadt-tls",
- 9616: "erunbook-agent",
- 9617: "erunbook-server",
- 9618: "condor",
- 9628: "odbcpathway",
- 9629: "uniport",
- 9630: "peoctlr",
- 9631: "peocoll",
- 9640: "pqsflows",
- 9666: "zoomcp",
- 9667: "xmms2",
- 9668: "tec5-sdctp",
- 9694: "client-wakeup",
- 9695: "ccnx",
- 9700: "board-roar",
- 9747: "l5nas-parchan",
- 9750: "board-voip",
- 9753: "rasadv",
- 9762: "tungsten-http",
- 9800: "davsrc",
- 9801: "sstp-2",
- 9802: "davsrcs",
- 9875: "sapv1",
- 9876: "sd",
- 9888: "cyborg-systems",
- 9889: "gt-proxy",
- 9898: "monkeycom",
- 9900: "iua",
- 9909: "domaintime",
- 9911: "sype-transport",
- 9925: "xybrid-cloud",
- 9950: "apc-9950",
- 9951: "apc-9951",
- 9952: "apc-9952",
- 9953: "acis",
- 9954: "hinp",
- 9955: "alljoyn-stm",
- 9966: "odnsp",
- 9978: "xybrid-rt",
- 9987: "dsm-scm-target",
- 9988: "nsesrvr",
- 9990: "osm-appsrvr",
- 9991: "osm-oev",
- 9992: "palace-1",
- 9993: "palace-2",
- 9994: "palace-3",
- 9995: "palace-4",
- 9996: "palace-5",
- 9997: "palace-6",
- 9998: "distinct32",
- 9999: "distinct",
- 10000: "ndmp",
- 10001: "scp-config",
- 10002: "documentum",
- 10003: "documentum-s",
- 10004: "emcrmirccd",
- 10005: "emcrmird",
- 10006: "netapp-sync",
- 10007: "mvs-capacity",
- 10008: "octopus",
- 10009: "swdtp-sv",
- 10010: "rxapi",
- 10050: "zabbix-agent",
- 10051: "zabbix-trapper",
- 10055: "qptlmd",
- 10080: "amanda",
- 10081: "famdc",
- 10100: "itap-ddtp",
- 10101: "ezmeeting-2",
- 10102: "ezproxy-2",
- 10103: "ezrelay",
- 10104: "swdtp",
- 10107: "bctp-server",
- 10110: "nmea-0183",
- 10113: "netiq-endpoint",
- 10114: "netiq-qcheck",
- 10115: "netiq-endpt",
- 10116: "netiq-voipa",
- 10117: "iqrm",
- 10128: "bmc-perf-sd",
- 10129: "bmc-gms",
- 10160: "qb-db-server",
- 10161: "snmptls",
- 10162: "snmptls-trap",
- 10200: "trisoap",
- 10201: "rsms",
- 10252: "apollo-relay",
- 10260: "axis-wimp-port",
- 10288: "blocks",
- 10321: "cosir",
- 10540: "MOS-lower",
- 10541: "MOS-upper",
- 10542: "MOS-aux",
- 10543: "MOS-soap",
- 10544: "MOS-soap-opt",
- 10631: "printopia",
- 10800: "gap",
- 10805: "lpdg",
- 10809: "nbd",
- 10860: "helix",
- 10880: "bveapi",
- 10990: "rmiaux",
- 11000: "irisa",
- 11001: "metasys",
- 11095: "weave",
- 11103: "origo-sync",
- 11104: "netapp-icmgmt",
- 11105: "netapp-icdata",
- 11106: "sgi-lk",
- 11109: "sgi-dmfmgr",
- 11110: "sgi-soap",
- 11111: "vce",
- 11112: "dicom",
- 11161: "suncacao-snmp",
- 11162: "suncacao-jmxmp",
- 11163: "suncacao-rmi",
- 11164: "suncacao-csa",
- 11165: "suncacao-websvc",
- 11172: "oemcacao-jmxmp",
- 11173: "t5-straton",
- 11174: "oemcacao-rmi",
- 11175: "oemcacao-websvc",
- 11201: "smsqp",
- 11202: "dcsl-backup",
- 11208: "wifree",
- 11211: "memcache",
- 11319: "imip",
- 11320: "imip-channels",
- 11321: "arena-server",
- 11367: "atm-uhas",
- 11371: "hkp",
- 11489: "asgcypresstcps",
- 11600: "tempest-port",
- 11623: "emc-xsw-dconfig",
- 11720: "h323callsigalt",
- 11723: "emc-xsw-dcache",
- 11751: "intrepid-ssl",
- 11796: "lanschool",
- 11876: "xoraya",
- 11967: "sysinfo-sp",
- 12000: "entextxid",
- 12001: "entextnetwk",
- 12002: "entexthigh",
- 12003: "entextmed",
- 12004: "entextlow",
- 12005: "dbisamserver1",
- 12006: "dbisamserver2",
- 12007: "accuracer",
- 12008: "accuracer-dbms",
- 12010: "edbsrvr",
- 12012: "vipera",
- 12013: "vipera-ssl",
- 12109: "rets-ssl",
- 12121: "nupaper-ss",
- 12168: "cawas",
- 12172: "hivep",
- 12300: "linogridengine",
- 12302: "rads",
- 12321: "warehouse-sss",
- 12322: "warehouse",
- 12345: "italk",
- 12753: "tsaf",
- 12865: "netperf",
- 13160: "i-zipqd",
- 13216: "bcslogc",
- 13217: "rs-pias",
- 13218: "emc-vcas-tcp",
- 13223: "powwow-client",
- 13224: "powwow-server",
- 13400: "doip-data",
- 13720: "bprd",
- 13721: "bpdbm",
- 13722: "bpjava-msvc",
- 13724: "vnetd",
- 13782: "bpcd",
- 13783: "vopied",
- 13785: "nbdb",
- 13786: "nomdb",
- 13818: "dsmcc-config",
- 13819: "dsmcc-session",
- 13820: "dsmcc-passthru",
- 13821: "dsmcc-download",
- 13822: "dsmcc-ccp",
- 13823: "bmdss",
- 13894: "ucontrol",
- 13929: "dta-systems",
- 13930: "medevolve",
- 14000: "scotty-ft",
- 14001: "sua",
- 14033: "sage-best-com1",
- 14034: "sage-best-com2",
- 14141: "vcs-app",
- 14142: "icpp",
- 14145: "gcm-app",
- 14149: "vrts-tdd",
- 14150: "vcscmd",
- 14154: "vad",
- 14250: "cps",
- 14414: "ca-web-update",
- 14936: "hde-lcesrvr-1",
- 14937: "hde-lcesrvr-2",
- 15000: "hydap",
- 15002: "onep-tls",
- 15345: "xpilot",
- 15363: "3link",
- 15555: "cisco-snat",
- 15660: "bex-xr",
- 15740: "ptp",
- 15999: "programmar",
- 16000: "fmsas",
- 16001: "fmsascon",
- 16002: "gsms",
- 16020: "jwpc",
- 16021: "jwpc-bin",
- 16161: "sun-sea-port",
- 16162: "solaris-audit",
- 16309: "etb4j",
- 16310: "pduncs",
- 16311: "pdefmns",
- 16360: "netserialext1",
- 16361: "netserialext2",
- 16367: "netserialext3",
- 16368: "netserialext4",
- 16384: "connected",
- 16619: "xoms",
- 16900: "newbay-snc-mc",
- 16950: "sgcip",
- 16991: "intel-rci-mp",
- 16992: "amt-soap-http",
- 16993: "amt-soap-https",
- 16994: "amt-redir-tcp",
- 16995: "amt-redir-tls",
- 17007: "isode-dua",
- 17184: "vestasdlp",
- 17185: "soundsvirtual",
- 17219: "chipper",
- 17220: "avtp",
- 17221: "avdecc",
- 17234: "integrius-stp",
- 17235: "ssh-mgmt",
- 17500: "db-lsp",
- 17555: "ailith",
- 17729: "ea",
- 17754: "zep",
- 17755: "zigbee-ip",
- 17756: "zigbee-ips",
- 17777: "sw-orion",
- 18000: "biimenu",
- 18104: "radpdf",
- 18136: "racf",
- 18181: "opsec-cvp",
- 18182: "opsec-ufp",
- 18183: "opsec-sam",
- 18184: "opsec-lea",
- 18185: "opsec-omi",
- 18186: "ohsc",
- 18187: "opsec-ela",
- 18241: "checkpoint-rtm",
- 18242: "iclid",
- 18243: "clusterxl",
- 18262: "gv-pf",
- 18463: "ac-cluster",
- 18634: "rds-ib",
- 18635: "rds-ip",
- 18769: "ique",
- 18881: "infotos",
- 18888: "apc-necmp",
- 19000: "igrid",
- 19007: "scintilla",
- 19020: "j-link",
- 19191: "opsec-uaa",
- 19194: "ua-secureagent",
- 19283: "keysrvr",
- 19315: "keyshadow",
- 19398: "mtrgtrans",
- 19410: "hp-sco",
- 19411: "hp-sca",
- 19412: "hp-sessmon",
- 19539: "fxuptp",
- 19540: "sxuptp",
- 19541: "jcp",
- 19998: "iec-104-sec",
- 19999: "dnp-sec",
- 20000: "dnp",
- 20001: "microsan",
- 20002: "commtact-http",
- 20003: "commtact-https",
- 20005: "openwebnet",
- 20013: "ss-idi",
- 20014: "opendeploy",
- 20034: "nburn-id",
- 20046: "tmophl7mts",
- 20048: "mountd",
- 20049: "nfsrdma",
- 20167: "tolfab",
- 20202: "ipdtp-port",
- 20222: "ipulse-ics",
- 20480: "emwavemsg",
- 20670: "track",
- 20999: "athand-mmp",
- 21000: "irtrans",
- 21010: "notezilla-lan",
- 21553: "rdm-tfs",
- 21554: "dfserver",
- 21590: "vofr-gateway",
- 21800: "tvpm",
- 21845: "webphone",
- 21846: "netspeak-is",
- 21847: "netspeak-cs",
- 21848: "netspeak-acd",
- 21849: "netspeak-cps",
- 22000: "snapenetio",
- 22001: "optocontrol",
- 22002: "optohost002",
- 22003: "optohost003",
- 22004: "optohost004",
- 22005: "optohost004",
- 22125: "dcap",
- 22128: "gsidcap",
- 22222: "easyengine",
- 22273: "wnn6",
- 22305: "cis",
- 22343: "cis-secure",
- 22347: "wibukey",
- 22350: "codemeter",
- 22351: "codemeter-cmwan",
- 22537: "caldsoft-backup",
- 22555: "vocaltec-wconf",
- 22763: "talikaserver",
- 22800: "aws-brf",
- 22951: "brf-gw",
- 23000: "inovaport1",
- 23001: "inovaport2",
- 23002: "inovaport3",
- 23003: "inovaport4",
- 23004: "inovaport5",
- 23005: "inovaport6",
- 23053: "gntp",
- 23333: "elxmgmt",
- 23400: "novar-dbase",
- 23401: "novar-alarm",
- 23402: "novar-global",
- 23456: "aequus",
- 23457: "aequus-alt",
- 23546: "areaguard-neo",
- 24000: "med-ltp",
- 24001: "med-fsp-rx",
- 24002: "med-fsp-tx",
- 24003: "med-supp",
- 24004: "med-ovw",
- 24005: "med-ci",
- 24006: "med-net-svc",
- 24242: "filesphere",
- 24249: "vista-4gl",
- 24321: "ild",
- 24386: "intel-rci",
- 24465: "tonidods",
- 24554: "binkp",
- 24577: "bilobit",
- 24676: "canditv",
- 24677: "flashfiler",
- 24678: "proactivate",
- 24680: "tcc-http",
- 24754: "cslg",
- 24922: "find",
- 25000: "icl-twobase1",
- 25001: "icl-twobase2",
- 25002: "icl-twobase3",
- 25003: "icl-twobase4",
- 25004: "icl-twobase5",
- 25005: "icl-twobase6",
- 25006: "icl-twobase7",
- 25007: "icl-twobase8",
- 25008: "icl-twobase9",
- 25009: "icl-twobase10",
- 25576: "sauterdongle",
- 25604: "idtp",
- 25793: "vocaltec-hos",
- 25900: "tasp-net",
- 25901: "niobserver",
- 25902: "nilinkanalyst",
- 25903: "niprobe",
- 26000: "quake",
- 26133: "scscp",
- 26208: "wnn6-ds",
- 26260: "ezproxy",
- 26261: "ezmeeting",
- 26262: "k3software-svr",
- 26263: "k3software-cli",
- 26486: "exoline-tcp",
- 26487: "exoconfig",
- 26489: "exonet",
- 27345: "imagepump",
- 27442: "jesmsjc",
- 27504: "kopek-httphead",
- 27782: "ars-vista",
- 27876: "astrolink",
- 27999: "tw-auth-key",
- 28000: "nxlmd",
- 28001: "pqsp",
- 28200: "voxelstorm",
- 28240: "siemensgsm",
- 29167: "otmp",
- 29999: "bingbang",
- 30000: "ndmps",
- 30001: "pago-services1",
- 30002: "pago-services2",
- 30003: "amicon-fpsu-ra",
- 30260: "kingdomsonline",
- 30999: "ovobs",
- 31020: "autotrac-acp",
- 31400: "pace-licensed",
- 31416: "xqosd",
- 31457: "tetrinet",
- 31620: "lm-mon",
- 31685: "dsx-monitor",
- 31765: "gamesmith-port",
- 31948: "iceedcp-tx",
- 31949: "iceedcp-rx",
- 32034: "iracinghelper",
- 32249: "t1distproc60",
- 32483: "apm-link",
- 32635: "sec-ntb-clnt",
- 32636: "DMExpress",
- 32767: "filenet-powsrm",
- 32768: "filenet-tms",
- 32769: "filenet-rpc",
- 32770: "filenet-nch",
- 32771: "filenet-rmi",
- 32772: "filenet-pa",
- 32773: "filenet-cm",
- 32774: "filenet-re",
- 32775: "filenet-pch",
- 32776: "filenet-peior",
- 32777: "filenet-obrok",
- 32801: "mlsn",
- 32811: "retp",
- 32896: "idmgratm",
- 33123: "aurora-balaena",
- 33331: "diamondport",
- 33333: "dgi-serv",
- 33334: "speedtrace",
- 33434: "traceroute",
- 33656: "snip-slave",
- 34249: "turbonote-2",
- 34378: "p-net-local",
- 34379: "p-net-remote",
- 34567: "dhanalakshmi",
- 34962: "profinet-rt",
- 34963: "profinet-rtm",
- 34964: "profinet-cm",
- 34980: "ethercat",
- 35000: "heathview",
- 35001: "rt-viewer",
- 35002: "rt-sound",
- 35003: "rt-devicemapper",
- 35004: "rt-classmanager",
- 35005: "rt-labtracker",
- 35006: "rt-helper",
- 35354: "kitim",
- 35355: "altova-lm",
- 35356: "guttersnex",
- 35357: "openstack-id",
- 36001: "allpeers",
- 36524: "febooti-aw",
- 36602: "observium-agent",
- 36865: "kastenxpipe",
- 37475: "neckar",
- 37483: "gdrive-sync",
- 37654: "unisys-eportal",
- 38000: "ivs-database",
- 38001: "ivs-insertion",
- 38201: "galaxy7-data",
- 38202: "fairview",
- 38203: "agpolicy",
- 38800: "sruth",
- 38865: "secrmmsafecopya",
- 39681: "turbonote-1",
- 40000: "safetynetp",
- 40404: "sptx",
- 40841: "cscp",
- 40842: "csccredir",
- 40843: "csccfirewall",
- 41111: "fs-qos",
- 41121: "tentacle",
- 41794: "crestron-cip",
- 41795: "crestron-ctp",
- 41796: "crestron-cips",
- 41797: "crestron-ctps",
- 42508: "candp",
- 42509: "candrp",
- 42510: "caerpc",
- 43000: "recvr-rc",
- 43188: "reachout",
- 43189: "ndm-agent-port",
- 43190: "ip-provision",
- 43191: "noit-transport",
- 43210: "shaperai",
- 43439: "eq3-update",
- 43440: "ew-mgmt",
- 43441: "ciscocsdb",
- 44123: "z-wave-s",
- 44321: "pmcd",
- 44322: "pmcdproxy",
- 44323: "pmwebapi",
- 44444: "cognex-dataman",
- 44553: "rbr-debug",
- 44818: "EtherNet-IP-2",
- 44900: "m3da",
- 45000: "asmp",
- 45001: "asmps",
- 45045: "synctest",
- 45054: "invision-ag",
- 45678: "eba",
- 45824: "dai-shell",
- 45825: "qdb2service",
- 45966: "ssr-servermgr",
- 46998: "spremotetablet",
- 46999: "mediabox",
- 47000: "mbus",
- 47001: "winrm",
- 47557: "dbbrowse",
- 47624: "directplaysrvr",
- 47806: "ap",
- 47808: "bacnet",
- 48000: "nimcontroller",
- 48001: "nimspooler",
- 48002: "nimhub",
- 48003: "nimgtw",
- 48004: "nimbusdb",
- 48005: "nimbusdbctrl",
- 48049: "3gpp-cbsp",
- 48050: "weandsf",
- 48128: "isnetserv",
- 48129: "blp5",
- 48556: "com-bardac-dw",
- 48619: "iqobject",
- 48653: "robotraconteur",
- 49000: "matahari"}
-
-IANA_PORTS_UDP = {
- 1: "tcpmux",
- 2: "compressnet",
- 3: "compressnet",
- 5: "rje",
- 7: "echo",
- 9: "discard",
- 11: "systat",
- 13: "daytime",
- 17: "qotd",
- 18: "msp",
- 19: "chargen",
- 20: "ftp-data",
- 21: "ftp",
- 22: "ssh",
- 23: "telnet",
- 25: "smtp",
- 27: "nsw-fe",
- 29: "msg-icp",
- 31: "msg-auth",
- 33: "dsp",
- 37: "time",
- 38: "rap",
- 39: "rlp",
- 41: "graphics",
- 42: "name",
- 43: "nicname",
- 44: "mpm-flags",
- 45: "mpm",
- 46: "mpm-snd",
- 47: "ni-ftp",
- 48: "auditd",
- 49: "tacacs",
- 50: "re-mail-ck",
- 52: "xns-time",
- 53: "domain",
- 54: "xns-ch",
- 55: "isi-gl",
- 56: "xns-auth",
- 58: "xns-mail",
- 61: "ni-mail",
- 62: "acas",
- 63: "whoispp",
- 64: "covia",
- 65: "tacacs-ds",
- 66: "sql-net",
- 67: "bootps",
- 68: "bootpc",
- 69: "tftp",
- 70: "gopher",
- 71: "netrjs-1",
- 72: "netrjs-2",
- 73: "netrjs-3",
- 74: "netrjs-4",
- 76: "deos",
- 78: "vettcp",
- 79: "finger",
- 80: "http",
- 82: "xfer",
- 83: "mit-ml-dev",
- 84: "ctf",
- 85: "mit-ml-dev",
- 86: "mfcobol",
- 88: "kerberos",
- 89: "su-mit-tg",
- 90: "dnsix",
- 91: "mit-dov",
- 92: "npp",
- 93: "dcp",
- 94: "objcall",
- 95: "supdup",
- 96: "dixie",
- 97: "swift-rvf",
- 98: "tacnews",
- 99: "metagram",
- 101: "hostname",
- 102: "iso-tsap",
- 103: "gppitnp",
- 104: "acr-nema",
- 105: "cso",
- 106: "3com-tsmux",
- 107: "rtelnet",
- 108: "snagas",
- 109: "pop2",
- 110: "pop3",
- 111: "sunrpc",
- 112: "mcidas",
- 113: "auth",
- 115: "sftp",
- 116: "ansanotify",
- 117: "uucp-path",
- 118: "sqlserv",
- 119: "nntp",
- 120: "cfdptkt",
- 121: "erpc",
- 122: "smakynet",
- 123: "ntp",
- 124: "ansatrader",
- 125: "locus-map",
- 126: "nxedit",
- 127: "locus-con",
- 128: "gss-xlicen",
- 129: "pwdgen",
- 130: "cisco-fna",
- 131: "cisco-tna",
- 132: "cisco-sys",
- 133: "statsrv",
- 134: "ingres-net",
- 135: "epmap",
- 136: "profile",
- 137: "netbios-ns",
- 138: "netbios-dgm",
- 139: "netbios-ssn",
- 140: "emfis-data",
- 141: "emfis-cntl",
- 142: "bl-idm",
- 143: "imap",
- 144: "uma",
- 145: "uaac",
- 146: "iso-tp0",
- 147: "iso-ip",
- 148: "jargon",
- 149: "aed-512",
- 150: "sql-net",
- 151: "hems",
- 152: "bftp",
- 153: "sgmp",
- 154: "netsc-prod",
- 155: "netsc-dev",
- 156: "sqlsrv",
- 157: "knet-cmp",
- 158: "pcmail-srv",
- 159: "nss-routing",
- 160: "sgmp-traps",
- 161: "snmp",
- 162: "snmptrap",
- 163: "cmip-man",
- 164: "cmip-agent",
- 165: "xns-courier",
- 166: "s-net",
- 167: "namp",
- 168: "rsvd",
- 169: "send",
- 170: "print-srv",
- 171: "multiplex",
- 172: "cl-1",
- 173: "xyplex-mux",
- 174: "mailq",
- 175: "vmnet",
- 176: "genrad-mux",
- 177: "xdmcp",
- 178: "nextstep",
- 179: "bgp",
- 180: "ris",
- 181: "unify",
- 182: "audit",
- 183: "ocbinder",
- 184: "ocserver",
- 185: "remote-kis",
- 186: "kis",
- 187: "aci",
- 188: "mumps",
- 189: "qft",
- 190: "gacp",
- 191: "prospero",
- 192: "osu-nms",
- 193: "srmp",
- 194: "irc",
- 195: "dn6-nlm-aud",
- 196: "dn6-smm-red",
- 197: "dls",
- 198: "dls-mon",
- 199: "smux",
- 200: "src",
- 201: "at-rtmp",
- 202: "at-nbp",
- 203: "at-3",
- 204: "at-echo",
- 205: "at-5",
- 206: "at-zis",
- 207: "at-7",
- 208: "at-8",
- 209: "qmtp",
- 210: "z39-50",
- 211: "914c-g",
- 212: "anet",
- 213: "ipx",
- 214: "vmpwscs",
- 215: "softpc",
- 216: "CAIlic",
- 217: "dbase",
- 218: "mpp",
- 219: "uarps",
- 220: "imap3",
- 221: "fln-spx",
- 222: "rsh-spx",
- 223: "cdc",
- 224: "masqdialer",
- 242: "direct",
- 243: "sur-meas",
- 244: "inbusiness",
- 245: "link",
- 246: "dsp3270",
- 247: "subntbcst-tftp",
- 248: "bhfhs",
- 256: "rap",
- 257: "set",
- 259: "esro-gen",
- 260: "openport",
- 261: "nsiiops",
- 262: "arcisdms",
- 263: "hdap",
- 264: "bgmp",
- 265: "x-bone-ctl",
- 266: "sst",
- 267: "td-service",
- 268: "td-replica",
- 269: "manet",
- 270: "gist",
- 280: "http-mgmt",
- 281: "personal-link",
- 282: "cableport-ax",
- 283: "rescap",
- 284: "corerjd",
- 286: "fxp",
- 287: "k-block",
- 308: "novastorbakcup",
- 309: "entrusttime",
- 310: "bhmds",
- 311: "asip-webadmin",
- 312: "vslmp",
- 313: "magenta-logic",
- 314: "opalis-robot",
- 315: "dpsi",
- 316: "decauth",
- 317: "zannet",
- 318: "pkix-timestamp",
- 319: "ptp-event",
- 320: "ptp-general",
- 321: "pip",
- 322: "rtsps",
- 333: "texar",
- 344: "pdap",
- 345: "pawserv",
- 346: "zserv",
- 347: "fatserv",
- 348: "csi-sgwp",
- 349: "mftp",
- 350: "matip-type-a",
- 351: "matip-type-b",
- 352: "dtag-ste-sb",
- 353: "ndsauth",
- 354: "bh611",
- 355: "datex-asn",
- 356: "cloanto-net-1",
- 357: "bhevent",
- 358: "shrinkwrap",
- 359: "nsrmp",
- 360: "scoi2odialog",
- 361: "semantix",
- 362: "srssend",
- 363: "rsvp-tunnel",
- 364: "aurora-cmgr",
- 365: "dtk",
- 366: "odmr",
- 367: "mortgageware",
- 368: "qbikgdp",
- 369: "rpc2portmap",
- 370: "codaauth2",
- 371: "clearcase",
- 372: "ulistproc",
- 373: "legent-1",
- 374: "legent-2",
- 375: "hassle",
- 376: "nip",
- 377: "tnETOS",
- 378: "dsETOS",
- 379: "is99c",
- 380: "is99s",
- 381: "hp-collector",
- 382: "hp-managed-node",
- 383: "hp-alarm-mgr",
- 384: "arns",
- 385: "ibm-app",
- 386: "asa",
- 387: "aurp",
- 388: "unidata-ldm",
- 389: "ldap",
- 390: "uis",
- 391: "synotics-relay",
- 392: "synotics-broker",
- 393: "meta5",
- 394: "embl-ndt",
- 395: "netcp",
- 396: "netware-ip",
- 397: "mptn",
- 398: "kryptolan",
- 399: "iso-tsap-c2",
- 400: "osb-sd",
- 401: "ups",
- 402: "genie",
- 403: "decap",
- 404: "nced",
- 405: "ncld",
- 406: "imsp",
- 407: "timbuktu",
- 408: "prm-sm",
- 409: "prm-nm",
- 410: "decladebug",
- 411: "rmt",
- 412: "synoptics-trap",
- 413: "smsp",
- 414: "infoseek",
- 415: "bnet",
- 416: "silverplatter",
- 417: "onmux",
- 418: "hyper-g",
- 419: "ariel1",
- 420: "smpte",
- 421: "ariel2",
- 422: "ariel3",
- 423: "opc-job-start",
- 424: "opc-job-track",
- 425: "icad-el",
- 426: "smartsdp",
- 427: "svrloc",
- 428: "ocs-cmu",
- 429: "ocs-amu",
- 430: "utmpsd",
- 431: "utmpcd",
- 432: "iasd",
- 433: "nnsp",
- 434: "mobileip-agent",
- 435: "mobilip-mn",
- 436: "dna-cml",
- 437: "comscm",
- 438: "dsfgw",
- 439: "dasp",
- 440: "sgcp",
- 441: "decvms-sysmgt",
- 442: "cvc-hostd",
- 443: "https",
- 444: "snpp",
- 445: "microsoft-ds",
- 446: "ddm-rdb",
- 447: "ddm-dfm",
- 448: "ddm-ssl",
- 449: "as-servermap",
- 450: "tserver",
- 451: "sfs-smp-net",
- 452: "sfs-config",
- 453: "creativeserver",
- 454: "contentserver",
- 455: "creativepartnr",
- 456: "macon-udp",
- 457: "scohelp",
- 458: "appleqtc",
- 459: "ampr-rcmd",
- 460: "skronk",
- 461: "datasurfsrv",
- 462: "datasurfsrvsec",
- 463: "alpes",
- 464: "kpasswd",
- 465: "igmpv3lite",
- 466: "digital-vrc",
- 467: "mylex-mapd",
- 468: "photuris",
- 469: "rcp",
- 470: "scx-proxy",
- 471: "mondex",
- 472: "ljk-login",
- 473: "hybrid-pop",
- 474: "tn-tl-w2",
- 475: "tcpnethaspsrv",
- 476: "tn-tl-fd1",
- 477: "ss7ns",
- 478: "spsc",
- 479: "iafserver",
- 480: "iafdbase",
- 481: "ph",
- 482: "bgs-nsi",
- 483: "ulpnet",
- 484: "integra-sme",
- 485: "powerburst",
- 486: "avian",
- 487: "saft",
- 488: "gss-http",
- 489: "nest-protocol",
- 490: "micom-pfs",
- 491: "go-login",
- 492: "ticf-1",
- 493: "ticf-2",
- 494: "pov-ray",
- 495: "intecourier",
- 496: "pim-rp-disc",
- 497: "retrospect",
- 498: "siam",
- 499: "iso-ill",
- 500: "isakmp",
- 501: "stmf",
- 502: "mbap",
- 503: "intrinsa",
- 504: "citadel",
- 505: "mailbox-lm",
- 506: "ohimsrv",
- 507: "crs",
- 508: "xvttp",
- 509: "snare",
- 510: "fcp",
- 511: "passgo",
- 512: "comsat",
- 513: "who",
- 514: "syslog",
- 515: "printer",
- 516: "videotex",
- 517: "talk",
- 518: "ntalk",
- 519: "utime",
- 520: "router",
- 521: "ripng",
- 522: "ulp",
- 523: "ibm-db2",
- 524: "ncp",
- 525: "timed",
- 526: "tempo",
- 527: "stx",
- 528: "custix",
- 529: "irc-serv",
- 530: "courier",
- 531: "conference",
- 532: "netnews",
- 533: "netwall",
- 534: "windream",
- 535: "iiop",
- 536: "opalis-rdv",
- 537: "nmsp",
- 538: "gdomap",
- 539: "apertus-ldp",
- 540: "uucp",
- 541: "uucp-rlogin",
- 542: "commerce",
- 543: "klogin",
- 544: "kshell",
- 545: "appleqtcsrvr",
- 546: "dhcpv6-client",
- 547: "dhcpv6-server",
- 548: "afpovertcp",
- 549: "idfp",
- 550: "new-rwho",
- 551: "cybercash",
- 552: "devshr-nts",
- 553: "pirp",
- 554: "rtsp",
- 555: "dsf",
- 556: "remotefs",
- 557: "openvms-sysipc",
- 558: "sdnskmp",
- 559: "teedtap",
- 560: "rmonitor",
- 561: "monitor",
- 562: "chshell",
- 563: "nntps",
- 564: "9pfs",
- 565: "whoami",
- 566: "streettalk",
- 567: "banyan-rpc",
- 568: "ms-shuttle",
- 569: "ms-rome",
- 570: "meter",
- 571: "meter",
- 572: "sonar",
- 573: "banyan-vip",
- 574: "ftp-agent",
- 575: "vemmi",
- 576: "ipcd",
- 577: "vnas",
- 578: "ipdd",
- 579: "decbsrv",
- 580: "sntp-heartbeat",
- 581: "bdp",
- 582: "scc-security",
- 583: "philips-vc",
- 584: "keyserver",
- 586: "password-chg",
- 587: "submission",
- 588: "cal",
- 589: "eyelink",
- 590: "tns-cml",
- 591: "http-alt",
- 592: "eudora-set",
- 593: "http-rpc-epmap",
- 594: "tpip",
- 595: "cab-protocol",
- 596: "smsd",
- 597: "ptcnameservice",
- 598: "sco-websrvrmg3",
- 599: "acp",
- 600: "ipcserver",
- 601: "syslog-conn",
- 602: "xmlrpc-beep",
- 603: "idxp",
- 604: "tunnel",
- 605: "soap-beep",
- 606: "urm",
- 607: "nqs",
- 608: "sift-uft",
- 609: "npmp-trap",
- 610: "npmp-local",
- 611: "npmp-gui",
- 612: "hmmp-ind",
- 613: "hmmp-op",
- 614: "sshell",
- 615: "sco-inetmgr",
- 616: "sco-sysmgr",
- 617: "sco-dtmgr",
- 618: "dei-icda",
- 619: "compaq-evm",
- 620: "sco-websrvrmgr",
- 621: "escp-ip",
- 622: "collaborator",
- 623: "asf-rmcp",
- 624: "cryptoadmin",
- 625: "dec-dlm",
- 626: "asia",
- 627: "passgo-tivoli",
- 628: "qmqp",
- 629: "3com-amp3",
- 630: "rda",
- 631: "ipp",
- 632: "bmpp",
- 633: "servstat",
- 634: "ginad",
- 635: "rlzdbase",
- 636: "ldaps",
- 637: "lanserver",
- 638: "mcns-sec",
- 639: "msdp",
- 640: "entrust-sps",
- 641: "repcmd",
- 642: "esro-emsdp",
- 643: "sanity",
- 644: "dwr",
- 645: "pssc",
- 646: "ldp",
- 647: "dhcp-failover",
- 648: "rrp",
- 649: "cadview-3d",
- 650: "obex",
- 651: "ieee-mms",
- 652: "hello-port",
- 653: "repscmd",
- 654: "aodv",
- 655: "tinc",
- 656: "spmp",
- 657: "rmc",
- 658: "tenfold",
- 660: "mac-srvr-admin",
- 661: "hap",
- 662: "pftp",
- 663: "purenoise",
- 664: "asf-secure-rmcp",
- 665: "sun-dr",
- 666: "mdqs",
- 667: "disclose",
- 668: "mecomm",
- 669: "meregister",
- 670: "vacdsm-sws",
- 671: "vacdsm-app",
- 672: "vpps-qua",
- 673: "cimplex",
- 674: "acap",
- 675: "dctp",
- 676: "vpps-via",
- 677: "vpp",
- 678: "ggf-ncp",
- 679: "mrm",
- 680: "entrust-aaas",
- 681: "entrust-aams",
- 682: "xfr",
- 683: "corba-iiop",
- 684: "corba-iiop-ssl",
- 685: "mdc-portmapper",
- 686: "hcp-wismar",
- 687: "asipregistry",
- 688: "realm-rusd",
- 689: "nmap",
- 690: "vatp",
- 691: "msexch-routing",
- 692: "hyperwave-isp",
- 693: "connendp",
- 694: "ha-cluster",
- 695: "ieee-mms-ssl",
- 696: "rushd",
- 697: "uuidgen",
- 698: "olsr",
- 699: "accessnetwork",
- 700: "epp",
- 701: "lmp",
- 702: "iris-beep",
- 704: "elcsd",
- 705: "agentx",
- 706: "silc",
- 707: "borland-dsj",
- 709: "entrust-kmsh",
- 710: "entrust-ash",
- 711: "cisco-tdp",
- 712: "tbrpf",
- 713: "iris-xpc",
- 714: "iris-xpcs",
- 715: "iris-lwz",
- 716: "pana",
- 729: "netviewdm1",
- 730: "netviewdm2",
- 731: "netviewdm3",
- 741: "netgw",
- 742: "netrcs",
- 744: "flexlm",
- 747: "fujitsu-dev",
- 748: "ris-cm",
- 749: "kerberos-adm",
- 750: "loadav",
- 751: "pump",
- 752: "qrh",
- 753: "rrh",
- 754: "tell",
- 758: "nlogin",
- 759: "con",
- 760: "ns",
- 761: "rxe",
- 762: "quotad",
- 763: "cycleserv",
- 764: "omserv",
- 765: "webster",
- 767: "phonebook",
- 769: "vid",
- 770: "cadlock",
- 771: "rtip",
- 772: "cycleserv2",
- 773: "notify",
- 774: "acmaint-dbd",
- 775: "acmaint-transd",
- 776: "wpages",
- 777: "multiling-http",
- 780: "wpgs",
- 800: "mdbs-daemon",
- 801: "device",
- 802: "mbap-s",
- 810: "fcp-udp",
- 828: "itm-mcell-s",
- 829: "pkix-3-ca-ra",
- 830: "netconf-ssh",
- 831: "netconf-beep",
- 832: "netconfsoaphttp",
- 833: "netconfsoapbeep",
- 847: "dhcp-failover2",
- 848: "gdoi",
- 860: "iscsi",
- 861: "owamp-control",
- 862: "twamp-control",
- 873: "rsync",
- 886: "iclcnet-locate",
- 887: "iclcnet-svinfo",
- 888: "accessbuilder",
- 900: "omginitialrefs",
- 901: "smpnameres",
- 902: "ideafarm-door",
- 903: "ideafarm-panic",
- 910: "kink",
- 911: "xact-backup",
- 912: "apex-mesh",
- 913: "apex-edge",
- 989: "ftps-data",
- 990: "ftps",
- 991: "nas",
- 992: "telnets",
- 993: "imaps",
- 995: "pop3s",
- 996: "vsinet",
- 997: "maitrd",
- 998: "puparp",
- 999: "applix",
- 1000: "cadlock2",
- 1010: "surf",
- 1021: "exp1",
- 1022: "exp2",
- 1025: "blackjack",
- 1026: "cap",
- 1027: "6a44",
- 1029: "solid-mux",
- 1033: "netinfo-local",
- 1034: "activesync",
- 1035: "mxxrlogin",
- 1036: "nsstp",
- 1037: "ams",
- 1038: "mtqp",
- 1039: "sbl",
- 1040: "netarx",
- 1041: "danf-ak2",
- 1042: "afrog",
- 1043: "boinc-client",
- 1044: "dcutility",
- 1045: "fpitp",
- 1046: "wfremotertm",
- 1047: "neod1",
- 1048: "neod2",
- 1049: "td-postman",
- 1050: "cma",
- 1051: "optima-vnet",
- 1052: "ddt",
- 1053: "remote-as",
- 1054: "brvread",
- 1055: "ansyslmd",
- 1056: "vfo",
- 1057: "startron",
- 1058: "nim",
- 1059: "nimreg",
- 1060: "polestar",
- 1061: "kiosk",
- 1062: "veracity",
- 1063: "kyoceranetdev",
- 1064: "jstel",
- 1065: "syscomlan",
- 1066: "fpo-fns",
- 1067: "instl-boots",
- 1068: "instl-bootc",
- 1069: "cognex-insight",
- 1070: "gmrupdateserv",
- 1071: "bsquare-voip",
- 1072: "cardax",
- 1073: "bridgecontrol",
- 1074: "warmspotMgmt",
- 1075: "rdrmshc",
- 1076: "dab-sti-c",
- 1077: "imgames",
- 1078: "avocent-proxy",
- 1079: "asprovatalk",
- 1080: "socks",
- 1081: "pvuniwien",
- 1082: "amt-esd-prot",
- 1083: "ansoft-lm-1",
- 1084: "ansoft-lm-2",
- 1085: "webobjects",
- 1086: "cplscrambler-lg",
- 1087: "cplscrambler-in",
- 1088: "cplscrambler-al",
- 1089: "ff-annunc",
- 1090: "ff-fms",
- 1091: "ff-sm",
- 1092: "obrpd",
- 1093: "proofd",
- 1094: "rootd",
- 1095: "nicelink",
- 1096: "cnrprotocol",
- 1097: "sunclustermgr",
- 1098: "rmiactivation",
- 1099: "rmiregistry",
- 1100: "mctp",
- 1101: "pt2-discover",
- 1102: "adobeserver-1",
- 1103: "adobeserver-2",
- 1104: "xrl",
- 1105: "ftranhc",
- 1106: "isoipsigport-1",
- 1107: "isoipsigport-2",
- 1108: "ratio-adp",
- 1110: "nfsd-keepalive",
- 1111: "lmsocialserver",
- 1112: "icp",
- 1113: "ltp-deepspace",
- 1114: "mini-sql",
- 1115: "ardus-trns",
- 1116: "ardus-cntl",
- 1117: "ardus-mtrns",
- 1118: "sacred",
- 1119: "bnetgame",
- 1120: "bnetfile",
- 1121: "rmpp",
- 1122: "availant-mgr",
- 1123: "murray",
- 1124: "hpvmmcontrol",
- 1125: "hpvmmagent",
- 1126: "hpvmmdata",
- 1127: "kwdb-commn",
- 1128: "saphostctrl",
- 1129: "saphostctrls",
- 1130: "casp",
- 1131: "caspssl",
- 1132: "kvm-via-ip",
- 1133: "dfn",
- 1134: "aplx",
- 1135: "omnivision",
- 1136: "hhb-gateway",
- 1137: "trim",
- 1138: "encrypted-admin",
- 1139: "evm",
- 1140: "autonoc",
- 1141: "mxomss",
- 1142: "edtools",
- 1143: "imyx",
- 1144: "fuscript",
- 1145: "x9-icue",
- 1146: "audit-transfer",
- 1147: "capioverlan",
- 1148: "elfiq-repl",
- 1149: "bvtsonar",
- 1150: "blaze",
- 1151: "unizensus",
- 1152: "winpoplanmess",
- 1153: "c1222-acse",
- 1154: "resacommunity",
- 1155: "nfa",
- 1156: "iascontrol-oms",
- 1157: "iascontrol",
- 1158: "dbcontrol-oms",
- 1159: "oracle-oms",
- 1160: "olsv",
- 1161: "health-polling",
- 1162: "health-trap",
- 1163: "sddp",
- 1164: "qsm-proxy",
- 1165: "qsm-gui",
- 1166: "qsm-remote",
- 1167: "cisco-ipsla",
- 1168: "vchat",
- 1169: "tripwire",
- 1170: "atc-lm",
- 1171: "atc-appserver",
- 1172: "dnap",
- 1173: "d-cinema-rrp",
- 1174: "fnet-remote-ui",
- 1175: "dossier",
- 1176: "indigo-server",
- 1177: "dkmessenger",
- 1178: "sgi-storman",
- 1179: "b2n",
- 1180: "mc-client",
- 1181: "3comnetman",
- 1182: "accelenet-data",
- 1183: "llsurfup-http",
- 1184: "llsurfup-https",
- 1185: "catchpole",
- 1186: "mysql-cluster",
- 1187: "alias",
- 1188: "hp-webadmin",
- 1189: "unet",
- 1190: "commlinx-avl",
- 1191: "gpfs",
- 1192: "caids-sensor",
- 1193: "fiveacross",
- 1194: "openvpn",
- 1195: "rsf-1",
- 1196: "netmagic",
- 1197: "carrius-rshell",
- 1198: "cajo-discovery",
- 1199: "dmidi",
- 1200: "scol",
- 1201: "nucleus-sand",
- 1202: "caiccipc",
- 1203: "ssslic-mgr",
- 1204: "ssslog-mgr",
- 1205: "accord-mgc",
- 1206: "anthony-data",
- 1207: "metasage",
- 1208: "seagull-ais",
- 1209: "ipcd3",
- 1210: "eoss",
- 1211: "groove-dpp",
- 1212: "lupa",
- 1213: "mpc-lifenet",
- 1214: "kazaa",
- 1215: "scanstat-1",
- 1216: "etebac5",
- 1217: "hpss-ndapi",
- 1218: "aeroflight-ads",
- 1219: "aeroflight-ret",
- 1220: "qt-serveradmin",
- 1221: "sweetware-apps",
- 1222: "nerv",
- 1223: "tgp",
- 1224: "vpnz",
- 1225: "slinkysearch",
- 1226: "stgxfws",
- 1227: "dns2go",
- 1228: "florence",
- 1229: "zented",
- 1230: "periscope",
- 1231: "menandmice-lpm",
- 1232: "first-defense",
- 1233: "univ-appserver",
- 1234: "search-agent",
- 1235: "mosaicsyssvc1",
- 1236: "bvcontrol",
- 1237: "tsdos390",
- 1238: "hacl-qs",
- 1239: "nmsd",
- 1240: "instantia",
- 1241: "nessus",
- 1242: "nmasoverip",
- 1243: "serialgateway",
- 1244: "isbconference1",
- 1245: "isbconference2",
- 1246: "payrouter",
- 1247: "visionpyramid",
- 1248: "hermes",
- 1249: "mesavistaco",
- 1250: "swldy-sias",
- 1251: "servergraph",
- 1252: "bspne-pcc",
- 1253: "q55-pcc",
- 1254: "de-noc",
- 1255: "de-cache-query",
- 1256: "de-server",
- 1257: "shockwave2",
- 1258: "opennl",
- 1259: "opennl-voice",
- 1260: "ibm-ssd",
- 1261: "mpshrsv",
- 1262: "qnts-orb",
- 1263: "dka",
- 1264: "prat",
- 1265: "dssiapi",
- 1266: "dellpwrappks",
- 1267: "epc",
- 1268: "propel-msgsys",
- 1269: "watilapp",
- 1270: "opsmgr",
- 1271: "excw",
- 1272: "cspmlockmgr",
- 1273: "emc-gateway",
- 1274: "t1distproc",
- 1275: "ivcollector",
- 1277: "miva-mqs",
- 1278: "dellwebadmin-1",
- 1279: "dellwebadmin-2",
- 1280: "pictrography",
- 1281: "healthd",
- 1282: "emperion",
- 1283: "productinfo",
- 1284: "iee-qfx",
- 1285: "neoiface",
- 1286: "netuitive",
- 1287: "routematch",
- 1288: "navbuddy",
- 1289: "jwalkserver",
- 1290: "winjaserver",
- 1291: "seagulllms",
- 1292: "dsdn",
- 1293: "pkt-krb-ipsec",
- 1294: "cmmdriver",
- 1295: "ehtp",
- 1296: "dproxy",
- 1297: "sdproxy",
- 1298: "lpcp",
- 1299: "hp-sci",
- 1300: "h323hostcallsc",
- 1301: "ci3-software-1",
- 1302: "ci3-software-2",
- 1303: "sftsrv",
- 1304: "boomerang",
- 1305: "pe-mike",
- 1306: "re-conn-proto",
- 1307: "pacmand",
- 1308: "odsi",
- 1309: "jtag-server",
- 1310: "husky",
- 1311: "rxmon",
- 1312: "sti-envision",
- 1313: "bmc-patroldb",
- 1314: "pdps",
- 1315: "els",
- 1316: "exbit-escp",
- 1317: "vrts-ipcserver",
- 1318: "krb5gatekeeper",
- 1319: "amx-icsp",
- 1320: "amx-axbnet",
- 1321: "pip",
- 1322: "novation",
- 1323: "brcd",
- 1324: "delta-mcp",
- 1325: "dx-instrument",
- 1326: "wimsic",
- 1327: "ultrex",
- 1328: "ewall",
- 1329: "netdb-export",
- 1330: "streetperfect",
- 1331: "intersan",
- 1332: "pcia-rxp-b",
- 1333: "passwrd-policy",
- 1334: "writesrv",
- 1335: "digital-notary",
- 1336: "ischat",
- 1337: "menandmice-dns",
- 1338: "wmc-log-svc",
- 1339: "kjtsiteserver",
- 1340: "naap",
- 1341: "qubes",
- 1342: "esbroker",
- 1343: "re101",
- 1344: "icap",
- 1345: "vpjp",
- 1346: "alta-ana-lm",
- 1347: "bbn-mmc",
- 1348: "bbn-mmx",
- 1349: "sbook",
- 1350: "editbench",
- 1351: "equationbuilder",
- 1352: "lotusnote",
- 1353: "relief",
- 1354: "XSIP-network",
- 1355: "intuitive-edge",
- 1356: "cuillamartin",
- 1357: "pegboard",
- 1358: "connlcli",
- 1359: "ftsrv",
- 1360: "mimer",
- 1361: "linx",
- 1362: "timeflies",
- 1363: "ndm-requester",
- 1364: "ndm-server",
- 1365: "adapt-sna",
- 1366: "netware-csp",
- 1367: "dcs",
- 1368: "screencast",
- 1369: "gv-us",
- 1370: "us-gv",
- 1371: "fc-cli",
- 1372: "fc-ser",
- 1373: "chromagrafx",
- 1374: "molly",
- 1375: "bytex",
- 1376: "ibm-pps",
- 1377: "cichlid",
- 1378: "elan",
- 1379: "dbreporter",
- 1380: "telesis-licman",
- 1381: "apple-licman",
- 1382: "udt-os",
- 1383: "gwha",
- 1384: "os-licman",
- 1385: "atex-elmd",
- 1386: "checksum",
- 1387: "cadsi-lm",
- 1388: "objective-dbc",
- 1389: "iclpv-dm",
- 1390: "iclpv-sc",
- 1391: "iclpv-sas",
- 1392: "iclpv-pm",
- 1393: "iclpv-nls",
- 1394: "iclpv-nlc",
- 1395: "iclpv-wsm",
- 1396: "dvl-activemail",
- 1397: "audio-activmail",
- 1398: "video-activmail",
- 1399: "cadkey-licman",
- 1400: "cadkey-tablet",
- 1401: "goldleaf-licman",
- 1402: "prm-sm-np",
- 1403: "prm-nm-np",
- 1404: "igi-lm",
- 1405: "ibm-res",
- 1406: "netlabs-lm",
- 1407: "dbsa-lm",
- 1408: "sophia-lm",
- 1409: "here-lm",
- 1410: "hiq",
- 1411: "af",
- 1412: "innosys",
- 1413: "innosys-acl",
- 1414: "ibm-mqseries",
- 1415: "dbstar",
- 1416: "novell-lu6-2",
- 1417: "timbuktu-srv1",
- 1418: "timbuktu-srv2",
- 1419: "timbuktu-srv3",
- 1420: "timbuktu-srv4",
- 1421: "gandalf-lm",
- 1422: "autodesk-lm",
- 1423: "essbase",
- 1424: "hybrid",
- 1425: "zion-lm",
- 1426: "sais",
- 1427: "mloadd",
- 1428: "informatik-lm",
- 1429: "nms",
- 1430: "tpdu",
- 1431: "rgtp",
- 1432: "blueberry-lm",
- 1433: "ms-sql-s",
- 1434: "ms-sql-m",
- 1435: "ibm-cics",
- 1436: "saism",
- 1437: "tabula",
- 1438: "eicon-server",
- 1439: "eicon-x25",
- 1440: "eicon-slp",
- 1441: "cadis-1",
- 1442: "cadis-2",
- 1443: "ies-lm",
- 1444: "marcam-lm",
- 1445: "proxima-lm",
- 1446: "ora-lm",
- 1447: "apri-lm",
- 1448: "oc-lm",
- 1449: "peport",
- 1450: "dwf",
- 1451: "infoman",
- 1452: "gtegsc-lm",
- 1453: "genie-lm",
- 1454: "interhdl-elmd",
- 1455: "esl-lm",
- 1456: "dca",
- 1457: "valisys-lm",
- 1458: "nrcabq-lm",
- 1459: "proshare1",
- 1460: "proshare2",
- 1461: "ibm-wrless-lan",
- 1462: "world-lm",
- 1463: "nucleus",
- 1464: "msl-lmd",
- 1465: "pipes",
- 1466: "oceansoft-lm",
- 1467: "csdmbase",
- 1468: "csdm",
- 1469: "aal-lm",
- 1470: "uaiact",
- 1471: "csdmbase",
- 1472: "csdm",
- 1473: "openmath",
- 1474: "telefinder",
- 1475: "taligent-lm",
- 1476: "clvm-cfg",
- 1477: "ms-sna-server",
- 1478: "ms-sna-base",
- 1479: "dberegister",
- 1480: "pacerforum",
- 1481: "airs",
- 1482: "miteksys-lm",
- 1483: "afs",
- 1484: "confluent",
- 1485: "lansource",
- 1486: "nms-topo-serv",
- 1487: "localinfosrvr",
- 1488: "docstor",
- 1489: "dmdocbroker",
- 1490: "insitu-conf",
- 1492: "stone-design-1",
- 1493: "netmap-lm",
- 1494: "ica",
- 1495: "cvc",
- 1496: "liberty-lm",
- 1497: "rfx-lm",
- 1498: "sybase-sqlany",
- 1499: "fhc",
- 1500: "vlsi-lm",
- 1501: "saiscm",
- 1502: "shivadiscovery",
- 1503: "imtc-mcs",
- 1504: "evb-elm",
- 1505: "funkproxy",
- 1506: "utcd",
- 1507: "symplex",
- 1508: "diagmond",
- 1509: "robcad-lm",
- 1510: "mvx-lm",
- 1511: "3l-l1",
- 1512: "wins",
- 1513: "fujitsu-dtc",
- 1514: "fujitsu-dtcns",
- 1515: "ifor-protocol",
- 1516: "vpad",
- 1517: "vpac",
- 1518: "vpvd",
- 1519: "vpvc",
- 1520: "atm-zip-office",
- 1521: "ncube-lm",
- 1522: "ricardo-lm",
- 1523: "cichild-lm",
- 1524: "ingreslock",
- 1525: "orasrv",
- 1526: "pdap-np",
- 1527: "tlisrv",
- 1529: "coauthor",
- 1530: "rap-service",
- 1531: "rap-listen",
- 1532: "miroconnect",
- 1533: "virtual-places",
- 1534: "micromuse-lm",
- 1535: "ampr-info",
- 1536: "ampr-inter",
- 1537: "sdsc-lm",
- 1538: "3ds-lm",
- 1539: "intellistor-lm",
- 1540: "rds",
- 1541: "rds2",
- 1542: "gridgen-elmd",
- 1543: "simba-cs",
- 1544: "aspeclmd",
- 1545: "vistium-share",
- 1546: "abbaccuray",
- 1547: "laplink",
- 1548: "axon-lm",
- 1549: "shivasound",
- 1550: "3m-image-lm",
- 1551: "hecmtl-db",
- 1552: "pciarray",
- 1553: "sna-cs",
- 1554: "caci-lm",
- 1555: "livelan",
- 1556: "veritas-pbx",
- 1557: "arbortext-lm",
- 1558: "xingmpeg",
- 1559: "web2host",
- 1560: "asci-val",
- 1561: "facilityview",
- 1562: "pconnectmgr",
- 1563: "cadabra-lm",
- 1564: "pay-per-view",
- 1565: "winddlb",
- 1566: "corelvideo",
- 1567: "jlicelmd",
- 1568: "tsspmap",
- 1569: "ets",
- 1570: "orbixd",
- 1571: "rdb-dbs-disp",
- 1572: "chip-lm",
- 1573: "itscomm-ns",
- 1574: "mvel-lm",
- 1575: "oraclenames",
- 1576: "moldflow-lm",
- 1577: "hypercube-lm",
- 1578: "jacobus-lm",
- 1579: "ioc-sea-lm",
- 1580: "tn-tl-r2",
- 1581: "mil-2045-47001",
- 1582: "msims",
- 1583: "simbaexpress",
- 1584: "tn-tl-fd2",
- 1585: "intv",
- 1586: "ibm-abtact",
- 1587: "pra-elmd",
- 1588: "triquest-lm",
- 1589: "vqp",
- 1590: "gemini-lm",
- 1591: "ncpm-pm",
- 1592: "commonspace",
- 1593: "mainsoft-lm",
- 1594: "sixtrak",
- 1595: "radio",
- 1596: "radio-bc",
- 1597: "orbplus-iiop",
- 1598: "picknfs",
- 1599: "simbaservices",
- 1600: "issd",
- 1601: "aas",
- 1602: "inspect",
- 1603: "picodbc",
- 1604: "icabrowser",
- 1605: "slp",
- 1606: "slm-api",
- 1607: "stt",
- 1608: "smart-lm",
- 1609: "isysg-lm",
- 1610: "taurus-wh",
- 1611: "ill",
- 1612: "netbill-trans",
- 1613: "netbill-keyrep",
- 1614: "netbill-cred",
- 1615: "netbill-auth",
- 1616: "netbill-prod",
- 1617: "nimrod-agent",
- 1618: "skytelnet",
- 1619: "xs-openstorage",
- 1620: "faxportwinport",
- 1621: "softdataphone",
- 1622: "ontime",
- 1623: "jaleosnd",
- 1624: "udp-sr-port",
- 1625: "svs-omagent",
- 1626: "shockwave",
- 1627: "t128-gateway",
- 1628: "lontalk-norm",
- 1629: "lontalk-urgnt",
- 1630: "oraclenet8cman",
- 1631: "visitview",
- 1632: "pammratc",
- 1633: "pammrpc",
- 1634: "loaprobe",
- 1635: "edb-server1",
- 1636: "isdc",
- 1637: "islc",
- 1638: "ismc",
- 1639: "cert-initiator",
- 1640: "cert-responder",
- 1641: "invision",
- 1642: "isis-am",
- 1643: "isis-ambc",
- 1644: "saiseh",
- 1645: "sightline",
- 1646: "sa-msg-port",
- 1647: "rsap",
- 1648: "concurrent-lm",
- 1649: "kermit",
- 1650: "nkd",
- 1651: "shiva-confsrvr",
- 1652: "xnmp",
- 1653: "alphatech-lm",
- 1654: "stargatealerts",
- 1655: "dec-mbadmin",
- 1656: "dec-mbadmin-h",
- 1657: "fujitsu-mmpdc",
- 1658: "sixnetudr",
- 1659: "sg-lm",
- 1660: "skip-mc-gikreq",
- 1661: "netview-aix-1",
- 1662: "netview-aix-2",
- 1663: "netview-aix-3",
- 1664: "netview-aix-4",
- 1665: "netview-aix-5",
- 1666: "netview-aix-6",
- 1667: "netview-aix-7",
- 1668: "netview-aix-8",
- 1669: "netview-aix-9",
- 1670: "netview-aix-10",
- 1671: "netview-aix-11",
- 1672: "netview-aix-12",
- 1673: "proshare-mc-1",
- 1674: "proshare-mc-2",
- 1675: "pdp",
- 1676: "netcomm2",
- 1677: "groupwise",
- 1678: "prolink",
- 1679: "darcorp-lm",
- 1680: "microcom-sbp",
- 1681: "sd-elmd",
- 1682: "lanyon-lantern",
- 1683: "ncpm-hip",
- 1684: "snaresecure",
- 1685: "n2nremote",
- 1686: "cvmon",
- 1687: "nsjtp-ctrl",
- 1688: "nsjtp-data",
- 1689: "firefox",
- 1690: "ng-umds",
- 1691: "empire-empuma",
- 1692: "sstsys-lm",
- 1693: "rrirtr",
- 1694: "rrimwm",
- 1695: "rrilwm",
- 1696: "rrifmm",
- 1697: "rrisat",
- 1698: "rsvp-encap-1",
- 1699: "rsvp-encap-2",
- 1700: "mps-raft",
- 1701: "l2f",
- 1702: "deskshare",
- 1703: "hb-engine",
- 1704: "bcs-broker",
- 1705: "slingshot",
- 1706: "jetform",
- 1707: "vdmplay",
- 1708: "gat-lmd",
- 1709: "centra",
- 1710: "impera",
- 1711: "pptconference",
- 1712: "registrar",
- 1713: "conferencetalk",
- 1714: "sesi-lm",
- 1715: "houdini-lm",
- 1716: "xmsg",
- 1717: "fj-hdnet",
- 1718: "h323gatedisc",
- 1719: "h323gatestat",
- 1720: "h323hostcall",
- 1721: "caicci",
- 1722: "hks-lm",
- 1723: "pptp",
- 1724: "csbphonemaster",
- 1725: "iden-ralp",
- 1726: "iberiagames",
- 1727: "winddx",
- 1728: "telindus",
- 1729: "citynl",
- 1730: "roketz",
- 1731: "msiccp",
- 1732: "proxim",
- 1733: "siipat",
- 1734: "cambertx-lm",
- 1735: "privatechat",
- 1736: "street-stream",
- 1737: "ultimad",
- 1738: "gamegen1",
- 1739: "webaccess",
- 1740: "encore",
- 1741: "cisco-net-mgmt",
- 1742: "3Com-nsd",
- 1743: "cinegrfx-lm",
- 1744: "ncpm-ft",
- 1745: "remote-winsock",
- 1746: "ftrapid-1",
- 1747: "ftrapid-2",
- 1748: "oracle-em1",
- 1749: "aspen-services",
- 1750: "sslp",
- 1751: "swiftnet",
- 1752: "lofr-lm",
- 1754: "oracle-em2",
- 1755: "ms-streaming",
- 1756: "capfast-lmd",
- 1757: "cnhrp",
- 1758: "tftp-mcast",
- 1759: "spss-lm",
- 1760: "www-ldap-gw",
- 1761: "cft-0",
- 1762: "cft-1",
- 1763: "cft-2",
- 1764: "cft-3",
- 1765: "cft-4",
- 1766: "cft-5",
- 1767: "cft-6",
- 1768: "cft-7",
- 1769: "bmc-net-adm",
- 1770: "bmc-net-svc",
- 1771: "vaultbase",
- 1772: "essweb-gw",
- 1773: "kmscontrol",
- 1774: "global-dtserv",
- 1776: "femis",
- 1777: "powerguardian",
- 1778: "prodigy-intrnet",
- 1779: "pharmasoft",
- 1780: "dpkeyserv",
- 1781: "answersoft-lm",
- 1782: "hp-hcip",
- 1784: "finle-lm",
- 1785: "windlm",
- 1786: "funk-logger",
- 1787: "funk-license",
- 1788: "psmond",
- 1789: "hello",
- 1790: "nmsp",
- 1791: "ea1",
- 1792: "ibm-dt-2",
- 1793: "rsc-robot",
- 1794: "cera-bcm",
- 1795: "dpi-proxy",
- 1796: "vocaltec-admin",
- 1797: "uma",
- 1798: "etp",
- 1799: "netrisk",
- 1800: "ansys-lm",
- 1801: "msmq",
- 1802: "concomp1",
- 1803: "hp-hcip-gwy",
- 1804: "enl",
- 1805: "enl-name",
- 1806: "musiconline",
- 1807: "fhsp",
- 1808: "oracle-vp2",
- 1809: "oracle-vp1",
- 1810: "jerand-lm",
- 1811: "scientia-sdb",
- 1812: "radius",
- 1813: "radius-acct",
- 1814: "tdp-suite",
- 1815: "mmpft",
- 1816: "harp",
- 1817: "rkb-oscs",
- 1818: "etftp",
- 1819: "plato-lm",
- 1820: "mcagent",
- 1821: "donnyworld",
- 1822: "es-elmd",
- 1823: "unisys-lm",
- 1824: "metrics-pas",
- 1825: "direcpc-video",
- 1826: "ardt",
- 1827: "asi",
- 1828: "itm-mcell-u",
- 1829: "optika-emedia",
- 1830: "net8-cman",
- 1831: "myrtle",
- 1832: "tht-treasure",
- 1833: "udpradio",
- 1834: "ardusuni",
- 1835: "ardusmul",
- 1836: "ste-smsc",
- 1837: "csoft1",
- 1838: "talnet",
- 1839: "netopia-vo1",
- 1840: "netopia-vo2",
- 1841: "netopia-vo3",
- 1842: "netopia-vo4",
- 1843: "netopia-vo5",
- 1844: "direcpc-dll",
- 1845: "altalink",
- 1846: "tunstall-pnc",
- 1847: "slp-notify",
- 1848: "fjdocdist",
- 1849: "alpha-sms",
- 1850: "gsi",
- 1851: "ctcd",
- 1852: "virtual-time",
- 1853: "vids-avtp",
- 1854: "buddy-draw",
- 1855: "fiorano-rtrsvc",
- 1856: "fiorano-msgsvc",
- 1857: "datacaptor",
- 1858: "privateark",
- 1859: "gammafetchsvr",
- 1860: "sunscalar-svc",
- 1861: "lecroy-vicp",
- 1862: "mysql-cm-agent",
- 1863: "msnp",
- 1864: "paradym-31port",
- 1865: "entp",
- 1866: "swrmi",
- 1867: "udrive",
- 1868: "viziblebrowser",
- 1869: "transact",
- 1870: "sunscalar-dns",
- 1871: "canocentral0",
- 1872: "canocentral1",
- 1873: "fjmpjps",
- 1874: "fjswapsnp",
- 1875: "westell-stats",
- 1876: "ewcappsrv",
- 1877: "hp-webqosdb",
- 1878: "drmsmc",
- 1879: "nettgain-nms",
- 1880: "vsat-control",
- 1881: "ibm-mqseries2",
- 1882: "ecsqdmn",
- 1883: "ibm-mqisdp",
- 1884: "idmaps",
- 1885: "vrtstrapserver",
- 1886: "leoip",
- 1887: "filex-lport",
- 1888: "ncconfig",
- 1889: "unify-adapter",
- 1890: "wilkenlistener",
- 1891: "childkey-notif",
- 1892: "childkey-ctrl",
- 1893: "elad",
- 1894: "o2server-port",
- 1896: "b-novative-ls",
- 1897: "metaagent",
- 1898: "cymtec-port",
- 1899: "mc2studios",
- 1900: "ssdp",
- 1901: "fjicl-tep-a",
- 1902: "fjicl-tep-b",
- 1903: "linkname",
- 1904: "fjicl-tep-c",
- 1905: "sugp",
- 1906: "tpmd",
- 1907: "intrastar",
- 1908: "dawn",
- 1909: "global-wlink",
- 1910: "ultrabac",
- 1911: "mtp",
- 1912: "rhp-iibp",
- 1913: "armadp",
- 1914: "elm-momentum",
- 1915: "facelink",
- 1916: "persona",
- 1917: "noagent",
- 1918: "can-nds",
- 1919: "can-dch",
- 1920: "can-ferret",
- 1921: "noadmin",
- 1922: "tapestry",
- 1923: "spice",
- 1924: "xiip",
- 1925: "discovery-port",
- 1926: "egs",
- 1927: "videte-cipc",
- 1928: "emsd-port",
- 1929: "bandwiz-system",
- 1930: "driveappserver",
- 1931: "amdsched",
- 1932: "ctt-broker",
- 1933: "xmapi",
- 1934: "xaapi",
- 1935: "macromedia-fcs",
- 1936: "jetcmeserver",
- 1937: "jwserver",
- 1938: "jwclient",
- 1939: "jvserver",
- 1940: "jvclient",
- 1941: "dic-aida",
- 1942: "res",
- 1943: "beeyond-media",
- 1944: "close-combat",
- 1945: "dialogic-elmd",
- 1946: "tekpls",
- 1947: "sentinelsrm",
- 1948: "eye2eye",
- 1949: "ismaeasdaqlive",
- 1950: "ismaeasdaqtest",
- 1951: "bcs-lmserver",
- 1952: "mpnjsc",
- 1953: "rapidbase",
- 1954: "abr-api",
- 1955: "abr-secure",
- 1956: "vrtl-vmf-ds",
- 1957: "unix-status",
- 1958: "dxadmind",
- 1959: "simp-all",
- 1960: "nasmanager",
- 1961: "bts-appserver",
- 1962: "biap-mp",
- 1963: "webmachine",
- 1964: "solid-e-engine",
- 1965: "tivoli-npm",
- 1966: "slush",
- 1967: "sns-quote",
- 1968: "lipsinc",
- 1969: "lipsinc1",
- 1970: "netop-rc",
- 1971: "netop-school",
- 1972: "intersys-cache",
- 1973: "dlsrap",
- 1974: "drp",
- 1975: "tcoflashagent",
- 1976: "tcoregagent",
- 1977: "tcoaddressbook",
- 1978: "unisql",
- 1979: "unisql-java",
- 1980: "pearldoc-xact",
- 1981: "p2pq",
- 1982: "estamp",
- 1983: "lhtp",
- 1984: "bb",
- 1985: "hsrp",
- 1986: "licensedaemon",
- 1987: "tr-rsrb-p1",
- 1988: "tr-rsrb-p2",
- 1989: "tr-rsrb-p3",
- 1990: "stun-p1",
- 1991: "stun-p2",
- 1992: "stun-p3",
- 1993: "snmp-tcp-port",
- 1994: "stun-port",
- 1995: "perf-port",
- 1996: "tr-rsrb-port",
- 1997: "gdp-port",
- 1998: "x25-svc-port",
- 1999: "tcp-id-port",
- 2000: "cisco-sccp",
- 2001: "wizard",
- 2002: "globe",
- 2003: "brutus",
- 2004: "emce",
- 2005: "oracle",
- 2006: "raid-cd",
- 2007: "raid-am",
- 2008: "terminaldb",
- 2009: "whosockami",
- 2010: "pipe-server",
- 2011: "servserv",
- 2012: "raid-ac",
- 2013: "raid-cd",
- 2014: "raid-sf",
- 2015: "raid-cs",
- 2016: "bootserver",
- 2017: "bootclient",
- 2018: "rellpack",
- 2019: "about",
- 2020: "xinupageserver",
- 2021: "xinuexpansion1",
- 2022: "xinuexpansion2",
- 2023: "xinuexpansion3",
- 2024: "xinuexpansion4",
- 2025: "xribs",
- 2026: "scrabble",
- 2027: "shadowserver",
- 2028: "submitserver",
- 2029: "hsrpv6",
- 2030: "device2",
- 2031: "mobrien-chat",
- 2032: "blackboard",
- 2033: "glogger",
- 2034: "scoremgr",
- 2035: "imsldoc",
- 2036: "e-dpnet",
- 2037: "applus",
- 2038: "objectmanager",
- 2039: "prizma",
- 2040: "lam",
- 2041: "interbase",
- 2042: "isis",
- 2043: "isis-bcast",
- 2044: "rimsl",
- 2045: "cdfunc",
- 2046: "sdfunc",
- 2047: "dls",
- 2048: "dls-monitor",
- 2049: "shilp",
- 2050: "av-emb-config",
- 2051: "epnsdp",
- 2052: "clearvisn",
- 2053: "lot105-ds-upd",
- 2054: "weblogin",
- 2055: "iop",
- 2056: "omnisky",
- 2057: "rich-cp",
- 2058: "newwavesearch",
- 2059: "bmc-messaging",
- 2060: "teleniumdaemon",
- 2061: "netmount",
- 2062: "icg-swp",
- 2063: "icg-bridge",
- 2064: "icg-iprelay",
- 2065: "dlsrpn",
- 2066: "aura",
- 2067: "dlswpn",
- 2068: "avauthsrvprtcl",
- 2069: "event-port",
- 2070: "ah-esp-encap",
- 2071: "acp-port",
- 2072: "msync",
- 2073: "gxs-data-port",
- 2074: "vrtl-vmf-sa",
- 2075: "newlixengine",
- 2076: "newlixconfig",
- 2077: "tsrmagt",
- 2078: "tpcsrvr",
- 2079: "idware-router",
- 2080: "autodesk-nlm",
- 2081: "kme-trap-port",
- 2082: "infowave",
- 2083: "radsec",
- 2084: "sunclustergeo",
- 2085: "ada-cip",
- 2086: "gnunet",
- 2087: "eli",
- 2088: "ip-blf",
- 2089: "sep",
- 2090: "lrp",
- 2091: "prp",
- 2092: "descent3",
- 2093: "nbx-cc",
- 2094: "nbx-au",
- 2095: "nbx-ser",
- 2096: "nbx-dir",
- 2097: "jetformpreview",
- 2098: "dialog-port",
- 2099: "h2250-annex-g",
- 2100: "amiganetfs",
- 2101: "rtcm-sc104",
- 2102: "zephyr-srv",
- 2103: "zephyr-clt",
- 2104: "zephyr-hm",
- 2105: "minipay",
- 2106: "mzap",
- 2107: "bintec-admin",
- 2108: "comcam",
- 2109: "ergolight",
- 2110: "umsp",
- 2111: "dsatp",
- 2112: "idonix-metanet",
- 2113: "hsl-storm",
- 2114: "newheights",
- 2115: "kdm",
- 2116: "ccowcmr",
- 2117: "mentaclient",
- 2118: "mentaserver",
- 2119: "gsigatekeeper",
- 2120: "qencp",
- 2121: "scientia-ssdb",
- 2122: "caupc-remote",
- 2123: "gtp-control",
- 2124: "elatelink",
- 2125: "lockstep",
- 2126: "pktcable-cops",
- 2127: "index-pc-wb",
- 2128: "net-steward",
- 2129: "cs-live",
- 2130: "xds",
- 2131: "avantageb2b",
- 2132: "solera-epmap",
- 2133: "zymed-zpp",
- 2134: "avenue",
- 2135: "gris",
- 2136: "appworxsrv",
- 2137: "connect",
- 2138: "unbind-cluster",
- 2139: "ias-auth",
- 2140: "ias-reg",
- 2141: "ias-admind",
- 2142: "tdmoip",
- 2143: "lv-jc",
- 2144: "lv-ffx",
- 2145: "lv-pici",
- 2146: "lv-not",
- 2147: "lv-auth",
- 2148: "veritas-ucl",
- 2149: "acptsys",
- 2150: "dynamic3d",
- 2151: "docent",
- 2152: "gtp-user",
- 2153: "ctlptc",
- 2154: "stdptc",
- 2155: "brdptc",
- 2156: "trp",
- 2157: "xnds",
- 2158: "touchnetplus",
- 2159: "gdbremote",
- 2160: "apc-2160",
- 2161: "apc-2161",
- 2162: "navisphere",
- 2163: "navisphere-sec",
- 2164: "ddns-v3",
- 2165: "x-bone-api",
- 2166: "iwserver",
- 2167: "raw-serial",
- 2168: "easy-soft-mux",
- 2169: "brain",
- 2170: "eyetv",
- 2171: "msfw-storage",
- 2172: "msfw-s-storage",
- 2173: "msfw-replica",
- 2174: "msfw-array",
- 2175: "airsync",
- 2176: "rapi",
- 2177: "qwave",
- 2178: "bitspeer",
- 2179: "vmrdp",
- 2180: "mc-gt-srv",
- 2181: "eforward",
- 2182: "cgn-stat",
- 2183: "cgn-config",
- 2184: "nvd",
- 2185: "onbase-dds",
- 2186: "gtaua",
- 2187: "ssmd",
- 2190: "tivoconnect",
- 2191: "tvbus",
- 2192: "asdis",
- 2193: "drwcs",
- 2197: "mnp-exchange",
- 2198: "onehome-remote",
- 2199: "onehome-help",
- 2200: "ici",
- 2201: "ats",
- 2202: "imtc-map",
- 2203: "b2-runtime",
- 2204: "b2-license",
- 2205: "jps",
- 2206: "hpocbus",
- 2207: "hpssd",
- 2208: "hpiod",
- 2209: "rimf-ps",
- 2210: "noaaport",
- 2211: "emwin",
- 2212: "leecoposserver",
- 2213: "kali",
- 2214: "rpi",
- 2215: "ipcore",
- 2216: "vtu-comms",
- 2217: "gotodevice",
- 2218: "bounzza",
- 2219: "netiq-ncap",
- 2220: "netiq",
- 2221: "rockwell-csp1",
- 2222: "EtherNet-IP-1",
- 2223: "rockwell-csp2",
- 2224: "efi-mg",
- 2226: "di-drm",
- 2227: "di-msg",
- 2228: "ehome-ms",
- 2229: "datalens",
- 2230: "queueadm",
- 2231: "wimaxasncp",
- 2232: "ivs-video",
- 2233: "infocrypt",
- 2234: "directplay",
- 2235: "sercomm-wlink",
- 2236: "nani",
- 2237: "optech-port1-lm",
- 2238: "aviva-sna",
- 2239: "imagequery",
- 2240: "recipe",
- 2241: "ivsd",
- 2242: "foliocorp",
- 2243: "magicom",
- 2244: "nmsserver",
- 2245: "hao",
- 2246: "pc-mta-addrmap",
- 2247: "antidotemgrsvr",
- 2248: "ums",
- 2249: "rfmp",
- 2250: "remote-collab",
- 2251: "dif-port",
- 2252: "njenet-ssl",
- 2253: "dtv-chan-req",
- 2254: "seispoc",
- 2255: "vrtp",
- 2256: "pcc-mfp",
- 2257: "simple-tx-rx",
- 2258: "rcts",
- 2260: "apc-2260",
- 2261: "comotionmaster",
- 2262: "comotionback",
- 2263: "ecwcfg",
- 2264: "apx500api-1",
- 2265: "apx500api-2",
- 2266: "mfserver",
- 2267: "ontobroker",
- 2268: "amt",
- 2269: "mikey",
- 2270: "starschool",
- 2271: "mmcals",
- 2272: "mmcal",
- 2273: "mysql-im",
- 2274: "pcttunnell",
- 2275: "ibridge-data",
- 2276: "ibridge-mgmt",
- 2277: "bluectrlproxy",
- 2278: "s3db",
- 2279: "xmquery",
- 2280: "lnvpoller",
- 2281: "lnvconsole",
- 2282: "lnvalarm",
- 2283: "lnvstatus",
- 2284: "lnvmaps",
- 2285: "lnvmailmon",
- 2286: "nas-metering",
- 2287: "dna",
- 2288: "netml",
- 2289: "dict-lookup",
- 2290: "sonus-logging",
- 2291: "eapsp",
- 2292: "mib-streaming",
- 2293: "npdbgmngr",
- 2294: "konshus-lm",
- 2295: "advant-lm",
- 2296: "theta-lm",
- 2297: "d2k-datamover1",
- 2298: "d2k-datamover2",
- 2299: "pc-telecommute",
- 2300: "cvmmon",
- 2301: "cpq-wbem",
- 2302: "binderysupport",
- 2303: "proxy-gateway",
- 2304: "attachmate-uts",
- 2305: "mt-scaleserver",
- 2306: "tappi-boxnet",
- 2307: "pehelp",
- 2308: "sdhelp",
- 2309: "sdserver",
- 2310: "sdclient",
- 2311: "messageservice",
- 2312: "wanscaler",
- 2313: "iapp",
- 2314: "cr-websystems",
- 2315: "precise-sft",
- 2316: "sent-lm",
- 2317: "attachmate-g32",
- 2318: "cadencecontrol",
- 2319: "infolibria",
- 2320: "siebel-ns",
- 2321: "rdlap",
- 2322: "ofsd",
- 2323: "3d-nfsd",
- 2324: "cosmocall",
- 2325: "ansysli",
- 2326: "idcp",
- 2327: "xingcsm",
- 2328: "netrix-sftm",
- 2329: "nvd",
- 2330: "tscchat",
- 2331: "agentview",
- 2332: "rcc-host",
- 2333: "snapp",
- 2334: "ace-client",
- 2335: "ace-proxy",
- 2336: "appleugcontrol",
- 2337: "ideesrv",
- 2338: "norton-lambert",
- 2339: "3com-webview",
- 2340: "wrs-registry",
- 2341: "xiostatus",
- 2342: "manage-exec",
- 2343: "nati-logos",
- 2344: "fcmsys",
- 2345: "dbm",
- 2346: "redstorm-join",
- 2347: "redstorm-find",
- 2348: "redstorm-info",
- 2349: "redstorm-diag",
- 2350: "psbserver",
- 2351: "psrserver",
- 2352: "pslserver",
- 2353: "pspserver",
- 2354: "psprserver",
- 2355: "psdbserver",
- 2356: "gxtelmd",
- 2357: "unihub-server",
- 2358: "futrix",
- 2359: "flukeserver",
- 2360: "nexstorindltd",
- 2361: "tl1",
- 2362: "digiman",
- 2363: "mediacntrlnfsd",
- 2364: "oi-2000",
- 2365: "dbref",
- 2366: "qip-login",
- 2367: "service-ctrl",
- 2368: "opentable",
- 2370: "l3-hbmon",
- 2372: "lanmessenger",
- 2381: "compaq-https",
- 2382: "ms-olap3",
- 2383: "ms-olap4",
- 2384: "sd-capacity",
- 2385: "sd-data",
- 2386: "virtualtape",
- 2387: "vsamredirector",
- 2388: "mynahautostart",
- 2389: "ovsessionmgr",
- 2390: "rsmtp",
- 2391: "3com-net-mgmt",
- 2392: "tacticalauth",
- 2393: "ms-olap1",
- 2394: "ms-olap2",
- 2395: "lan900-remote",
- 2396: "wusage",
- 2397: "ncl",
- 2398: "orbiter",
- 2399: "fmpro-fdal",
- 2400: "opequus-server",
- 2401: "cvspserver",
- 2402: "taskmaster2000",
- 2403: "taskmaster2000",
- 2404: "iec-104",
- 2405: "trc-netpoll",
- 2406: "jediserver",
- 2407: "orion",
- 2409: "sns-protocol",
- 2410: "vrts-registry",
- 2411: "netwave-ap-mgmt",
- 2412: "cdn",
- 2413: "orion-rmi-reg",
- 2414: "beeyond",
- 2415: "codima-rtp",
- 2416: "rmtserver",
- 2417: "composit-server",
- 2418: "cas",
- 2419: "attachmate-s2s",
- 2420: "dslremote-mgmt",
- 2421: "g-talk",
- 2422: "crmsbits",
- 2423: "rnrp",
- 2424: "kofax-svr",
- 2425: "fjitsuappmgr",
- 2427: "mgcp-gateway",
- 2428: "ott",
- 2429: "ft-role",
- 2430: "venus",
- 2431: "venus-se",
- 2432: "codasrv",
- 2433: "codasrv-se",
- 2434: "pxc-epmap",
- 2435: "optilogic",
- 2436: "topx",
- 2437: "unicontrol",
- 2438: "msp",
- 2439: "sybasedbsynch",
- 2440: "spearway",
- 2441: "pvsw-inet",
- 2442: "netangel",
- 2443: "powerclientcsf",
- 2444: "btpp2sectrans",
- 2445: "dtn1",
- 2446: "bues-service",
- 2447: "ovwdb",
- 2448: "hpppssvr",
- 2449: "ratl",
- 2450: "netadmin",
- 2451: "netchat",
- 2452: "snifferclient",
- 2453: "madge-ltd",
- 2454: "indx-dds",
- 2455: "wago-io-system",
- 2456: "altav-remmgt",
- 2457: "rapido-ip",
- 2458: "griffin",
- 2459: "community",
- 2460: "ms-theater",
- 2461: "qadmifoper",
- 2462: "qadmifevent",
- 2463: "lsi-raid-mgmt",
- 2464: "direcpc-si",
- 2465: "lbm",
- 2466: "lbf",
- 2467: "high-criteria",
- 2468: "qip-msgd",
- 2469: "mti-tcs-comm",
- 2470: "taskman-port",
- 2471: "seaodbc",
- 2472: "c3",
- 2473: "aker-cdp",
- 2474: "vitalanalysis",
- 2475: "ace-server",
- 2476: "ace-svr-prop",
- 2477: "ssm-cvs",
- 2478: "ssm-cssps",
- 2479: "ssm-els",
- 2480: "powerexchange",
- 2481: "giop",
- 2482: "giop-ssl",
- 2483: "ttc",
- 2484: "ttc-ssl",
- 2485: "netobjects1",
- 2486: "netobjects2",
- 2487: "pns",
- 2488: "moy-corp",
- 2489: "tsilb",
- 2490: "qip-qdhcp",
- 2491: "conclave-cpp",
- 2492: "groove",
- 2493: "talarian-mqs",
- 2494: "bmc-ar",
- 2495: "fast-rem-serv",
- 2496: "dirgis",
- 2497: "quaddb",
- 2498: "odn-castraq",
- 2499: "unicontrol",
- 2500: "rtsserv",
- 2501: "rtsclient",
- 2502: "kentrox-prot",
- 2503: "nms-dpnss",
- 2504: "wlbs",
- 2505: "ppcontrol",
- 2506: "jbroker",
- 2507: "spock",
- 2508: "jdatastore",
- 2509: "fjmpss",
- 2510: "fjappmgrbulk",
- 2511: "metastorm",
- 2512: "citrixima",
- 2513: "citrixadmin",
- 2514: "facsys-ntp",
- 2515: "facsys-router",
- 2516: "maincontrol",
- 2517: "call-sig-trans",
- 2518: "willy",
- 2519: "globmsgsvc",
- 2520: "pvsw",
- 2521: "adaptecmgr",
- 2522: "windb",
- 2523: "qke-llc-v3",
- 2524: "optiwave-lm",
- 2525: "ms-v-worlds",
- 2526: "ema-sent-lm",
- 2527: "iqserver",
- 2528: "ncr-ccl",
- 2529: "utsftp",
- 2530: "vrcommerce",
- 2531: "ito-e-gui",
- 2532: "ovtopmd",
- 2533: "snifferserver",
- 2534: "combox-web-acc",
- 2535: "madcap",
- 2536: "btpp2audctr1",
- 2537: "upgrade",
- 2538: "vnwk-prapi",
- 2539: "vsiadmin",
- 2540: "lonworks",
- 2541: "lonworks2",
- 2542: "udrawgraph",
- 2543: "reftek",
- 2544: "novell-zen",
- 2545: "sis-emt",
- 2546: "vytalvaultbrtp",
- 2547: "vytalvaultvsmp",
- 2548: "vytalvaultpipe",
- 2549: "ipass",
- 2550: "ads",
- 2551: "isg-uda-server",
- 2552: "call-logging",
- 2553: "efidiningport",
- 2554: "vcnet-link-v10",
- 2555: "compaq-wcp",
- 2556: "nicetec-nmsvc",
- 2557: "nicetec-mgmt",
- 2558: "pclemultimedia",
- 2559: "lstp",
- 2560: "labrat",
- 2561: "mosaixcc",
- 2562: "delibo",
- 2563: "cti-redwood",
- 2564: "hp-3000-telnet",
- 2565: "coord-svr",
- 2566: "pcs-pcw",
- 2567: "clp",
- 2568: "spamtrap",
- 2569: "sonuscallsig",
- 2570: "hs-port",
- 2571: "cecsvc",
- 2572: "ibp",
- 2573: "trustestablish",
- 2574: "blockade-bpsp",
- 2575: "hl7",
- 2576: "tclprodebugger",
- 2577: "scipticslsrvr",
- 2578: "rvs-isdn-dcp",
- 2579: "mpfoncl",
- 2580: "tributary",
- 2581: "argis-te",
- 2582: "argis-ds",
- 2583: "mon",
- 2584: "cyaserv",
- 2585: "netx-server",
- 2586: "netx-agent",
- 2587: "masc",
- 2588: "privilege",
- 2589: "quartus-tcl",
- 2590: "idotdist",
- 2591: "maytagshuffle",
- 2592: "netrek",
- 2593: "mns-mail",
- 2594: "dts",
- 2595: "worldfusion1",
- 2596: "worldfusion2",
- 2597: "homesteadglory",
- 2598: "citriximaclient",
- 2599: "snapd",
- 2600: "hpstgmgr",
- 2601: "discp-client",
- 2602: "discp-server",
- 2603: "servicemeter",
- 2604: "nsc-ccs",
- 2605: "nsc-posa",
- 2606: "netmon",
- 2607: "connection",
- 2608: "wag-service",
- 2609: "system-monitor",
- 2610: "versa-tek",
- 2611: "lionhead",
- 2612: "qpasa-agent",
- 2613: "smntubootstrap",
- 2614: "neveroffline",
- 2615: "firepower",
- 2616: "appswitch-emp",
- 2617: "cmadmin",
- 2618: "priority-e-com",
- 2619: "bruce",
- 2620: "lpsrecommender",
- 2621: "miles-apart",
- 2622: "metricadbc",
- 2623: "lmdp",
- 2624: "aria",
- 2625: "blwnkl-port",
- 2626: "gbjd816",
- 2627: "moshebeeri",
- 2628: "dict",
- 2629: "sitaraserver",
- 2630: "sitaramgmt",
- 2631: "sitaradir",
- 2632: "irdg-post",
- 2633: "interintelli",
- 2634: "pk-electronics",
- 2635: "backburner",
- 2636: "solve",
- 2637: "imdocsvc",
- 2638: "sybaseanywhere",
- 2639: "aminet",
- 2640: "sai-sentlm",
- 2641: "hdl-srv",
- 2642: "tragic",
- 2643: "gte-samp",
- 2644: "travsoft-ipx-t",
- 2645: "novell-ipx-cmd",
- 2646: "and-lm",
- 2647: "syncserver",
- 2648: "upsnotifyprot",
- 2649: "vpsipport",
- 2650: "eristwoguns",
- 2651: "ebinsite",
- 2652: "interpathpanel",
- 2653: "sonus",
- 2654: "corel-vncadmin",
- 2655: "unglue",
- 2656: "kana",
- 2657: "sns-dispatcher",
- 2658: "sns-admin",
- 2659: "sns-query",
- 2660: "gcmonitor",
- 2661: "olhost",
- 2662: "bintec-capi",
- 2663: "bintec-tapi",
- 2664: "patrol-mq-gm",
- 2665: "patrol-mq-nm",
- 2666: "extensis",
- 2667: "alarm-clock-s",
- 2668: "alarm-clock-c",
- 2669: "toad",
- 2670: "tve-announce",
- 2671: "newlixreg",
- 2672: "nhserver",
- 2673: "firstcall42",
- 2674: "ewnn",
- 2675: "ttc-etap",
- 2676: "simslink",
- 2677: "gadgetgate1way",
- 2678: "gadgetgate2way",
- 2679: "syncserverssl",
- 2680: "pxc-sapxom",
- 2681: "mpnjsomb",
- 2683: "ncdloadbalance",
- 2684: "mpnjsosv",
- 2685: "mpnjsocl",
- 2686: "mpnjsomg",
- 2687: "pq-lic-mgmt",
- 2688: "md-cg-http",
- 2689: "fastlynx",
- 2690: "hp-nnm-data",
- 2691: "itinternet",
- 2692: "admins-lms",
- 2694: "pwrsevent",
- 2695: "vspread",
- 2696: "unifyadmin",
- 2697: "oce-snmp-trap",
- 2698: "mck-ivpip",
- 2699: "csoft-plusclnt",
- 2700: "tqdata",
- 2701: "sms-rcinfo",
- 2702: "sms-xfer",
- 2703: "sms-chat",
- 2704: "sms-remctrl",
- 2705: "sds-admin",
- 2706: "ncdmirroring",
- 2707: "emcsymapiport",
- 2708: "banyan-net",
- 2709: "supermon",
- 2710: "sso-service",
- 2711: "sso-control",
- 2712: "aocp",
- 2713: "raventbs",
- 2714: "raventdm",
- 2715: "hpstgmgr2",
- 2716: "inova-ip-disco",
- 2717: "pn-requester",
- 2718: "pn-requester2",
- 2719: "scan-change",
- 2720: "wkars",
- 2721: "smart-diagnose",
- 2722: "proactivesrvr",
- 2723: "watchdog-nt",
- 2724: "qotps",
- 2725: "msolap-ptp2",
- 2726: "tams",
- 2727: "mgcp-callagent",
- 2728: "sqdr",
- 2729: "tcim-control",
- 2730: "nec-raidplus",
- 2731: "fyre-messanger",
- 2732: "g5m",
- 2733: "signet-ctf",
- 2734: "ccs-software",
- 2735: "netiq-mc",
- 2736: "radwiz-nms-srv",
- 2737: "srp-feedback",
- 2738: "ndl-tcp-ois-gw",
- 2739: "tn-timing",
- 2740: "alarm",
- 2741: "tsb",
- 2742: "tsb2",
- 2743: "murx",
- 2744: "honyaku",
- 2745: "urbisnet",
- 2746: "cpudpencap",
- 2747: "fjippol-swrly",
- 2748: "fjippol-polsvr",
- 2749: "fjippol-cnsl",
- 2750: "fjippol-port1",
- 2751: "fjippol-port2",
- 2752: "rsisysaccess",
- 2753: "de-spot",
- 2754: "apollo-cc",
- 2755: "expresspay",
- 2756: "simplement-tie",
- 2757: "cnrp",
- 2758: "apollo-status",
- 2759: "apollo-gms",
- 2760: "sabams",
- 2761: "dicom-iscl",
- 2762: "dicom-tls",
- 2763: "desktop-dna",
- 2764: "data-insurance",
- 2765: "qip-audup",
- 2766: "compaq-scp",
- 2767: "uadtc",
- 2768: "uacs",
- 2769: "exce",
- 2770: "veronica",
- 2771: "vergencecm",
- 2772: "auris",
- 2773: "rbakcup1",
- 2774: "rbakcup2",
- 2775: "smpp",
- 2776: "ridgeway1",
- 2777: "ridgeway2",
- 2778: "gwen-sonya",
- 2779: "lbc-sync",
- 2780: "lbc-control",
- 2781: "whosells",
- 2782: "everydayrc",
- 2783: "aises",
- 2784: "www-dev",
- 2785: "aic-np",
- 2786: "aic-oncrpc",
- 2787: "piccolo",
- 2788: "fryeserv",
- 2789: "media-agent",
- 2790: "plgproxy",
- 2791: "mtport-regist",
- 2792: "f5-globalsite",
- 2793: "initlsmsad",
- 2795: "livestats",
- 2796: "ac-tech",
- 2797: "esp-encap",
- 2798: "tmesis-upshot",
- 2799: "icon-discover",
- 2800: "acc-raid",
- 2801: "igcp",
- 2802: "veritas-udp1",
- 2803: "btprjctrl",
- 2804: "dvr-esm",
- 2805: "wta-wsp-s",
- 2806: "cspuni",
- 2807: "cspmulti",
- 2808: "j-lan-p",
- 2809: "corbaloc",
- 2810: "netsteward",
- 2811: "gsiftp",
- 2812: "atmtcp",
- 2813: "llm-pass",
- 2814: "llm-csv",
- 2815: "lbc-measure",
- 2816: "lbc-watchdog",
- 2817: "nmsigport",
- 2818: "rmlnk",
- 2819: "fc-faultnotify",
- 2820: "univision",
- 2821: "vrts-at-port",
- 2822: "ka0wuc",
- 2823: "cqg-netlan",
- 2824: "cqg-netlan-1",
- 2826: "slc-systemlog",
- 2827: "slc-ctrlrloops",
- 2828: "itm-lm",
- 2829: "silkp1",
- 2830: "silkp2",
- 2831: "silkp3",
- 2832: "silkp4",
- 2833: "glishd",
- 2834: "evtp",
- 2835: "evtp-data",
- 2836: "catalyst",
- 2837: "repliweb",
- 2838: "starbot",
- 2839: "nmsigport",
- 2840: "l3-exprt",
- 2841: "l3-ranger",
- 2842: "l3-hawk",
- 2843: "pdnet",
- 2844: "bpcp-poll",
- 2845: "bpcp-trap",
- 2846: "aimpp-hello",
- 2847: "aimpp-port-req",
- 2848: "amt-blc-port",
- 2849: "fxp",
- 2850: "metaconsole",
- 2851: "webemshttp",
- 2852: "bears-01",
- 2853: "ispipes",
- 2854: "infomover",
- 2856: "cesdinv",
- 2857: "simctlp",
- 2858: "ecnp",
- 2859: "activememory",
- 2860: "dialpad-voice1",
- 2861: "dialpad-voice2",
- 2862: "ttg-protocol",
- 2863: "sonardata",
- 2864: "astromed-main",
- 2865: "pit-vpn",
- 2866: "iwlistener",
- 2867: "esps-portal",
- 2868: "npep-messaging",
- 2869: "icslap",
- 2870: "daishi",
- 2871: "msi-selectplay",
- 2872: "radix",
- 2874: "dxmessagebase1",
- 2875: "dxmessagebase2",
- 2876: "sps-tunnel",
- 2877: "bluelance",
- 2878: "aap",
- 2879: "ucentric-ds",
- 2880: "synapse",
- 2881: "ndsp",
- 2882: "ndtp",
- 2883: "ndnp",
- 2884: "flashmsg",
- 2885: "topflow",
- 2886: "responselogic",
- 2887: "aironetddp",
- 2888: "spcsdlobby",
- 2889: "rsom",
- 2890: "cspclmulti",
- 2891: "cinegrfx-elmd",
- 2892: "snifferdata",
- 2893: "vseconnector",
- 2894: "abacus-remote",
- 2895: "natuslink",
- 2896: "ecovisiong6-1",
- 2897: "citrix-rtmp",
- 2898: "appliance-cfg",
- 2899: "powergemplus",
- 2900: "quicksuite",
- 2901: "allstorcns",
- 2902: "netaspi",
- 2903: "suitcase",
- 2904: "m2ua",
- 2906: "caller9",
- 2907: "webmethods-b2b",
- 2908: "mao",
- 2909: "funk-dialout",
- 2910: "tdaccess",
- 2911: "blockade",
- 2912: "epicon",
- 2913: "boosterware",
- 2914: "gamelobby",
- 2915: "tksocket",
- 2916: "elvin-server",
- 2917: "elvin-client",
- 2918: "kastenchasepad",
- 2919: "roboer",
- 2920: "roboeda",
- 2921: "cesdcdman",
- 2922: "cesdcdtrn",
- 2923: "wta-wsp-wtp-s",
- 2924: "precise-vip",
- 2926: "mobile-file-dl",
- 2927: "unimobilectrl",
- 2928: "redstone-cpss",
- 2929: "amx-webadmin",
- 2930: "amx-weblinx",
- 2931: "circle-x",
- 2932: "incp",
- 2933: "4-tieropmgw",
- 2934: "4-tieropmcli",
- 2935: "qtp",
- 2936: "otpatch",
- 2937: "pnaconsult-lm",
- 2938: "sm-pas-1",
- 2939: "sm-pas-2",
- 2940: "sm-pas-3",
- 2941: "sm-pas-4",
- 2942: "sm-pas-5",
- 2943: "ttnrepository",
- 2944: "megaco-h248",
- 2945: "h248-binary",
- 2946: "fjsvmpor",
- 2947: "gpsd",
- 2948: "wap-push",
- 2949: "wap-pushsecure",
- 2950: "esip",
- 2951: "ottp",
- 2952: "mpfwsas",
- 2953: "ovalarmsrv",
- 2954: "ovalarmsrv-cmd",
- 2955: "csnotify",
- 2956: "ovrimosdbman",
- 2957: "jmact5",
- 2958: "jmact6",
- 2959: "rmopagt",
- 2960: "dfoxserver",
- 2961: "boldsoft-lm",
- 2962: "iph-policy-cli",
- 2963: "iph-policy-adm",
- 2964: "bullant-srap",
- 2965: "bullant-rap",
- 2966: "idp-infotrieve",
- 2967: "ssc-agent",
- 2968: "enpp",
- 2969: "essp",
- 2970: "index-net",
- 2971: "netclip",
- 2972: "pmsm-webrctl",
- 2973: "svnetworks",
- 2974: "signal",
- 2975: "fjmpcm",
- 2976: "cns-srv-port",
- 2977: "ttc-etap-ns",
- 2978: "ttc-etap-ds",
- 2979: "h263-video",
- 2980: "wimd",
- 2981: "mylxamport",
- 2982: "iwb-whiteboard",
- 2983: "netplan",
- 2984: "hpidsadmin",
- 2985: "hpidsagent",
- 2986: "stonefalls",
- 2987: "identify",
- 2988: "hippad",
- 2989: "zarkov",
- 2990: "boscap",
- 2991: "wkstn-mon",
- 2992: "avenyo",
- 2993: "veritas-vis1",
- 2994: "veritas-vis2",
- 2995: "idrs",
- 2996: "vsixml",
- 2997: "rebol",
- 2998: "realsecure",
- 2999: "remoteware-un",
- 3000: "hbci",
- 3002: "exlm-agent",
- 3003: "cgms",
- 3004: "csoftragent",
- 3005: "geniuslm",
- 3006: "ii-admin",
- 3007: "lotusmtap",
- 3008: "midnight-tech",
- 3009: "pxc-ntfy",
- 3010: "ping-pong",
- 3011: "trusted-web",
- 3012: "twsdss",
- 3013: "gilatskysurfer",
- 3014: "broker-service",
- 3015: "nati-dstp",
- 3016: "notify-srvr",
- 3017: "event-listener",
- 3018: "srvc-registry",
- 3019: "resource-mgr",
- 3020: "cifs",
- 3021: "agriserver",
- 3022: "csregagent",
- 3023: "magicnotes",
- 3024: "nds-sso",
- 3025: "arepa-raft",
- 3026: "agri-gateway",
- 3027: "LiebDevMgmt-C",
- 3028: "LiebDevMgmt-DM",
- 3029: "LiebDevMgmt-A",
- 3030: "arepa-cas",
- 3031: "eppc",
- 3032: "redwood-chat",
- 3033: "pdb",
- 3034: "osmosis-aeea",
- 3035: "fjsv-gssagt",
- 3036: "hagel-dump",
- 3037: "hp-san-mgmt",
- 3038: "santak-ups",
- 3039: "cogitate",
- 3040: "tomato-springs",
- 3041: "di-traceware",
- 3042: "journee",
- 3043: "brp",
- 3044: "epp",
- 3045: "responsenet",
- 3046: "di-ase",
- 3047: "hlserver",
- 3048: "pctrader",
- 3049: "nsws",
- 3050: "gds-db",
- 3051: "galaxy-server",
- 3052: "apc-3052",
- 3053: "dsom-server",
- 3054: "amt-cnf-prot",
- 3055: "policyserver",
- 3056: "cdl-server",
- 3057: "goahead-fldup",
- 3058: "videobeans",
- 3059: "qsoft",
- 3060: "interserver",
- 3061: "cautcpd",
- 3062: "ncacn-ip-tcp",
- 3063: "ncadg-ip-udp",
- 3064: "rprt",
- 3065: "slinterbase",
- 3066: "netattachsdmp",
- 3067: "fjhpjp",
- 3068: "ls3bcast",
- 3069: "ls3",
- 3070: "mgxswitch",
- 3071: "csd-mgmt-port",
- 3072: "csd-monitor",
- 3073: "vcrp",
- 3074: "xbox",
- 3075: "orbix-locator",
- 3076: "orbix-config",
- 3077: "orbix-loc-ssl",
- 3078: "orbix-cfg-ssl",
- 3079: "lv-frontpanel",
- 3080: "stm-pproc",
- 3081: "tl1-lv",
- 3082: "tl1-raw",
- 3083: "tl1-telnet",
- 3084: "itm-mccs",
- 3085: "pcihreq",
- 3086: "jdl-dbkitchen",
- 3087: "asoki-sma",
- 3088: "xdtp",
- 3089: "ptk-alink",
- 3090: "stss",
- 3091: "1ci-smcs",
- 3093: "rapidmq-center",
- 3094: "rapidmq-reg",
- 3095: "panasas",
- 3096: "ndl-aps",
- 3098: "umm-port",
- 3099: "chmd",
- 3100: "opcon-xps",
- 3101: "hp-pxpib",
- 3102: "slslavemon",
- 3103: "autocuesmi",
- 3104: "autocuetime",
- 3105: "cardbox",
- 3106: "cardbox-http",
- 3107: "business",
- 3108: "geolocate",
- 3109: "personnel",
- 3110: "sim-control",
- 3111: "wsynch",
- 3112: "ksysguard",
- 3113: "cs-auth-svr",
- 3114: "ccmad",
- 3115: "mctet-master",
- 3116: "mctet-gateway",
- 3117: "mctet-jserv",
- 3118: "pkagent",
- 3119: "d2000kernel",
- 3120: "d2000webserver",
- 3122: "vtr-emulator",
- 3123: "edix",
- 3124: "beacon-port",
- 3125: "a13-an",
- 3127: "ctx-bridge",
- 3128: "ndl-aas",
- 3129: "netport-id",
- 3130: "icpv2",
- 3131: "netbookmark",
- 3132: "ms-rule-engine",
- 3133: "prism-deploy",
- 3134: "ecp",
- 3135: "peerbook-port",
- 3136: "grubd",
- 3137: "rtnt-1",
- 3138: "rtnt-2",
- 3139: "incognitorv",
- 3140: "ariliamulti",
- 3141: "vmodem",
- 3142: "rdc-wh-eos",
- 3143: "seaview",
- 3144: "tarantella",
- 3145: "csi-lfap",
- 3146: "bears-02",
- 3147: "rfio",
- 3148: "nm-game-admin",
- 3149: "nm-game-server",
- 3150: "nm-asses-admin",
- 3151: "nm-assessor",
- 3152: "feitianrockey",
- 3153: "s8-client-port",
- 3154: "ccmrmi",
- 3155: "jpegmpeg",
- 3156: "indura",
- 3157: "e3consultants",
- 3158: "stvp",
- 3159: "navegaweb-port",
- 3160: "tip-app-server",
- 3161: "doc1lm",
- 3162: "sflm",
- 3163: "res-sap",
- 3164: "imprs",
- 3165: "newgenpay",
- 3166: "sossecollector",
- 3167: "nowcontact",
- 3168: "poweronnud",
- 3169: "serverview-as",
- 3170: "serverview-asn",
- 3171: "serverview-gf",
- 3172: "serverview-rm",
- 3173: "serverview-icc",
- 3174: "armi-server",
- 3175: "t1-e1-over-ip",
- 3176: "ars-master",
- 3177: "phonex-port",
- 3178: "radclientport",
- 3179: "h2gf-w-2m",
- 3180: "mc-brk-srv",
- 3181: "bmcpatrolagent",
- 3182: "bmcpatrolrnvu",
- 3183: "cops-tls",
- 3184: "apogeex-port",
- 3185: "smpppd",
- 3186: "iiw-port",
- 3187: "odi-port",
- 3188: "brcm-comm-port",
- 3189: "pcle-infex",
- 3190: "csvr-proxy",
- 3191: "csvr-sslproxy",
- 3192: "firemonrcc",
- 3193: "spandataport",
- 3194: "magbind",
- 3195: "ncu-1",
- 3196: "ncu-2",
- 3197: "embrace-dp-s",
- 3198: "embrace-dp-c",
- 3199: "dmod-workspace",
- 3200: "tick-port",
- 3201: "cpq-tasksmart",
- 3202: "intraintra",
- 3203: "netwatcher-mon",
- 3204: "netwatcher-db",
- 3205: "isns",
- 3206: "ironmail",
- 3207: "vx-auth-port",
- 3208: "pfu-prcallback",
- 3209: "netwkpathengine",
- 3210: "flamenco-proxy",
- 3211: "avsecuremgmt",
- 3212: "surveyinst",
- 3213: "neon24x7",
- 3214: "jmq-daemon-1",
- 3215: "jmq-daemon-2",
- 3216: "ferrari-foam",
- 3217: "unite",
- 3218: "smartpackets",
- 3219: "wms-messenger",
- 3220: "xnm-ssl",
- 3221: "xnm-clear-text",
- 3222: "glbp",
- 3223: "digivote",
- 3224: "aes-discovery",
- 3225: "fcip-port",
- 3226: "isi-irp",
- 3227: "dwnmshttp",
- 3228: "dwmsgserver",
- 3229: "global-cd-port",
- 3230: "sftdst-port",
- 3231: "vidigo",
- 3232: "mdtp",
- 3233: "whisker",
- 3234: "alchemy",
- 3235: "mdap-port",
- 3236: "apparenet-ts",
- 3237: "apparenet-tps",
- 3238: "apparenet-as",
- 3239: "apparenet-ui",
- 3240: "triomotion",
- 3241: "sysorb",
- 3242: "sdp-id-port",
- 3243: "timelot",
- 3244: "onesaf",
- 3245: "vieo-fe",
- 3246: "dvt-system",
- 3247: "dvt-data",
- 3248: "procos-lm",
- 3249: "ssp",
- 3250: "hicp",
- 3251: "sysscanner",
- 3252: "dhe",
- 3253: "pda-data",
- 3254: "pda-sys",
- 3255: "semaphore",
- 3256: "cpqrpm-agent",
- 3257: "cpqrpm-server",
- 3258: "ivecon-port",
- 3259: "epncdp2",
- 3260: "iscsi-target",
- 3261: "winshadow",
- 3262: "necp",
- 3263: "ecolor-imager",
- 3264: "ccmail",
- 3265: "altav-tunnel",
- 3266: "ns-cfg-server",
- 3267: "ibm-dial-out",
- 3268: "msft-gc",
- 3269: "msft-gc-ssl",
- 3270: "verismart",
- 3271: "csoft-prev",
- 3272: "user-manager",
- 3273: "sxmp",
- 3274: "ordinox-server",
- 3275: "samd",
- 3276: "maxim-asics",
- 3277: "awg-proxy",
- 3278: "lkcmserver",
- 3279: "admind",
- 3280: "vs-server",
- 3281: "sysopt",
- 3282: "datusorb",
- 3283: "Apple Remote Desktop (Net Assistant)",
- 3284: "4talk",
- 3285: "plato",
- 3286: "e-net",
- 3287: "directvdata",
- 3288: "cops",
- 3289: "enpc",
- 3290: "caps-lm",
- 3291: "sah-lm",
- 3292: "cart-o-rama",
- 3293: "fg-fps",
- 3294: "fg-gip",
- 3295: "dyniplookup",
- 3296: "rib-slm",
- 3297: "cytel-lm",
- 3298: "deskview",
- 3299: "pdrncs",
- 3302: "mcs-fastmail",
- 3303: "opsession-clnt",
- 3304: "opsession-srvr",
- 3305: "odette-ftp",
- 3306: "mysql",
- 3307: "opsession-prxy",
- 3308: "tns-server",
- 3309: "tns-adv",
- 3310: "dyna-access",
- 3311: "mcns-tel-ret",
- 3312: "appman-server",
- 3313: "uorb",
- 3314: "uohost",
- 3315: "cdid",
- 3316: "aicc-cmi",
- 3317: "vsaiport",
- 3318: "ssrip",
- 3319: "sdt-lmd",
- 3320: "officelink2000",
- 3321: "vnsstr",
- 3326: "sftu",
- 3327: "bbars",
- 3328: "egptlm",
- 3329: "hp-device-disc",
- 3330: "mcs-calypsoicf",
- 3331: "mcs-messaging",
- 3332: "mcs-mailsvr",
- 3333: "dec-notes",
- 3334: "directv-web",
- 3335: "directv-soft",
- 3336: "directv-tick",
- 3337: "directv-catlg",
- 3338: "anet-b",
- 3339: "anet-l",
- 3340: "anet-m",
- 3341: "anet-h",
- 3342: "webtie",
- 3343: "ms-cluster-net",
- 3344: "bnt-manager",
- 3345: "influence",
- 3346: "trnsprntproxy",
- 3347: "phoenix-rpc",
- 3348: "pangolin-laser",
- 3349: "chevinservices",
- 3350: "findviatv",
- 3351: "btrieve",
- 3352: "ssql",
- 3353: "fatpipe",
- 3354: "suitjd",
- 3355: "ordinox-dbase",
- 3356: "upnotifyps",
- 3357: "adtech-test",
- 3358: "mpsysrmsvr",
- 3359: "wg-netforce",
- 3360: "kv-server",
- 3361: "kv-agent",
- 3362: "dj-ilm",
- 3363: "nati-vi-server",
- 3364: "creativeserver",
- 3365: "contentserver",
- 3366: "creativepartnr",
- 3372: "tip2",
- 3373: "lavenir-lm",
- 3374: "cluster-disc",
- 3375: "vsnm-agent",
- 3376: "cdbroker",
- 3377: "cogsys-lm",
- 3378: "wsicopy",
- 3379: "socorfs",
- 3380: "sns-channels",
- 3381: "geneous",
- 3382: "fujitsu-neat",
- 3383: "esp-lm",
- 3384: "hp-clic",
- 3385: "qnxnetman",
- 3386: "gprs-sig",
- 3387: "backroomnet",
- 3388: "cbserver",
- 3389: "ms-wbt-server",
- 3390: "dsc",
- 3391: "savant",
- 3392: "efi-lm",
- 3393: "d2k-tapestry1",
- 3394: "d2k-tapestry2",
- 3395: "dyna-lm",
- 3396: "printer-agent",
- 3397: "cloanto-lm",
- 3398: "mercantile",
- 3399: "csms",
- 3400: "csms2",
- 3401: "filecast",
- 3402: "fxaengine-net",
- 3405: "nokia-ann-ch1",
- 3406: "nokia-ann-ch2",
- 3407: "ldap-admin",
- 3408: "BESApi",
- 3409: "networklens",
- 3410: "networklenss",
- 3411: "biolink-auth",
- 3412: "xmlblaster",
- 3413: "svnet",
- 3414: "wip-port",
- 3415: "bcinameservice",
- 3416: "commandport",
- 3417: "csvr",
- 3418: "rnmap",
- 3419: "softaudit",
- 3420: "ifcp-port",
- 3421: "bmap",
- 3422: "rusb-sys-port",
- 3423: "xtrm",
- 3424: "xtrms",
- 3425: "agps-port",
- 3426: "arkivio",
- 3427: "websphere-snmp",
- 3428: "twcss",
- 3429: "gcsp",
- 3430: "ssdispatch",
- 3431: "ndl-als",
- 3432: "osdcp",
- 3433: "opnet-smp",
- 3434: "opencm",
- 3435: "pacom",
- 3436: "gc-config",
- 3437: "autocueds",
- 3438: "spiral-admin",
- 3439: "hri-port",
- 3440: "ans-console",
- 3441: "connect-client",
- 3442: "connect-server",
- 3443: "ov-nnm-websrv",
- 3444: "denali-server",
- 3445: "monp",
- 3446: "3comfaxrpc",
- 3447: "directnet",
- 3448: "dnc-port",
- 3449: "hotu-chat",
- 3450: "castorproxy",
- 3451: "asam",
- 3452: "sabp-signal",
- 3453: "pscupd",
- 3454: "mira",
- 3455: "prsvp",
- 3456: "vat",
- 3457: "vat-control",
- 3458: "d3winosfi",
- 3459: "integral",
- 3460: "edm-manager",
- 3461: "edm-stager",
- 3462: "edm-std-notify",
- 3463: "edm-adm-notify",
- 3464: "edm-mgr-sync",
- 3465: "edm-mgr-cntrl",
- 3466: "workflow",
- 3467: "rcst",
- 3468: "ttcmremotectrl",
- 3469: "pluribus",
- 3470: "jt400",
- 3471: "jt400-ssl",
- 3472: "jaugsremotec-1",
- 3473: "jaugsremotec-2",
- 3474: "ttntspauto",
- 3475: "genisar-port",
- 3476: "nppmp",
- 3477: "ecomm",
- 3478: "stun",
- 3479: "twrpc",
- 3480: "plethora",
- 3481: "cleanerliverc",
- 3482: "vulture",
- 3483: "slim-devices",
- 3484: "gbs-stp",
- 3485: "celatalk",
- 3486: "ifsf-hb-port",
- 3487: "ltcudp",
- 3488: "fs-rh-srv",
- 3489: "dtp-dia",
- 3490: "colubris",
- 3491: "swr-port",
- 3492: "tvdumtray-port",
- 3493: "nut",
- 3494: "ibm3494",
- 3495: "seclayer-tcp",
- 3496: "seclayer-tls",
- 3497: "ipether232port",
- 3498: "dashpas-port",
- 3499: "sccip-media",
- 3500: "rtmp-port",
- 3501: "isoft-p2p",
- 3502: "avinstalldisc",
- 3503: "lsp-ping",
- 3504: "ironstorm",
- 3505: "ccmcomm",
- 3506: "apc-3506",
- 3507: "nesh-broker",
- 3508: "interactionweb",
- 3509: "vt-ssl",
- 3510: "xss-port",
- 3511: "webmail-2",
- 3512: "aztec",
- 3513: "arcpd",
- 3514: "must-p2p",
- 3515: "must-backplane",
- 3516: "smartcard-port",
- 3517: "802-11-iapp",
- 3518: "artifact-msg",
- 3519: "galileo",
- 3520: "galileolog",
- 3521: "mc3ss",
- 3522: "nssocketport",
- 3523: "odeumservlink",
- 3524: "ecmport",
- 3525: "eisport",
- 3526: "starquiz-port",
- 3527: "beserver-msg-q",
- 3528: "jboss-iiop",
- 3529: "jboss-iiop-ssl",
- 3530: "gf",
- 3531: "joltid",
- 3532: "raven-rmp",
- 3533: "raven-rdp",
- 3534: "urld-port",
- 3535: "ms-la",
- 3536: "snac",
- 3537: "ni-visa-remote",
- 3538: "ibm-diradm",
- 3539: "ibm-diradm-ssl",
- 3540: "pnrp-port",
- 3541: "voispeed-port",
- 3542: "hacl-monitor",
- 3543: "qftest-lookup",
- 3544: "teredo",
- 3545: "camac",
- 3547: "symantec-sim",
- 3548: "interworld",
- 3549: "tellumat-nms",
- 3550: "ssmpp",
- 3551: "apcupsd",
- 3552: "taserver",
- 3553: "rbr-discovery",
- 3554: "questnotify",
- 3555: "razor",
- 3556: "sky-transport",
- 3557: "personalos-001",
- 3558: "mcp-port",
- 3559: "cctv-port",
- 3560: "iniserve-port",
- 3561: "bmc-onekey",
- 3562: "sdbproxy",
- 3563: "watcomdebug",
- 3564: "esimport",
- 3567: "enc-eps",
- 3568: "enc-tunnel-sec",
- 3569: "mbg-ctrl",
- 3570: "mccwebsvr-port",
- 3571: "megardsvr-port",
- 3572: "megaregsvrport",
- 3573: "tag-ups-1",
- 3574: "dmaf-caster",
- 3575: "ccm-port",
- 3576: "cmc-port",
- 3577: "config-port",
- 3578: "data-port",
- 3579: "ttat3lb",
- 3580: "nati-svrloc",
- 3581: "kfxaclicensing",
- 3582: "press",
- 3583: "canex-watch",
- 3584: "u-dbap",
- 3585: "emprise-lls",
- 3586: "emprise-lsc",
- 3587: "p2pgroup",
- 3588: "sentinel",
- 3589: "isomair",
- 3590: "wv-csp-sms",
- 3591: "gtrack-server",
- 3592: "gtrack-ne",
- 3593: "bpmd",
- 3594: "mediaspace",
- 3595: "shareapp",
- 3596: "iw-mmogame",
- 3597: "a14",
- 3598: "a15",
- 3599: "quasar-server",
- 3600: "trap-daemon",
- 3601: "visinet-gui",
- 3602: "infiniswitchcl",
- 3603: "int-rcv-cntrl",
- 3604: "bmc-jmx-port",
- 3605: "comcam-io",
- 3606: "splitlock",
- 3607: "precise-i3",
- 3608: "trendchip-dcp",
- 3609: "cpdi-pidas-cm",
- 3610: "echonet",
- 3611: "six-degrees",
- 3612: "hp-dataprotect",
- 3613: "alaris-disc",
- 3614: "sigma-port",
- 3615: "start-network",
- 3616: "cd3o-protocol",
- 3617: "sharp-server",
- 3618: "aairnet-1",
- 3619: "aairnet-2",
- 3620: "ep-pcp",
- 3621: "ep-nsp",
- 3622: "ff-lr-port",
- 3623: "haipe-discover",
- 3624: "dist-upgrade",
- 3625: "volley",
- 3626: "bvcdaemon-port",
- 3627: "jamserverport",
- 3628: "ept-machine",
- 3629: "escvpnet",
- 3630: "cs-remote-db",
- 3631: "cs-services",
- 3632: "distcc",
- 3633: "wacp",
- 3634: "hlibmgr",
- 3635: "sdo",
- 3636: "servistaitsm",
- 3637: "scservp",
- 3638: "ehp-backup",
- 3639: "xap-ha",
- 3640: "netplay-port1",
- 3641: "netplay-port2",
- 3642: "juxml-port",
- 3643: "audiojuggler",
- 3644: "ssowatch",
- 3645: "cyc",
- 3646: "xss-srv-port",
- 3647: "splitlock-gw",
- 3648: "fjcp",
- 3649: "nmmp",
- 3650: "prismiq-plugin",
- 3651: "xrpc-registry",
- 3652: "vxcrnbuport",
- 3653: "tsp",
- 3654: "vaprtm",
- 3655: "abatemgr",
- 3656: "abatjss",
- 3657: "immedianet-bcn",
- 3658: "ps-ams",
- 3659: "apple-sasl",
- 3660: "can-nds-ssl",
- 3661: "can-ferret-ssl",
- 3662: "pserver",
- 3663: "dtp",
- 3664: "ups-engine",
- 3665: "ent-engine",
- 3666: "eserver-pap",
- 3667: "infoexch",
- 3668: "dell-rm-port",
- 3669: "casanswmgmt",
- 3670: "smile",
- 3671: "efcp",
- 3672: "lispworks-orb",
- 3673: "mediavault-gui",
- 3674: "wininstall-ipc",
- 3675: "calltrax",
- 3676: "va-pacbase",
- 3677: "roverlog",
- 3678: "ipr-dglt",
- 3679: "Escale (Newton Dock)",
- 3680: "npds-tracker",
- 3681: "bts-x73",
- 3682: "cas-mapi",
- 3683: "bmc-ea",
- 3684: "faxstfx-port",
- 3685: "dsx-agent",
- 3686: "tnmpv2",
- 3687: "simple-push",
- 3688: "simple-push-s",
- 3689: "daap",
- 3690: "svn",
- 3691: "magaya-network",
- 3692: "intelsync",
- 3695: "bmc-data-coll",
- 3696: "telnetcpcd",
- 3697: "nw-license",
- 3698: "sagectlpanel",
- 3699: "kpn-icw",
- 3700: "lrs-paging",
- 3701: "netcelera",
- 3702: "ws-discovery",
- 3703: "adobeserver-3",
- 3704: "adobeserver-4",
- 3705: "adobeserver-5",
- 3706: "rt-event",
- 3707: "rt-event-s",
- 3708: "sun-as-iiops",
- 3709: "ca-idms",
- 3710: "portgate-auth",
- 3711: "edb-server2",
- 3712: "sentinel-ent",
- 3713: "tftps",
- 3714: "delos-dms",
- 3715: "anoto-rendezv",
- 3716: "wv-csp-sms-cir",
- 3717: "wv-csp-udp-cir",
- 3718: "opus-services",
- 3719: "itelserverport",
- 3720: "ufastro-instr",
- 3721: "xsync",
- 3722: "xserveraid",
- 3723: "sychrond",
- 3724: "blizwow",
- 3725: "na-er-tip",
- 3726: "array-manager",
- 3727: "e-mdu",
- 3728: "e-woa",
- 3729: "fksp-audit",
- 3730: "client-ctrl",
- 3731: "smap",
- 3732: "m-wnn",
- 3733: "multip-msg",
- 3734: "synel-data",
- 3735: "pwdis",
- 3736: "rs-rmi",
- 3738: "versatalk",
- 3739: "launchbird-lm",
- 3740: "heartbeat",
- 3741: "wysdma",
- 3742: "cst-port",
- 3743: "ipcs-command",
- 3744: "sasg",
- 3745: "gw-call-port",
- 3746: "linktest",
- 3747: "linktest-s",
- 3748: "webdata",
- 3749: "cimtrak",
- 3750: "cbos-ip-port",
- 3751: "gprs-cube",
- 3752: "vipremoteagent",
- 3753: "nattyserver",
- 3754: "timestenbroker",
- 3755: "sas-remote-hlp",
- 3756: "canon-capt",
- 3757: "grf-port",
- 3758: "apw-registry",
- 3759: "exapt-lmgr",
- 3760: "adtempusclient",
- 3761: "gsakmp",
- 3762: "gbs-smp",
- 3763: "xo-wave",
- 3764: "mni-prot-rout",
- 3765: "rtraceroute",
- 3767: "listmgr-port",
- 3768: "rblcheckd",
- 3769: "haipe-otnk",
- 3770: "cindycollab",
- 3771: "paging-port",
- 3772: "ctp",
- 3773: "ctdhercules",
- 3774: "zicom",
- 3775: "ispmmgr",
- 3776: "dvcprov-port",
- 3777: "jibe-eb",
- 3778: "c-h-it-port",
- 3779: "cognima",
- 3780: "nnp",
- 3781: "abcvoice-port",
- 3782: "iso-tp0s",
- 3783: "bim-pem",
- 3784: "bfd-control",
- 3785: "bfd-echo",
- 3786: "upstriggervsw",
- 3787: "fintrx",
- 3788: "isrp-port",
- 3789: "remotedeploy",
- 3790: "quickbooksrds",
- 3791: "tvnetworkvideo",
- 3792: "sitewatch",
- 3793: "dcsoftware",
- 3794: "jaus",
- 3795: "myblast",
- 3796: "spw-dialer",
- 3797: "idps",
- 3798: "minilock",
- 3799: "radius-dynauth",
- 3800: "pwgpsi",
- 3801: "ibm-mgr",
- 3802: "vhd",
- 3803: "soniqsync",
- 3804: "iqnet-port",
- 3805: "tcpdataserver",
- 3806: "wsmlb",
- 3807: "spugna",
- 3808: "sun-as-iiops-ca",
- 3809: "apocd",
- 3810: "wlanauth",
- 3811: "amp",
- 3812: "neto-wol-server",
- 3813: "rap-ip",
- 3814: "neto-dcs",
- 3815: "lansurveyorxml",
- 3816: "sunlps-http",
- 3817: "tapeware",
- 3818: "crinis-hb",
- 3819: "epl-slp",
- 3820: "scp",
- 3821: "pmcp",
- 3822: "acp-discovery",
- 3823: "acp-conduit",
- 3824: "acp-policy",
- 3825: "ffserver",
- 3826: "warmux",
- 3827: "netmpi",
- 3828: "neteh",
- 3829: "neteh-ext",
- 3830: "cernsysmgmtagt",
- 3831: "dvapps",
- 3832: "xxnetserver",
- 3833: "aipn-auth",
- 3834: "spectardata",
- 3835: "spectardb",
- 3836: "markem-dcp",
- 3837: "mkm-discovery",
- 3838: "sos",
- 3839: "amx-rms",
- 3840: "flirtmitmir",
- 3842: "nhci",
- 3843: "quest-agent",
- 3844: "rnm",
- 3845: "v-one-spp",
- 3846: "an-pcp",
- 3847: "msfw-control",
- 3848: "item",
- 3849: "spw-dnspreload",
- 3850: "qtms-bootstrap",
- 3851: "spectraport",
- 3852: "sse-app-config",
- 3853: "sscan",
- 3854: "stryker-com",
- 3855: "opentrac",
- 3856: "informer",
- 3857: "trap-port",
- 3858: "trap-port-mom",
- 3859: "nav-port",
- 3860: "sasp",
- 3861: "winshadow-hd",
- 3862: "giga-pocket",
- 3863: "asap-udp",
- 3865: "xpl",
- 3866: "dzdaemon",
- 3867: "dzoglserver",
- 3869: "ovsam-mgmt",
- 3870: "ovsam-d-agent",
- 3871: "avocent-adsap",
- 3872: "oem-agent",
- 3873: "fagordnc",
- 3874: "sixxsconfig",
- 3875: "pnbscada",
- 3876: "dl-agent",
- 3877: "xmpcr-interface",
- 3878: "fotogcad",
- 3879: "appss-lm",
- 3880: "igrs",
- 3881: "idac",
- 3882: "msdts1",
- 3883: "vrpn",
- 3884: "softrack-meter",
- 3885: "topflow-ssl",
- 3886: "nei-management",
- 3887: "ciphire-data",
- 3888: "ciphire-serv",
- 3889: "dandv-tester",
- 3890: "ndsconnect",
- 3891: "rtc-pm-port",
- 3892: "pcc-image-port",
- 3893: "cgi-starapi",
- 3894: "syam-agent",
- 3895: "syam-smc",
- 3896: "sdo-tls",
- 3897: "sdo-ssh",
- 3898: "senip",
- 3899: "itv-control",
- 3900: "udt-os",
- 3901: "nimsh",
- 3902: "nimaux",
- 3903: "charsetmgr",
- 3904: "omnilink-port",
- 3905: "mupdate",
- 3906: "topovista-data",
- 3907: "imoguia-port",
- 3908: "hppronetman",
- 3909: "surfcontrolcpa",
- 3910: "prnrequest",
- 3911: "prnstatus",
- 3912: "gbmt-stars",
- 3913: "listcrt-port",
- 3914: "listcrt-port-2",
- 3915: "agcat",
- 3916: "wysdmc",
- 3917: "aftmux",
- 3918: "pktcablemmcops",
- 3919: "hyperip",
- 3920: "exasoftport1",
- 3921: "herodotus-net",
- 3922: "sor-update",
- 3923: "symb-sb-port",
- 3924: "mpl-gprs-port",
- 3925: "zmp",
- 3926: "winport",
- 3927: "natdataservice",
- 3928: "netboot-pxe",
- 3929: "smauth-port",
- 3930: "syam-webserver",
- 3931: "msr-plugin-port",
- 3932: "dyn-site",
- 3933: "plbserve-port",
- 3934: "sunfm-port",
- 3935: "sdp-portmapper",
- 3936: "mailprox",
- 3937: "dvbservdsc",
- 3938: "dbcontrol-agent",
- 3939: "aamp",
- 3940: "xecp-node",
- 3941: "homeportal-web",
- 3942: "srdp",
- 3943: "tig",
- 3944: "sops",
- 3945: "emcads",
- 3946: "backupedge",
- 3947: "ccp",
- 3948: "apdap",
- 3949: "drip",
- 3950: "namemunge",
- 3951: "pwgippfax",
- 3952: "i3-sessionmgr",
- 3953: "xmlink-connect",
- 3954: "adrep",
- 3955: "p2pcommunity",
- 3956: "gvcp",
- 3957: "mqe-broker",
- 3958: "mqe-agent",
- 3959: "treehopper",
- 3960: "bess",
- 3961: "proaxess",
- 3962: "sbi-agent",
- 3963: "thrp",
- 3964: "sasggprs",
- 3965: "ati-ip-to-ncpe",
- 3966: "bflckmgr",
- 3967: "ppsms",
- 3968: "ianywhere-dbns",
- 3969: "landmarks",
- 3970: "lanrevagent",
- 3971: "lanrevserver",
- 3972: "iconp",
- 3973: "progistics",
- 3974: "citysearch",
- 3975: "airshot",
- 3976: "opswagent",
- 3977: "opswmanager",
- 3978: "secure-cfg-svr",
- 3979: "smwan",
- 3980: "acms",
- 3981: "starfish",
- 3982: "eis",
- 3983: "eisp",
- 3984: "mapper-nodemgr",
- 3985: "mapper-mapethd",
- 3986: "mapper-ws-ethd",
- 3987: "centerline",
- 3988: "dcs-config",
- 3989: "bv-queryengine",
- 3990: "bv-is",
- 3991: "bv-smcsrv",
- 3992: "bv-ds",
- 3993: "bv-agent",
- 3995: "iss-mgmt-ssl",
- 3996: "abcsoftware",
- 3997: "agentsease-db",
- 3998: "dnx",
- 3999: "nvcnet",
- 4000: "terabase",
- 4001: "newoak",
- 4002: "pxc-spvr-ft",
- 4003: "pxc-splr-ft",
- 4004: "pxc-roid",
- 4005: "pxc-pin",
- 4006: "pxc-spvr",
- 4007: "pxc-splr",
- 4008: "netcheque",
- 4009: "chimera-hwm",
- 4010: "samsung-unidex",
- 4011: "altserviceboot",
- 4012: "pda-gate",
- 4013: "acl-manager",
- 4014: "taiclock",
- 4015: "talarian-mcast1",
- 4016: "talarian-mcast2",
- 4017: "talarian-mcast3",
- 4018: "talarian-mcast4",
- 4019: "talarian-mcast5",
- 4020: "trap",
- 4021: "nexus-portal",
- 4022: "dnox",
- 4023: "esnm-zoning",
- 4024: "tnp1-port",
- 4025: "partimage",
- 4026: "as-debug",
- 4027: "bxp",
- 4028: "dtserver-port",
- 4029: "ip-qsig",
- 4030: "jdmn-port",
- 4031: "suucp",
- 4032: "vrts-auth-port",
- 4033: "sanavigator",
- 4034: "ubxd",
- 4035: "wap-push-http",
- 4036: "wap-push-https",
- 4037: "ravehd",
- 4038: "fazzt-ptp",
- 4039: "fazzt-admin",
- 4040: "yo-main",
- 4041: "houston",
- 4042: "ldxp",
- 4043: "nirp",
- 4044: "ltp",
- 4045: "npp",
- 4046: "acp-proto",
- 4047: "ctp-state",
- 4049: "wafs",
- 4050: "cisco-wafs",
- 4051: "cppdp",
- 4052: "interact",
- 4053: "ccu-comm-1",
- 4054: "ccu-comm-2",
- 4055: "ccu-comm-3",
- 4056: "lms",
- 4057: "wfm",
- 4058: "kingfisher",
- 4059: "dlms-cosem",
- 4060: "dsmeter-iatc",
- 4061: "ice-location",
- 4062: "ice-slocation",
- 4063: "ice-router",
- 4064: "ice-srouter",
- 4065: "avanti-cdp",
- 4066: "pmas",
- 4067: "idp",
- 4068: "ipfltbcst",
- 4069: "minger",
- 4070: "tripe",
- 4071: "aibkup",
- 4072: "zieto-sock",
- 4073: "iRAPP",
- 4074: "cequint-cityid",
- 4075: "perimlan",
- 4076: "seraph",
- 4077: "ascomalarm",
- 4079: "santools",
- 4080: "lorica-in",
- 4081: "lorica-in-sec",
- 4082: "lorica-out",
- 4083: "lorica-out-sec",
- 4084: "fortisphere-vm",
- 4086: "ftsync",
- 4089: "opencore",
- 4090: "omasgport",
- 4091: "ewinstaller",
- 4092: "ewdgs",
- 4093: "pvxpluscs",
- 4094: "sysrqd",
- 4095: "xtgui",
- 4096: "bre",
- 4097: "patrolview",
- 4098: "drmsfsd",
- 4099: "dpcp",
- 4100: "igo-incognito",
- 4101: "brlp-0",
- 4102: "brlp-1",
- 4103: "brlp-2",
- 4104: "brlp-3",
- 4105: "shofar",
- 4106: "synchronite",
- 4107: "j-ac",
- 4108: "accel",
- 4109: "izm",
- 4110: "g2tag",
- 4111: "xgrid",
- 4112: "apple-vpns-rp",
- 4113: "aipn-reg",
- 4114: "jomamqmonitor",
- 4115: "cds",
- 4116: "smartcard-tls",
- 4117: "hillrserv",
- 4118: "netscript",
- 4119: "assuria-slm",
- 4121: "e-builder",
- 4122: "fprams",
- 4123: "z-wave",
- 4124: "tigv2",
- 4125: "opsview-envoy",
- 4126: "ddrepl",
- 4127: "unikeypro",
- 4128: "nufw",
- 4129: "nuauth",
- 4130: "fronet",
- 4131: "stars",
- 4132: "nuts-dem",
- 4133: "nuts-bootp",
- 4134: "nifty-hmi",
- 4135: "cl-db-attach",
- 4136: "cl-db-request",
- 4137: "cl-db-remote",
- 4138: "nettest",
- 4139: "thrtx",
- 4140: "cedros-fds",
- 4141: "oirtgsvc",
- 4142: "oidocsvc",
- 4143: "oidsr",
- 4145: "vvr-control",
- 4146: "tgcconnect",
- 4147: "vrxpservman",
- 4148: "hhb-handheld",
- 4149: "agslb",
- 4150: "PowerAlert-nsa",
- 4151: "menandmice-noh",
- 4152: "idig-mux",
- 4153: "mbl-battd",
- 4154: "atlinks",
- 4155: "bzr",
- 4156: "stat-results",
- 4157: "stat-scanner",
- 4158: "stat-cc",
- 4159: "nss",
- 4160: "jini-discovery",
- 4161: "omscontact",
- 4162: "omstopology",
- 4163: "silverpeakpeer",
- 4164: "silverpeakcomm",
- 4165: "altcp",
- 4166: "joost",
- 4167: "ddgn",
- 4168: "pslicser",
- 4169: "iadt-disc",
- 4172: "pcoip",
- 4173: "mma-discovery",
- 4174: "sm-disc",
- 4177: "wello",
- 4178: "storman",
- 4179: "MaxumSP",
- 4180: "httpx",
- 4181: "macbak",
- 4182: "pcptcpservice",
- 4183: "gmmp",
- 4184: "universe-suite",
- 4185: "wcpp",
- 4188: "vatata",
- 4191: "dsmipv6",
- 4192: "azeti-bd",
- 4199: "eims-admin",
- 4300: "corelccam",
- 4301: "d-data",
- 4302: "d-data-control",
- 4303: "srcp",
- 4304: "owserver",
- 4305: "batman",
- 4306: "pinghgl",
- 4307: "visicron-vs",
- 4308: "compx-lockview",
- 4309: "dserver",
- 4310: "mirrtex",
- 4320: "fdt-rcatp",
- 4321: "rwhois",
- 4322: "trim-event",
- 4323: "trim-ice",
- 4324: "balour",
- 4325: "geognosisman",
- 4326: "geognosis",
- 4327: "jaxer-web",
- 4328: "jaxer-manager",
- 4333: "ahsp",
- 4340: "gaia",
- 4341: "lisp-data",
- 4342: "lisp-control",
- 4343: "unicall",
- 4344: "vinainstall",
- 4345: "m4-network-as",
- 4346: "elanlm",
- 4347: "lansurveyor",
- 4348: "itose",
- 4349: "fsportmap",
- 4350: "net-device",
- 4351: "plcy-net-svcs",
- 4352: "pjlink",
- 4353: "f5-iquery",
- 4354: "qsnet-trans",
- 4355: "qsnet-workst",
- 4356: "qsnet-assist",
- 4357: "qsnet-cond",
- 4358: "qsnet-nucl",
- 4359: "omabcastltkm",
- 4361: "nacnl",
- 4362: "afore-vdp-disc",
- 4368: "wxbrief",
- 4369: "epmd",
- 4370: "elpro-tunnel",
- 4371: "l2c-disc",
- 4372: "l2c-data",
- 4373: "remctl",
- 4375: "tolteces",
- 4376: "bip",
- 4377: "cp-spxsvr",
- 4378: "cp-spxdpy",
- 4379: "ctdb",
- 4389: "xandros-cms",
- 4390: "wiegand",
- 4394: "apwi-disc",
- 4395: "omnivisionesx",
- 4400: "ds-srv",
- 4401: "ds-srvr",
- 4402: "ds-clnt",
- 4403: "ds-user",
- 4404: "ds-admin",
- 4405: "ds-mail",
- 4406: "ds-slp",
- 4425: "netrockey6",
- 4426: "beacon-port-2",
- 4430: "rsqlserver",
- 4432: "l-acoustics",
- 4441: "netblox",
- 4442: "saris",
- 4443: "pharos",
- 4444: "krb524",
- 4445: "upnotifyp",
- 4446: "n1-fwp",
- 4447: "n1-rmgmt",
- 4448: "asc-slmd",
- 4449: "privatewire",
- 4450: "camp",
- 4451: "ctisystemmsg",
- 4452: "ctiprogramload",
- 4453: "nssalertmgr",
- 4454: "nssagentmgr",
- 4455: "prchat-user",
- 4456: "prchat-server",
- 4457: "prRegister",
- 4458: "mcp",
- 4484: "hpssmgmt",
- 4486: "icms",
- 4488: "awacs-ice",
- 4500: "ipsec-nat-t",
- 4534: "armagetronad",
- 4535: "ehs",
- 4536: "ehs-ssl",
- 4537: "wssauthsvc",
- 4538: "swx-gate",
- 4545: "worldscores",
- 4546: "sf-lm",
- 4547: "lanner-lm",
- 4548: "synchromesh",
- 4549: "aegate",
- 4550: "gds-adppiw-db",
- 4551: "ieee-mih",
- 4552: "menandmice-mon",
- 4554: "msfrs",
- 4555: "rsip",
- 4556: "dtn-bundle",
- 4557: "mtcevrunqss",
- 4558: "mtcevrunqman",
- 4559: "hylafax",
- 4566: "kwtc",
- 4567: "tram",
- 4568: "bmc-reporting",
- 4569: "iax",
- 4591: "l3t-at-an",
- 4592: "hrpd-ith-at-an",
- 4593: "ipt-anri-anri",
- 4594: "ias-session",
- 4595: "ias-paging",
- 4596: "ias-neighbor",
- 4597: "a21-an-1xbs",
- 4598: "a16-an-an",
- 4599: "a17-an-an",
- 4600: "piranha1",
- 4601: "piranha2",
- 4658: "playsta2-app",
- 4659: "playsta2-lob",
- 4660: "smaclmgr",
- 4661: "kar2ouche",
- 4662: "oms",
- 4663: "noteit",
- 4664: "ems",
- 4665: "contclientms",
- 4666: "eportcomm",
- 4667: "mmacomm",
- 4668: "mmaeds",
- 4669: "eportcommdata",
- 4670: "light",
- 4671: "acter",
- 4672: "rfa",
- 4673: "cxws",
- 4674: "appiq-mgmt",
- 4675: "dhct-status",
- 4676: "dhct-alerts",
- 4677: "bcs",
- 4678: "traversal",
- 4679: "mgesupervision",
- 4680: "mgemanagement",
- 4681: "parliant",
- 4682: "finisar",
- 4683: "spike",
- 4684: "rfid-rp1",
- 4685: "autopac",
- 4686: "msp-os",
- 4687: "nst",
- 4688: "mobile-p2p",
- 4689: "altovacentral",
- 4690: "prelude",
- 4691: "mtn",
- 4692: "conspiracy",
- 4700: "netxms-agent",
- 4701: "netxms-mgmt",
- 4702: "netxms-sync",
- 4725: "truckstar",
- 4726: "a26-fap-fgw",
- 4727: "fcis-disc",
- 4728: "capmux",
- 4729: "gsmtap",
- 4730: "gearman",
- 4732: "ohmtrigger",
- 4737: "ipdr-sp",
- 4738: "solera-lpn",
- 4739: "ipfix",
- 4740: "ipfixs",
- 4741: "lumimgrd",
- 4742: "sicct-sdp",
- 4743: "openhpid",
- 4744: "ifsp",
- 4745: "fmp",
- 4747: "buschtrommel",
- 4749: "profilemac",
- 4750: "ssad",
- 4751: "spocp",
- 4752: "snap",
- 4753: "simon-disc",
- 4784: "bfd-multi-ctl",
- 4785: "cncp",
- 4789: "vxlan",
- 4790: "vxlan-gpe",
- 4800: "iims",
- 4801: "iwec",
- 4802: "ilss",
- 4803: "notateit-disc",
- 4804: "aja-ntv4-disc",
- 4827: "htcp",
- 4837: "varadero-0",
- 4838: "varadero-1",
- 4839: "varadero-2",
- 4840: "opcua-udp",
- 4841: "quosa",
- 4842: "gw-asv",
- 4843: "opcua-tls",
- 4844: "gw-log",
- 4845: "wcr-remlib",
- 4846: "contamac-icm",
- 4847: "wfc",
- 4848: "appserv-http",
- 4849: "appserv-https",
- 4850: "sun-as-nodeagt",
- 4851: "derby-repli",
- 4867: "unify-debug",
- 4868: "phrelay",
- 4869: "phrelaydbg",
- 4870: "cc-tracking",
- 4871: "wired",
- 4876: "tritium-can",
- 4877: "lmcs",
- 4878: "inst-discovery",
- 4881: "socp-t",
- 4882: "socp-c",
- 4884: "hivestor",
- 4885: "abbs",
- 4894: "lyskom",
- 4899: "radmin-port",
- 4900: "hfcs",
- 4914: "bones",
- 4936: "an-signaling",
- 4937: "atsc-mh-ssc",
- 4940: "eq-office-4940",
- 4941: "eq-office-4941",
- 4942: "eq-office-4942",
- 4949: "munin",
- 4950: "sybasesrvmon",
- 4951: "pwgwims",
- 4952: "sagxtsds",
- 4969: "ccss-qmm",
- 4970: "ccss-qsm",
- 4986: "mrip",
- 4987: "smar-se-port1",
- 4988: "smar-se-port2",
- 4989: "parallel",
- 4990: "busycal",
- 4991: "vrt",
- 4999: "hfcs-manager",
- 5000: "commplex-main",
- 5001: "commplex-link",
- 5002: "rfe",
- 5003: "fmpro-internal",
- 5004: "avt-profile-1",
- 5005: "avt-profile-2",
- 5006: "wsm-server",
- 5007: "wsm-server-ssl",
- 5008: "synapsis-edge",
- 5009: "winfs",
- 5010: "telelpathstart",
- 5011: "telelpathattack",
- 5012: "nsp",
- 5013: "fmpro-v6",
- 5014: "onpsocket",
- 5020: "zenginkyo-1",
- 5021: "zenginkyo-2",
- 5022: "mice",
- 5023: "htuilsrv",
- 5024: "scpi-telnet",
- 5025: "scpi-raw",
- 5026: "strexec-d",
- 5027: "strexec-s",
- 5029: "infobright",
- 5030: "surfpass",
- 5031: "dmp",
- 5042: "asnaacceler8db",
- 5043: "swxadmin",
- 5044: "lxi-evntsvc",
- 5046: "vpm-udp",
- 5047: "iscape",
- 5049: "ivocalize",
- 5050: "mmcc",
- 5051: "ita-agent",
- 5052: "ita-manager",
- 5053: "rlm-disc",
- 5055: "unot",
- 5056: "intecom-ps1",
- 5057: "intecom-ps2",
- 5058: "locus-disc",
- 5059: "sds",
- 5060: "sip",
- 5061: "sips",
- 5062: "na-localise",
- 5064: "ca-1",
- 5065: "ca-2",
- 5066: "stanag-5066",
- 5067: "authentx",
- 5069: "i-net-2000-npr",
- 5070: "vtsas",
- 5071: "powerschool",
- 5072: "ayiya",
- 5073: "tag-pm",
- 5074: "alesquery",
- 5078: "pixelpusher",
- 5079: "cp-spxrpts",
- 5080: "onscreen",
- 5081: "sdl-ets",
- 5082: "qcp",
- 5083: "qfp",
- 5084: "llrp",
- 5085: "encrypted-llrp",
- 5092: "magpie",
- 5093: "sentinel-lm",
- 5094: "hart-ip",
- 5099: "sentlm-srv2srv",
- 5100: "socalia",
- 5101: "talarian-udp",
- 5102: "oms-nonsecure",
- 5104: "tinymessage",
- 5105: "hughes-ap",
- 5111: "taep-as-svc",
- 5112: "pm-cmdsvr",
- 5116: "emb-proj-cmd",
- 5120: "barracuda-bbs",
- 5133: "nbt-pc",
- 5136: "minotaur-sa",
- 5137: "ctsd",
- 5145: "rmonitor-secure",
- 5150: "atmp",
- 5151: "esri-sde",
- 5152: "sde-discovery",
- 5154: "bzflag",
- 5155: "asctrl-agent",
- 5164: "vpa-disc",
- 5165: "ife-icorp",
- 5166: "winpcs",
- 5167: "scte104",
- 5168: "scte30",
- 5190: "aol",
- 5191: "aol-1",
- 5192: "aol-2",
- 5193: "aol-3",
- 5200: "targus-getdata",
- 5201: "targus-getdata1",
- 5202: "targus-getdata2",
- 5203: "targus-getdata3",
- 5223: "hpvirtgrp",
- 5224: "hpvirtctrl",
- 5225: "hp-server",
- 5226: "hp-status",
- 5227: "perfd",
- 5234: "eenet",
- 5235: "galaxy-network",
- 5236: "padl2sim",
- 5237: "mnet-discovery",
- 5245: "downtools-disc",
- 5246: "capwap-control",
- 5247: "capwap-data",
- 5248: "caacws",
- 5249: "caaclang2",
- 5250: "soagateway",
- 5251: "caevms",
- 5252: "movaz-ssc",
- 5264: "3com-njack-1",
- 5265: "3com-njack-2",
- 5270: "cartographerxmp",
- 5271: "cuelink-disc",
- 5272: "pk",
- 5282: "transmit-port",
- 5298: "presence",
- 5299: "nlg-data",
- 5300: "hacl-hb",
- 5301: "hacl-gs",
- 5302: "hacl-cfg",
- 5303: "hacl-probe",
- 5304: "hacl-local",
- 5305: "hacl-test",
- 5306: "sun-mc-grp",
- 5307: "sco-aip",
- 5308: "cfengine",
- 5309: "jprinter",
- 5310: "outlaws",
- 5312: "permabit-cs",
- 5313: "rrdp",
- 5314: "opalis-rbt-ipc",
- 5315: "hacl-poll",
- 5343: "kfserver",
- 5344: "xkotodrcp",
- 5349: "stuns",
- 5350: "pcp-multicast",
- 5351: "pcp",
- 5352: "dns-llq",
- 5353: "mdns",
- 5354: "mdnsresponder",
- 5355: "llmnr",
- 5356: "ms-smlbiz",
- 5357: "wsdapi",
- 5358: "wsdapi-s",
- 5359: "ms-alerter",
- 5360: "ms-sideshow",
- 5361: "ms-s-sideshow",
- 5362: "serverwsd2",
- 5363: "net-projection",
- 5364: "kdnet",
- 5397: "stresstester",
- 5398: "elektron-admin",
- 5399: "securitychase",
- 5400: "excerpt",
- 5401: "excerpts",
- 5402: "mftp",
- 5403: "hpoms-ci-lstn",
- 5404: "hpoms-dps-lstn",
- 5405: "netsupport",
- 5406: "systemics-sox",
- 5407: "foresyte-clear",
- 5408: "foresyte-sec",
- 5409: "salient-dtasrv",
- 5410: "salient-usrmgr",
- 5411: "actnet",
- 5412: "continuus",
- 5413: "wwiotalk",
- 5414: "statusd",
- 5415: "ns-server",
- 5416: "sns-gateway",
- 5417: "sns-agent",
- 5418: "mcntp",
- 5419: "dj-ice",
- 5420: "cylink-c",
- 5421: "netsupport2",
- 5422: "salient-mux",
- 5423: "virtualuser",
- 5424: "beyond-remote",
- 5425: "br-channel",
- 5426: "devbasic",
- 5427: "sco-peer-tta",
- 5428: "telaconsole",
- 5429: "base",
- 5430: "radec-corp",
- 5431: "park-agent",
- 5432: "postgresql",
- 5433: "pyrrho",
- 5434: "sgi-arrayd",
- 5435: "sceanics",
- 5436: "pmip6-cntl",
- 5437: "pmip6-data",
- 5443: "spss",
- 5453: "surebox",
- 5454: "apc-5454",
- 5455: "apc-5455",
- 5456: "apc-5456",
- 5461: "silkmeter",
- 5462: "ttl-publisher",
- 5463: "ttlpriceproxy",
- 5464: "quailnet",
- 5465: "netops-broker",
- 5500: "fcp-addr-srvr1",
- 5501: "fcp-addr-srvr2",
- 5502: "fcp-srvr-inst1",
- 5503: "fcp-srvr-inst2",
- 5504: "fcp-cics-gw1",
- 5505: "checkoutdb",
- 5506: "amc",
- 5553: "sgi-eventmond",
- 5554: "sgi-esphttp",
- 5555: "personal-agent",
- 5556: "freeciv",
- 5567: "enc-eps-mc-sec",
- 5568: "sdt",
- 5569: "rdmnet-device",
- 5573: "sdmmp",
- 5580: "tmosms0",
- 5581: "tmosms1",
- 5582: "fac-restore",
- 5583: "tmo-icon-sync",
- 5584: "bis-web",
- 5585: "bis-sync",
- 5597: "ininmessaging",
- 5598: "mctfeed",
- 5599: "esinstall",
- 5600: "esmmanager",
- 5601: "esmagent",
- 5602: "a1-msc",
- 5603: "a1-bs",
- 5604: "a3-sdunode",
- 5605: "a4-sdunode",
- 5627: "ninaf",
- 5628: "htrust",
- 5629: "symantec-sfdb",
- 5630: "precise-comm",
- 5631: "pcanywheredata",
- 5632: "pcanywherestat",
- 5633: "beorl",
- 5634: "xprtld",
- 5670: "zre-disc",
- 5671: "amqps",
- 5672: "amqp",
- 5673: "jms",
- 5674: "hyperscsi-port",
- 5675: "v5ua",
- 5676: "raadmin",
- 5677: "questdb2-lnchr",
- 5678: "rrac",
- 5679: "dccm",
- 5680: "auriga-router",
- 5681: "ncxcp",
- 5682: "brightcore",
- 5683: "coap",
- 5684: "coaps",
- 5687: "gog-multiplayer",
- 5688: "ggz",
- 5689: "qmvideo",
- 5713: "proshareaudio",
- 5714: "prosharevideo",
- 5715: "prosharedata",
- 5716: "prosharerequest",
- 5717: "prosharenotify",
- 5718: "dpm",
- 5719: "dpm-agent",
- 5720: "ms-licensing",
- 5721: "dtpt",
- 5722: "msdfsr",
- 5723: "omhs",
- 5724: "omsdk",
- 5728: "io-dist-group",
- 5729: "openmail",
- 5730: "unieng",
- 5741: "ida-discover1",
- 5742: "ida-discover2",
- 5743: "watchdoc-pod",
- 5744: "watchdoc",
- 5745: "fcopy-server",
- 5746: "fcopys-server",
- 5747: "tunatic",
- 5748: "tunalyzer",
- 5750: "rscd",
- 5755: "openmailg",
- 5757: "x500ms",
- 5766: "openmailns",
- 5767: "s-openmail",
- 5768: "openmailpxy",
- 5769: "spramsca",
- 5770: "spramsd",
- 5771: "netagent",
- 5777: "dali-port",
- 5781: "3par-evts",
- 5782: "3par-mgmt",
- 5783: "3par-mgmt-ssl",
- 5784: "ibar",
- 5785: "3par-rcopy",
- 5786: "cisco-redu",
- 5787: "waascluster",
- 5793: "xtreamx",
- 5794: "spdp",
- 5813: "icmpd",
- 5814: "spt-automation",
- 5859: "wherehoo",
- 5863: "ppsuitemsg",
- 5900: "rfb",
- 5910: "cm",
- 5911: "cpdlc",
- 5912: "fis",
- 5913: "ads-c",
- 5963: "indy",
- 5968: "mppolicy-v5",
- 5969: "mppolicy-mgr",
- 5984: "couchdb",
- 5985: "wsman",
- 5986: "wsmans",
- 5987: "wbem-rmi",
- 5988: "wbem-http",
- 5989: "wbem-https",
- 5990: "wbem-exp-https",
- 5991: "nuxsl",
- 5992: "consul-insight",
- 5999: "cvsup",
- 6064: "ndl-ahp-svc",
- 6065: "winpharaoh",
- 6066: "ewctsp",
- 6069: "trip",
- 6070: "messageasap",
- 6071: "ssdtp",
- 6072: "diagnose-proc",
- 6073: "directplay8",
- 6074: "max",
- 6081: "geneve",
- 6082: "p25cai",
- 6083: "miami-bcast",
- 6085: "konspire2b",
- 6086: "pdtp",
- 6087: "ldss",
- 6088: "doglms-notify",
- 6100: "synchronet-db",
- 6101: "synchronet-rtc",
- 6102: "synchronet-upd",
- 6103: "rets",
- 6104: "dbdb",
- 6105: "primaserver",
- 6106: "mpsserver",
- 6107: "etc-control",
- 6108: "sercomm-scadmin",
- 6109: "globecast-id",
- 6110: "softcm",
- 6111: "spc",
- 6112: "dtspcd",
- 6118: "tipc",
- 6122: "bex-webadmin",
- 6123: "backup-express",
- 6124: "pnbs",
- 6133: "nbt-wol",
- 6140: "pulsonixnls",
- 6141: "meta-corp",
- 6142: "aspentec-lm",
- 6143: "watershed-lm",
- 6144: "statsci1-lm",
- 6145: "statsci2-lm",
- 6146: "lonewolf-lm",
- 6147: "montage-lm",
- 6148: "ricardo-lm",
- 6149: "tal-pod",
- 6160: "ecmp-data",
- 6161: "patrol-ism",
- 6162: "patrol-coll",
- 6163: "pscribe",
- 6200: "lm-x",
- 6201: "thermo-calc",
- 6222: "radmind",
- 6241: "jeol-nsddp-1",
- 6242: "jeol-nsddp-2",
- 6243: "jeol-nsddp-3",
- 6244: "jeol-nsddp-4",
- 6251: "tl1-raw-ssl",
- 6252: "tl1-ssh",
- 6253: "crip",
- 6268: "grid",
- 6269: "grid-alt",
- 6300: "bmc-grx",
- 6301: "bmc-ctd-ldap",
- 6306: "ufmp",
- 6315: "scup-disc",
- 6316: "abb-escp",
- 6317: "nav-data",
- 6320: "repsvc",
- 6321: "emp-server1",
- 6322: "emp-server2",
- 6324: "hrd-ns-disc",
- 6343: "sflow",
- 6346: "gnutella-svc",
- 6347: "gnutella-rtr",
- 6350: "adap",
- 6355: "pmcs",
- 6360: "metaedit-mu",
- 6363: "ndn",
- 6370: "metaedit-se",
- 6382: "metatude-mds",
- 6389: "clariion-evr01",
- 6390: "metaedit-ws",
- 6417: "faxcomservice",
- 6420: "nim-vdrshell",
- 6421: "nim-wan",
- 6443: "sun-sr-https",
- 6444: "sge-qmaster",
- 6445: "sge-execd",
- 6446: "mysql-proxy",
- 6455: "skip-cert-recv",
- 6456: "skip-cert-send",
- 6471: "lvision-lm",
- 6480: "sun-sr-http",
- 6481: "servicetags",
- 6482: "ldoms-mgmt",
- 6483: "SunVTS-RMI",
- 6484: "sun-sr-jms",
- 6485: "sun-sr-iiop",
- 6486: "sun-sr-iiops",
- 6487: "sun-sr-iiop-aut",
- 6488: "sun-sr-jmx",
- 6489: "sun-sr-admin",
- 6500: "boks",
- 6501: "boks-servc",
- 6502: "boks-servm",
- 6503: "boks-clntd",
- 6505: "badm-priv",
- 6506: "badm-pub",
- 6507: "bdir-priv",
- 6508: "bdir-pub",
- 6509: "mgcs-mfp-port",
- 6510: "mcer-port",
- 6511: "dccp-udp",
- 6514: "syslog-tls",
- 6515: "elipse-rec",
- 6543: "lds-distrib",
- 6544: "lds-dump",
- 6547: "apc-6547",
- 6548: "apc-6548",
- 6549: "apc-6549",
- 6550: "fg-sysupdate",
- 6551: "sum",
- 6558: "xdsxdm",
- 6566: "sane-port",
- 6568: "rp-reputation",
- 6579: "affiliate",
- 6580: "parsec-master",
- 6581: "parsec-peer",
- 6582: "parsec-game",
- 6583: "joaJewelSuite",
- 6619: "odette-ftps",
- 6620: "kftp-data",
- 6621: "kftp",
- 6622: "mcftp",
- 6623: "ktelnet",
- 6626: "wago-service",
- 6627: "nexgen",
- 6628: "afesc-mc",
- 6633: "cisco-vpath-tun",
- 6634: "mpls-pm",
- 6653: "openflow",
- 6657: "palcom-disc",
- 6670: "vocaltec-gold",
- 6671: "p4p-portal",
- 6672: "vision-server",
- 6673: "vision-elmd",
- 6678: "vfbp-disc",
- 6679: "osaut",
- 6689: "tsa",
- 6696: "babel",
- 6701: "kti-icad-srvr",
- 6702: "e-design-net",
- 6703: "e-design-web",
- 6714: "ibprotocol",
- 6715: "fibotrader-com",
- 6767: "bmc-perf-agent",
- 6768: "bmc-perf-mgrd",
- 6769: "adi-gxp-srvprt",
- 6770: "plysrv-http",
- 6771: "plysrv-https",
- 6784: "bfd-lag",
- 6785: "dgpf-exchg",
- 6786: "smc-jmx",
- 6787: "smc-admin",
- 6788: "smc-http",
- 6789: "smc-https",
- 6790: "hnmp",
- 6791: "hnm",
- 6801: "acnet",
- 6831: "ambit-lm",
- 6841: "netmo-default",
- 6842: "netmo-http",
- 6850: "iccrushmore",
- 6868: "acctopus-st",
- 6888: "muse",
- 6935: "ethoscan",
- 6936: "xsmsvc",
- 6946: "bioserver",
- 6951: "otlp",
- 6961: "jmact3",
- 6962: "jmevt2",
- 6963: "swismgr1",
- 6964: "swismgr2",
- 6965: "swistrap",
- 6966: "swispol",
- 6969: "acmsoda",
- 6997: "MobilitySrv",
- 6998: "iatp-highpri",
- 6999: "iatp-normalpri",
- 7000: "afs3-fileserver",
- 7001: "afs3-callback",
- 7002: "afs3-prserver",
- 7003: "afs3-vlserver",
- 7004: "afs3-kaserver",
- 7005: "afs3-volser",
- 7006: "afs3-errors",
- 7007: "afs3-bos",
- 7008: "afs3-update",
- 7009: "afs3-rmtsys",
- 7010: "ups-onlinet",
- 7011: "talon-disc",
- 7012: "talon-engine",
- 7013: "microtalon-dis",
- 7014: "microtalon-com",
- 7015: "talon-webserver",
- 7019: "doceri-view",
- 7020: "dpserve",
- 7021: "dpserveadmin",
- 7022: "ctdp",
- 7023: "ct2nmcs",
- 7024: "vmsvc",
- 7025: "vmsvc-2",
- 7030: "op-probe",
- 7040: "quest-disc",
- 7070: "arcp",
- 7071: "iwg1",
- 7080: "empowerid",
- 7095: "jdp-disc",
- 7099: "lazy-ptop",
- 7100: "font-service",
- 7101: "elcn",
- 7107: "aes-x170",
- 7121: "virprot-lm",
- 7128: "scenidm",
- 7129: "scenccs",
- 7161: "cabsm-comm",
- 7162: "caistoragemgr",
- 7163: "cacsambroker",
- 7164: "fsr",
- 7165: "doc-server",
- 7166: "aruba-server",
- 7169: "ccag-pib",
- 7170: "nsrp",
- 7171: "drm-production",
- 7174: "clutild",
- 7181: "janus-disc",
- 7200: "fodms",
- 7201: "dlip",
- 7227: "ramp",
- 7235: "aspcoordination",
- 7262: "cnap",
- 7272: "watchme-7272",
- 7273: "oma-rlp",
- 7274: "oma-rlp-s",
- 7275: "oma-ulp",
- 7276: "oma-ilp",
- 7277: "oma-ilp-s",
- 7278: "oma-dcdocbs",
- 7279: "ctxlic",
- 7280: "itactionserver1",
- 7281: "itactionserver2",
- 7282: "mzca-alert",
- 7365: "lcm-server",
- 7391: "mindfilesys",
- 7392: "mrssrendezvous",
- 7393: "nfoldman",
- 7394: "fse",
- 7395: "winqedit",
- 7397: "hexarc",
- 7400: "rtps-discovery",
- 7401: "rtps-dd-ut",
- 7402: "rtps-dd-mt",
- 7410: "ionixnetmon",
- 7411: "daqstream",
- 7421: "mtportmon",
- 7426: "pmdmgr",
- 7427: "oveadmgr",
- 7428: "ovladmgr",
- 7429: "opi-sock",
- 7430: "xmpv7",
- 7431: "pmd",
- 7437: "faximum",
- 7443: "oracleas-https",
- 7473: "rise",
- 7491: "telops-lmd",
- 7500: "silhouette",
- 7501: "ovbus",
- 7510: "ovhpas",
- 7511: "pafec-lm",
- 7542: "saratoga",
- 7543: "atul",
- 7544: "nta-ds",
- 7545: "nta-us",
- 7546: "cfs",
- 7547: "cwmp",
- 7548: "tidp",
- 7549: "nls-tl",
- 7550: "cloudsignaling",
- 7560: "sncp",
- 7566: "vsi-omega",
- 7570: "aries-kfinder",
- 7574: "coherence-disc",
- 7588: "sun-lm",
- 7624: "indi",
- 7627: "soap-http",
- 7628: "zen-pawn",
- 7629: "xdas",
- 7633: "pmdfmgt",
- 7648: "cuseeme",
- 7674: "imqtunnels",
- 7675: "imqtunnel",
- 7676: "imqbrokerd",
- 7677: "sun-user-https",
- 7680: "pando-pub",
- 7689: "collaber",
- 7697: "klio",
- 7707: "sync-em7",
- 7708: "scinet",
- 7720: "medimageportal",
- 7724: "nsdeepfreezectl",
- 7725: "nitrogen",
- 7726: "freezexservice",
- 7727: "trident-data",
- 7734: "smip",
- 7738: "aiagent",
- 7741: "scriptview",
- 7743: "sstp-1",
- 7744: "raqmon-pdu",
- 7747: "prgp",
- 7777: "cbt",
- 7778: "interwise",
- 7779: "vstat",
- 7781: "accu-lmgr",
- 7786: "minivend",
- 7787: "popup-reminders",
- 7789: "office-tools",
- 7794: "q3ade",
- 7797: "pnet-conn",
- 7798: "pnet-enc",
- 7799: "altbsdp",
- 7800: "asr",
- 7801: "ssp-client",
- 7802: "vns-tp",
- 7810: "rbt-wanopt",
- 7845: "apc-7845",
- 7846: "apc-7846",
- 7872: "mipv6tls",
- 7880: "pss",
- 7887: "ubroker",
- 7900: "mevent",
- 7901: "tnos-sp",
- 7902: "tnos-dp",
- 7903: "tnos-dps",
- 7913: "qo-secure",
- 7932: "t2-drm",
- 7933: "t2-brm",
- 7962: "generalsync",
- 7967: "supercell",
- 7979: "micromuse-ncps",
- 7980: "quest-vista",
- 7982: "sossd-disc",
- 7998: "usicontentpush",
- 7999: "irdmi2",
- 8000: "irdmi",
- 8001: "vcom-tunnel",
- 8002: "teradataordbms",
- 8003: "mcreport",
- 8005: "mxi",
- 8008: "http-alt",
- 8019: "qbdb",
- 8020: "intu-ec-svcdisc",
- 8021: "intu-ec-client",
- 8022: "oa-system",
- 8025: "ca-audit-da",
- 8026: "ca-audit-ds",
- 8032: "pro-ed",
- 8033: "mindprint",
- 8034: "vantronix-mgmt",
- 8040: "ampify",
- 8052: "senomix01",
- 8053: "senomix02",
- 8054: "senomix03",
- 8055: "senomix04",
- 8056: "senomix05",
- 8057: "senomix06",
- 8058: "senomix07",
- 8059: "senomix08",
- 8060: "aero",
- 8074: "gadugadu",
- 8080: "http-alt",
- 8081: "sunproxyadmin",
- 8082: "us-cli",
- 8083: "us-srv",
- 8086: "d-s-n",
- 8087: "simplifymedia",
- 8088: "radan-http",
- 8097: "sac",
- 8100: "xprint-server",
- 8115: "mtl8000-matrix",
- 8116: "cp-cluster",
- 8118: "privoxy",
- 8121: "apollo-data",
- 8122: "apollo-admin",
- 8128: "paycash-online",
- 8129: "paycash-wbp",
- 8130: "indigo-vrmi",
- 8131: "indigo-vbcp",
- 8132: "dbabble",
- 8148: "isdd",
- 8149: "eor-game",
- 8160: "patrol",
- 8161: "patrol-snmp",
- 8182: "vmware-fdm",
- 8184: "itach",
- 8192: "spytechphone",
- 8194: "blp1",
- 8195: "blp2",
- 8199: "vvr-data",
- 8200: "trivnet1",
- 8201: "trivnet2",
- 8202: "aesop",
- 8204: "lm-perfworks",
- 8205: "lm-instmgr",
- 8206: "lm-dta",
- 8207: "lm-sserver",
- 8208: "lm-webwatcher",
- 8230: "rexecj",
- 8243: "synapse-nhttps",
- 8276: "pando-sec",
- 8280: "synapse-nhttp",
- 8292: "blp3",
- 8294: "blp4",
- 8300: "tmi",
- 8301: "amberon",
- 8320: "tnp-discover",
- 8321: "tnp",
- 8351: "server-find",
- 8376: "cruise-enum",
- 8377: "cruise-swroute",
- 8378: "cruise-config",
- 8379: "cruise-diags",
- 8380: "cruise-update",
- 8383: "m2mservices",
- 8400: "cvd",
- 8401: "sabarsd",
- 8402: "abarsd",
- 8403: "admind",
- 8416: "espeech",
- 8417: "espeech-rtp",
- 8442: "cybro-a-bus",
- 8443: "pcsync-https",
- 8444: "pcsync-http",
- 8445: "copy-disc",
- 8450: "npmp",
- 8472: "otv",
- 8473: "vp2p",
- 8474: "noteshare",
- 8500: "fmtp",
- 8501: "cmtp-av",
- 8554: "rtsp-alt",
- 8555: "d-fence",
- 8567: "enc-tunnel",
- 8600: "asterix",
- 8609: "canon-cpp-disc",
- 8610: "canon-mfnp",
- 8611: "canon-bjnp1",
- 8612: "canon-bjnp2",
- 8613: "canon-bjnp3",
- 8614: "canon-bjnp4",
- 8675: "msi-cps-rm-disc",
- 8686: "sun-as-jmxrmi",
- 8732: "dtp-net",
- 8733: "ibus",
- 8763: "mc-appserver",
- 8764: "openqueue",
- 8765: "ultraseek-http",
- 8766: "amcs",
- 8770: "dpap",
- 8786: "msgclnt",
- 8787: "msgsrvr",
- 8793: "acd-pm",
- 8800: "sunwebadmin",
- 8804: "truecm",
- 8873: "dxspider",
- 8880: "cddbp-alt",
- 8883: "secure-mqtt",
- 8888: "ddi-udp-1",
- 8889: "ddi-udp-2",
- 8890: "ddi-udp-3",
- 8891: "ddi-udp-4",
- 8892: "ddi-udp-5",
- 8893: "ddi-udp-6",
- 8894: "ddi-udp-7",
- 8899: "ospf-lite",
- 8900: "jmb-cds1",
- 8901: "jmb-cds2",
- 8910: "manyone-http",
- 8911: "manyone-xml",
- 8912: "wcbackup",
- 8913: "dragonfly",
- 8954: "cumulus-admin",
- 8989: "sunwebadmins",
- 8990: "http-wmap",
- 8991: "https-wmap",
- 8999: "bctp",
- 9000: "cslistener",
- 9001: "etlservicemgr",
- 9002: "dynamid",
- 9007: "ogs-client",
- 9009: "pichat",
- 9020: "tambora",
- 9021: "panagolin-ident",
- 9022: "paragent",
- 9023: "swa-1",
- 9024: "swa-2",
- 9025: "swa-3",
- 9026: "swa-4",
- 9080: "glrpc",
- 9084: "aurora",
- 9085: "ibm-rsyscon",
- 9086: "net2display",
- 9087: "classic",
- 9088: "sqlexec",
- 9089: "sqlexec-ssl",
- 9090: "websm",
- 9091: "xmltec-xmlmail",
- 9092: "XmlIpcRegSvc",
- 9100: "hp-pdl-datastr",
- 9101: "bacula-dir",
- 9102: "bacula-fd",
- 9103: "bacula-sd",
- 9104: "peerwire",
- 9105: "xadmin",
- 9106: "astergate-disc",
- 9119: "mxit",
- 9131: "dddp",
- 9160: "apani1",
- 9161: "apani2",
- 9162: "apani3",
- 9163: "apani4",
- 9164: "apani5",
- 9191: "sun-as-jpda",
- 9200: "wap-wsp",
- 9201: "wap-wsp-wtp",
- 9202: "wap-wsp-s",
- 9203: "wap-wsp-wtp-s",
- 9204: "wap-vcard",
- 9205: "wap-vcal",
- 9206: "wap-vcard-s",
- 9207: "wap-vcal-s",
- 9208: "rjcdb-vcards",
- 9209: "almobile-system",
- 9210: "oma-mlp",
- 9211: "oma-mlp-s",
- 9212: "serverviewdbms",
- 9213: "serverstart",
- 9214: "ipdcesgbs",
- 9215: "insis",
- 9216: "acme",
- 9217: "fsc-port",
- 9222: "teamcoherence",
- 9255: "mon",
- 9277: "traingpsdata",
- 9278: "pegasus",
- 9279: "pegasus-ctl",
- 9280: "pgps",
- 9281: "swtp-port1",
- 9282: "swtp-port2",
- 9283: "callwaveiam",
- 9284: "visd",
- 9285: "n2h2server",
- 9286: "n2receive",
- 9287: "cumulus",
- 9292: "armtechdaemon",
- 9293: "storview",
- 9294: "armcenterhttp",
- 9295: "armcenterhttps",
- 9300: "vrace",
- 9318: "secure-ts",
- 9321: "guibase",
- 9343: "mpidcmgr",
- 9344: "mphlpdmc",
- 9346: "ctechlicensing",
- 9374: "fjdmimgr",
- 9380: "boxp",
- 9396: "fjinvmgr",
- 9397: "mpidcagt",
- 9400: "sec-t4net-srv",
- 9401: "sec-t4net-clt",
- 9402: "sec-pc2fax-srv",
- 9418: "git",
- 9443: "tungsten-https",
- 9444: "wso2esb-console",
- 9450: "sntlkeyssrvr",
- 9500: "ismserver",
- 9522: "sma-spw",
- 9535: "mngsuite",
- 9536: "laes-bf",
- 9555: "trispen-sra",
- 9592: "ldgateway",
- 9593: "cba8",
- 9594: "msgsys",
- 9595: "pds",
- 9596: "mercury-disc",
- 9597: "pd-admin",
- 9598: "vscp",
- 9599: "robix",
- 9600: "micromuse-ncpw",
- 9612: "streamcomm-ds",
- 9618: "condor",
- 9628: "odbcpathway",
- 9629: "uniport",
- 9632: "mc-comm",
- 9667: "xmms2",
- 9668: "tec5-sdctp",
- 9694: "client-wakeup",
- 9695: "ccnx",
- 9700: "board-roar",
- 9747: "l5nas-parchan",
- 9750: "board-voip",
- 9753: "rasadv",
- 9762: "tungsten-http",
- 9800: "davsrc",
- 9801: "sstp-2",
- 9802: "davsrcs",
- 9875: "sapv1",
- 9878: "kca-service",
- 9888: "cyborg-systems",
- 9889: "gt-proxy",
- 9898: "monkeycom",
- 9899: "sctp-tunneling",
- 9900: "iua",
- 9901: "enrp",
- 9903: "multicast-ping",
- 9909: "domaintime",
- 9911: "sype-transport",
- 9950: "apc-9950",
- 9951: "apc-9951",
- 9952: "apc-9952",
- 9953: "acis",
- 9955: "alljoyn-mcm",
- 9956: "alljoyn",
- 9966: "odnsp",
- 9987: "dsm-scm-target",
- 9990: "osm-appsrvr",
- 9991: "osm-oev",
- 9992: "palace-1",
- 9993: "palace-2",
- 9994: "palace-3",
- 9995: "palace-4",
- 9996: "palace-5",
- 9997: "palace-6",
- 9998: "distinct32",
- 9999: "distinct",
- 10000: "ndmp",
- 10001: "scp-config",
- 10002: "documentum",
- 10003: "documentum-s",
- 10007: "mvs-capacity",
- 10008: "octopus",
- 10009: "swdtp-sv",
- 10050: "zabbix-agent",
- 10051: "zabbix-trapper",
- 10080: "amanda",
- 10081: "famdc",
- 10100: "itap-ddtp",
- 10101: "ezmeeting-2",
- 10102: "ezproxy-2",
- 10103: "ezrelay",
- 10104: "swdtp",
- 10107: "bctp-server",
- 10110: "nmea-0183",
- 10111: "nmea-onenet",
- 10113: "netiq-endpoint",
- 10114: "netiq-qcheck",
- 10115: "netiq-endpt",
- 10116: "netiq-voipa",
- 10117: "iqrm",
- 10128: "bmc-perf-sd",
- 10160: "qb-db-server",
- 10161: "snmpdtls",
- 10162: "snmpdtls-trap",
- 10200: "trisoap",
- 10201: "rscs",
- 10252: "apollo-relay",
- 10260: "axis-wimp-port",
- 10288: "blocks",
- 10439: "bngsync",
- 10500: "hip-nat-t",
- 10540: "MOS-lower",
- 10541: "MOS-upper",
- 10542: "MOS-aux",
- 10543: "MOS-soap",
- 10544: "MOS-soap-opt",
- 10800: "gap",
- 10805: "lpdg",
- 10810: "nmc-disc",
- 10860: "helix",
- 10880: "bveapi",
- 10990: "rmiaux",
- 11000: "irisa",
- 11001: "metasys",
- 10023: "cefd-vmp",
- 11095: "weave",
- 11106: "sgi-lk",
- 11108: "myq-termlink",
- 11111: "vce",
- 11112: "dicom",
- 11161: "suncacao-snmp",
- 11162: "suncacao-jmxmp",
- 11163: "suncacao-rmi",
- 11164: "suncacao-csa",
- 11165: "suncacao-websvc",
- 11171: "snss",
- 11201: "smsqp",
- 11208: "wifree",
- 11211: "memcache",
- 11319: "imip",
- 11320: "imip-channels",
- 11321: "arena-server",
- 11367: "atm-uhas",
- 11371: "hkp",
- 11430: "lsdp",
- 11600: "tempest-port",
- 11720: "h323callsigalt",
- 11723: "emc-xsw-dcache",
- 11751: "intrepid-ssl",
- 11796: "lanschool-mpt",
- 11876: "xoraya",
- 11877: "x2e-disc",
- 11967: "sysinfo-sp",
- 12000: "entextxid",
- 12001: "entextnetwk",
- 12002: "entexthigh",
- 12003: "entextmed",
- 12004: "entextlow",
- 12005: "dbisamserver1",
- 12006: "dbisamserver2",
- 12007: "accuracer",
- 12008: "accuracer-dbms",
- 12009: "ghvpn",
- 12012: "vipera",
- 12013: "vipera-ssl",
- 12109: "rets-ssl",
- 12121: "nupaper-ss",
- 12168: "cawas",
- 12172: "hivep",
- 12300: "linogridengine",
- 12321: "warehouse-sss",
- 12322: "warehouse",
- 12345: "italk",
- 12753: "tsaf",
- 13160: "i-zipqd",
- 13216: "bcslogc",
- 13217: "rs-pias",
- 13218: "emc-vcas-udp",
- 13223: "powwow-client",
- 13224: "powwow-server",
- 13400: "doip-disc",
- 13720: "bprd",
- 13721: "bpdbm",
- 13722: "bpjava-msvc",
- 13724: "vnetd",
- 13782: "bpcd",
- 13783: "vopied",
- 13785: "nbdb",
- 13786: "nomdb",
- 13818: "dsmcc-config",
- 13819: "dsmcc-session",
- 13820: "dsmcc-passthru",
- 13821: "dsmcc-download",
- 13822: "dsmcc-ccp",
- 13894: "ucontrol",
- 13929: "dta-systems",
- 14000: "scotty-ft",
- 14001: "sua",
- 14002: "scotty-disc",
- 14033: "sage-best-com1",
- 14034: "sage-best-com2",
- 14141: "vcs-app",
- 14142: "icpp",
- 14145: "gcm-app",
- 14149: "vrts-tdd",
- 14154: "vad",
- 14250: "cps",
- 14414: "ca-web-update",
- 14936: "hde-lcesrvr-1",
- 14937: "hde-lcesrvr-2",
- 15000: "hydap",
- 15118: "v2g-secc",
- 15345: "xpilot",
- 15363: "3link",
- 15555: "cisco-snat",
- 15660: "bex-xr",
- 15740: "ptp",
- 15998: "2ping",
- 16003: "alfin",
- 16161: "sun-sea-port",
- 16309: "etb4j",
- 16310: "pduncs",
- 16311: "pdefmns",
- 16360: "netserialext1",
- 16361: "netserialext2",
- 16367: "netserialext3",
- 16368: "netserialext4",
- 16384: "connected",
- 16666: "vtp",
- 16900: "newbay-snc-mc",
- 16950: "sgcip",
- 16991: "intel-rci-mp",
- 16992: "amt-soap-http",
- 16993: "amt-soap-https",
- 16994: "amt-redir-tcp",
- 16995: "amt-redir-tls",
- 17007: "isode-dua",
- 17185: "soundsvirtual",
- 17219: "chipper",
- 17220: "avtp",
- 17221: "avdecc",
- 17222: "cpsp",
- 17234: "integrius-stp",
- 17235: "ssh-mgmt",
- 17500: "db-lsp-disc",
- 17729: "ea",
- 17754: "zep",
- 17755: "zigbee-ip",
- 17756: "zigbee-ips",
- 18000: "biimenu",
- 18181: "opsec-cvp",
- 18182: "opsec-ufp",
- 18183: "opsec-sam",
- 18184: "opsec-lea",
- 18185: "opsec-omi",
- 18186: "ohsc",
- 18187: "opsec-ela",
- 18241: "checkpoint-rtm",
- 18262: "gv-pf",
- 18463: "ac-cluster",
- 18634: "rds-ib",
- 18635: "rds-ip",
- 18769: "ique",
- 18881: "infotos",
- 18888: "apc-necmp",
- 19000: "igrid",
- 19007: "scintilla",
- 19191: "opsec-uaa",
- 19194: "ua-secureagent",
- 19283: "keysrvr",
- 19315: "keyshadow",
- 19398: "mtrgtrans",
- 19410: "hp-sco",
- 19411: "hp-sca",
- 19412: "hp-sessmon",
- 19539: "fxuptp",
- 19540: "sxuptp",
- 19541: "jcp",
- 19788: "mle",
- 19999: "dnp-sec",
- 20000: "dnp",
- 20001: "microsan",
- 20002: "commtact-http",
- 20003: "commtact-https",
- 20005: "openwebnet",
- 20012: "ss-idi-disc",
- 20014: "opendeploy",
- 20034: "nburn-id",
- 20046: "tmophl7mts",
- 20048: "mountd",
- 20049: "nfsrdma",
- 20167: "tolfab",
- 20202: "ipdtp-port",
- 20222: "ipulse-ics",
- 20480: "emwavemsg",
- 20670: "track",
- 20999: "athand-mmp",
- 21000: "irtrans",
- 21554: "dfserver",
- 21590: "vofr-gateway",
- 21800: "tvpm",
- 21845: "webphone",
- 21846: "netspeak-is",
- 21847: "netspeak-cs",
- 21848: "netspeak-acd",
- 21849: "netspeak-cps",
- 22000: "snapenetio",
- 22001: "optocontrol",
- 22002: "optohost002",
- 22003: "optohost003",
- 22004: "optohost004",
- 22005: "optohost004",
- 22273: "wnn6",
- 22305: "cis",
- 22343: "cis-secure",
- 22347: "wibukey",
- 22350: "codemeter",
- 22555: "vocaltec-phone",
- 22763: "talikaserver",
- 22800: "aws-brf",
- 22951: "brf-gw",
- 23000: "inovaport1",
- 23001: "inovaport2",
- 23002: "inovaport3",
- 23003: "inovaport4",
- 23004: "inovaport5",
- 23005: "inovaport6",
- 23272: "s102",
- 23333: "elxmgmt",
- 23400: "novar-dbase",
- 23401: "novar-alarm",
- 23402: "novar-global",
- 24000: "med-ltp",
- 24001: "med-fsp-rx",
- 24002: "med-fsp-tx",
- 24003: "med-supp",
- 24004: "med-ovw",
- 24005: "med-ci",
- 24006: "med-net-svc",
- 24242: "filesphere",
- 24249: "vista-4gl",
- 24321: "ild",
- 24322: "hid",
- 24386: "intel-rci",
- 24465: "tonidods",
- 24554: "binkp",
- 24577: "bilobit-update",
- 24676: "canditv",
- 24677: "flashfiler",
- 24678: "proactivate",
- 24680: "tcc-http",
- 24850: "assoc-disc",
- 24922: "find",
- 25000: "icl-twobase1",
- 25001: "icl-twobase2",
- 25002: "icl-twobase3",
- 25003: "icl-twobase4",
- 25004: "icl-twobase5",
- 25005: "icl-twobase6",
- 25006: "icl-twobase7",
- 25007: "icl-twobase8",
- 25008: "icl-twobase9",
- 25009: "icl-twobase10",
- 25793: "vocaltec-hos",
- 25900: "tasp-net",
- 25901: "niobserver",
- 25902: "nilinkanalyst",
- 25903: "niprobe",
- 25954: "bf-game",
- 25955: "bf-master",
- 26000: "quake",
- 26133: "scscp",
- 26208: "wnn6-ds",
- 26260: "ezproxy",
- 26261: "ezmeeting",
- 26262: "k3software-svr",
- 26263: "k3software-cli",
- 26486: "exoline-udp",
- 26487: "exoconfig",
- 26489: "exonet",
- 27345: "imagepump",
- 27442: "jesmsjc",
- 27504: "kopek-httphead",
- 27782: "ars-vista",
- 27999: "tw-auth-key",
- 28000: "nxlmd",
- 28119: "a27-ran-ran",
- 28200: "voxelstorm",
- 28240: "siemensgsm",
- 29167: "otmp",
- 30001: "pago-services1",
- 30002: "pago-services2",
- 30003: "amicon-fpsu-ra",
- 30004: "amicon-fpsu-s",
- 30260: "kingdomsonline",
- 30832: "samsung-disc",
- 30999: "ovobs",
- 31029: "yawn",
- 31416: "xqosd",
- 31457: "tetrinet",
- 31620: "lm-mon",
- 31765: "gamesmith-port",
- 31948: "iceedcp-tx",
- 31949: "iceedcp-rx",
- 32034: "iracinghelper",
- 32249: "t1distproc60",
- 32483: "apm-link",
- 32635: "sec-ntb-clnt",
- 32636: "DMExpress",
- 32767: "filenet-powsrm",
- 32768: "filenet-tms",
- 32769: "filenet-rpc",
- 32770: "filenet-nch",
- 32771: "filenet-rmi",
- 32772: "filenet-pa",
- 32773: "filenet-cm",
- 32774: "filenet-re",
- 32775: "filenet-pch",
- 32776: "filenet-peior",
- 32777: "filenet-obrok",
- 32801: "mlsn",
- 32896: "idmgratm",
- 33123: "aurora-balaena",
- 33331: "diamondport",
- 33334: "speedtrace-disc",
- 33434: "traceroute",
- 33656: "snip-slave",
- 34249: "turbonote-2",
- 34378: "p-net-local",
- 34379: "p-net-remote",
- 34962: "profinet-rt",
- 34963: "profinet-rtm",
- 34964: "profinet-cm",
- 34980: "ethercat",
- 35001: "rt-viewer",
- 35004: "rt-classmanager",
- 35355: "altova-lm-disc",
- 36001: "allpeers",
- 36865: "kastenxpipe",
- 37475: "neckar",
- 37654: "unisys-eportal",
- 38201: "galaxy7-data",
- 38202: "fairview",
- 38203: "agpolicy",
- 39681: "turbonote-1",
- 40000: "safetynetp",
- 40841: "cscp",
- 40842: "csccredir",
- 40843: "csccfirewall",
- 40853: "ortec-disc",
- 41111: "fs-qos",
- 41794: "crestron-cip",
- 41795: "crestron-ctp",
- 42508: "candp",
- 42509: "candrp",
- 42510: "caerpc",
- 43000: "recvr-rc-disc",
- 43188: "reachout",
- 43189: "ndm-agent-port",
- 43190: "ip-provision",
- 43210: "shaperai-disc",
- 43439: "eq3-config",
- 43440: "ew-disc-cmd",
- 43441: "ciscocsdb",
- 44321: "pmcd",
- 44322: "pmcdproxy",
- 44544: "domiq",
- 44553: "rbr-debug",
- 44600: "asihpi",
- 44818: "EtherNet-IP-2",
- 44900: "m3da-disc",
- 45000: "asmp-mon",
- 45054: "invision-ag",
- 45678: "eba",
- 45825: "qdb2service",
- 45966: "ssr-servermgr",
- 46999: "mediabox",
- 47000: "mbus",
- 47100: "jvl-mactalk",
- 47557: "dbbrowse",
- 47624: "directplaysrvr",
- 47806: "ap",
- 47808: "bacnet",
- 47809: "presonus-ucnet",
- 48000: "nimcontroller",
- 48001: "nimspooler",
- 48002: "nimhub",
- 48003: "nimgtw",
- 48128: "isnetserv",
- 48129: "blp5",
- 48556: "com-bardac-dw",
- 48619: "iqobject",
- 48653: "robotraconteur"}
diff --git a/fibratus/tcpip/tcpip.py b/fibratus/tcpip/tcpip.py
deleted file mode 100644
index d175d43e7..000000000
--- a/fibratus/tcpip/tcpip.py
+++ /dev/null
@@ -1,123 +0,0 @@
-# Copyright 2015 by Nedim Sabic (RabbitStack)
-# All Rights Reserved.
-#
-# Licensed under the Apache License, Version 2.0 (the "License"); you may
-# not use this file except in compliance with the License. You may obtain
-# a copy of the License at
-#
-# http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
-# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
-# License for the specific language governing permissions and limitations
-# under the License.
-from enum import Enum
-
-from fibratus.common import NA
-from fibratus.kevent_types import SEND_SOCKET_TCPV4, SEND_SOCKET_UDPV4, RECV_SOCKET_TCPV4, RECV_SOCKET_UDPV4, \
- ACCEPT_SOCKET_TCPV4, CONNECT_SOCKET_TCPV4, DISCONNECT_SOCKET_TCPV4, RECONNECT_SOCKET_TCPV4
-
-import fibratus.tcpip.ports as ports
-
-
-def port_to_proto(port, l4_proto):
- if 'TCP' in l4_proto:
- return ports.IANA_PORTS_TCP[port] if port in ports.IANA_PORTS_TCP else NA
- else:
- return ports.IANA_PORTS_UDP[port] if port in ports.IANA_PORTS_UDP else NA
-
-
-class IpVer(Enum):
-
- IPV4 = 0
- IPV6 = 1
-
-
-class TcpIpParser(object):
-
- def __init__(self, kevent):
- """TCP/IP kernel event parser.
-
- Packages the TCP and UDP requests into a single
- kernel event.
-
- Parameters:
- ----------
-
- kevent: dict
- kernel event representing the UDP / TCP request
- """
- self._kevent = kevent
-
- def parse_tcpip(self, ketype, ktcpip):
- """Parses the TCP/IP kernel events.
-
- Parameters
- ----------
-
- ketype: tuple
- network kernel event
- ktcpip:
- kevent payload as forwarded from the collector
-
- """
- pid = ktcpip.pid
- ip_src = ktcpip.saddr
- ip_dst = ktcpip.daddr
- sport = ktcpip.sport
- dport = ktcpip.dport
-
- self._kevent.pid = pid
-
- if ketype in [SEND_SOCKET_TCPV4,
- SEND_SOCKET_UDPV4,
- RECV_SOCKET_TCPV4,
- RECV_SOCKET_UDPV4]:
- # get the application layer protocol
- # associated with the tcp segment
- # or the udp datagram
- if ketype in [SEND_SOCKET_TCPV4,
- RECV_SOCKET_TCPV4]:
- l4_proto = 'TCP'
- else:
- l4_proto = 'UDP'
- protocol = port_to_proto(dport, l4_proto)
- if protocol == NA:
- protocol = port_to_proto(sport, l4_proto)
- self._kevent.params = {'pid': pid,
- 'ip_src': ip_src,
- 'ip_dst': ip_dst,
- 'sport': sport,
- 'dport': dport,
- 'packet_size': ktcpip.size,
- 'l4_proto': l4_proto,
- 'protocol': protocol}
- elif ketype == ACCEPT_SOCKET_TCPV4:
- self._kevent.params = dict(pid=pid, ip_src=ip_src, ip_dst=ip_dst,
- sport=sport,
- dport=dport,
- rwin=ktcpip.rcvwin,
- protocol=port_to_proto(sport, 'TCP'))
-
- elif ketype == CONNECT_SOCKET_TCPV4:
- self._kevent.params = dict(pid=pid,
- ip_src=ip_src,
- ip_dst=ip_dst,
- sport=sport,
- dport=dport,
- rwin=ktcpip.rcvwin,
- protocol=port_to_proto(dport, 'TCP'))
- elif ketype == DISCONNECT_SOCKET_TCPV4:
- self._kevent.params = dict(pid=pid,
- ip_src=ip_src,
- ip_dst=ip_dst,
- sport=sport,
- dport=dport)
-
- elif ketype == RECONNECT_SOCKET_TCPV4:
- self._kevent.params = dict(pid=pid,
- ip_src=ip_src,
- ip_dst=ip_dst,
- sport=sport,
- dport=dport)
\ No newline at end of file
diff --git a/fibratus/term.py b/fibratus/term.py
deleted file mode 100644
index 892cd9b69..000000000
--- a/fibratus/term.py
+++ /dev/null
@@ -1,191 +0,0 @@
-# Copyright 2015 by Nedim Sabic (RabbitStack)
-# All Rights Reserved.
-# http://rabbitstack.github.io
-
-# Licensed under the Apache License, Version 2.0 (the "License"); you may
-# not use this file except in compliance with the License. You may obtain
-# a copy of the License at
-#
-# http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
-# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
-# License for the specific language governing permissions and limitations
-# under the License.
-from _ctypes import byref
-from ctypes import c_ulong
-import os
-
-from fibratus.apidefs.sys import CONSOLE_SCREEN_BUFFER_INFO, INVALID_HANDLE_VALUE, get_std_handle, STD_OUTPUT_HANDLE, \
- create_console_screen_buffer, GENERIC_READ, GENERIC_WRITE, FILE_SHARE_READ, FILE_SHARE_WRITE, \
- CONSOLE_TEXTMODE_BUFFER, get_console_screen_buffer_info, COORD, SMALL_RECT, CHAR_INFO, \
- set_console_active_screen_buffer, write_console_output, CURSOR_INFO, get_console_cursor_info, \
- set_console_cursor_info, write_console_unicode
-from fibratus.errors import TermInitializationError
-
-
-HIGH_INTENSITY = 0x0008
-
-# terminal colors
-BLACK = 0x0000
-DARK_BLUE = 0x0001
-DARK_GREEN = 0x0002
-DARK_RED = 0x0004
-GRAY = DARK_BLUE | DARK_GREEN | DARK_RED
-DARK_YELLOW = DARK_RED | DARK_GREEN
-DARK_PURPLE = DARK_RED | DARK_BLUE
-DARK_CYAN = DARK_GREEN | DARK_BLUE
-LIGHT_WHITE = GRAY | HIGH_INTENSITY
-
-
-class AnsiTerm(object):
- """Terminal's low level interface.
-
- Provides a set of methods to interact
- with the Windows terminals. By writing the chars
- directly to the screen buffer can prevent the
- annoying screen flickering.
- """
-
- def __init__(self):
- """Creates a new instance of the terminal.
- """
- self._cursor_info = CURSOR_INFO()
- self._console = INVALID_HANDLE_VALUE
- self._framebuffer = INVALID_HANDLE_VALUE
- self._char_buffer = None
- self._cols = 0
- self._rows = 0
- self._rect = None
- self._coord = COORD(0, 0)
- self._size = COORD(0, 0)
-
- def setup_console(self):
- """Initializes the screen frame buffer.
-
- Swaps the current screen buffer with a
- brand new created back buffer where the
- characters can be written to the flicker-free
- rectangular region.
-
- """
- self._console = get_std_handle(STD_OUTPUT_HANDLE)
- # could not get the standard
- # console handle, raise an exception
- if self._console == INVALID_HANDLE_VALUE:
- raise TermInitializationError()
-
- buffer_info = CONSOLE_SCREEN_BUFFER_INFO()
- get_console_screen_buffer_info(self._console, byref(buffer_info))
- get_console_cursor_info(self._console, byref(self._cursor_info))
- self._cursor_info.visible = False
-
- self._cols = buffer_info.size.x
- self._rows = buffer_info.size.y
- self._size = COORD(self._cols, self._rows)
- self._rect = SMALL_RECT(0, 0, self._cols - 1, self._rows - 1)
- self._char_buffer = (CHAR_INFO * (self._size.x * self._size.y))()
- self._framebuffer = create_console_screen_buffer(GENERIC_READ | GENERIC_WRITE,
- FILE_SHARE_READ | FILE_SHARE_WRITE,
- None,
- CONSOLE_TEXTMODE_BUFFER,
- None)
- if self._framebuffer == INVALID_HANDLE_VALUE:
- raise TermInitializationError()
- # hide the cursor and swap
- # the console active screen buffer
- set_console_cursor_info(self._framebuffer, byref(self._cursor_info))
- set_console_active_screen_buffer(self._framebuffer)
-
- def restore_console(self):
- if self._console:
- set_console_active_screen_buffer(self._console)
- self._cursor_info.visible = True
- set_console_cursor_info(self._console, byref(self._cursor_info))
-
- def write_output(self, charseq, color=LIGHT_WHITE):
- """Writes character and color attribute data to the frame buffer.
-
- The data to be written is taken from a correspondingly sized rectangular
- block at a specified location in the source buffer.
-
- Parameters
- ----------
-
- charseq: str
- the sequence of characters to be written on the frame buffer
-
- color: int
- the terminal output color
- """
-
- col = 0
- x = 0
- crlf = False
-
- if not charseq or len(charseq) <= 0:
- return
-
- try:
- for char in charseq:
- if char == '\n':
- crlf = True
- col += 1
- # the last column has been reached.
- # If there was a carriage return
- # then stop the iteration
- if col == self._cols:
- col = 0
- if crlf:
- crlf = False
- continue
-
- if crlf:
- crlf = False
- space = col
- # keep filling the rectangle with spaces
- # until we reach the last column
- while space <= self._cols:
- self._char_buffer[space - 1].char.unicode_char = ' '
- space += 1
- x += 1
- # reset the column and
- # stop the current iteration
- col = 0
- continue
- self._char_buffer[x].char.unicode_char = char
- self._char_buffer[x].attributes = color
- x += 1
- except IndexError:
- pass
- # write the character attribute data
- # to the screen buffer
- write_console_output(self._framebuffer,
- self._char_buffer,
- self._size,
- self._coord,
- byref(self._rect))
-
- def write_console(self, charseq):
- """Writes a string to a console frame buffer
- beginning at the current cursor location.
-
- charseq: str
- the string to be written on the frame buffer
- """
- write_console_unicode(self._framebuffer, charseq, len(charseq), byref(c_ulong()), None)
-
- def cls(self):
- """Clears the current screen buffer.
- """
- for y in range(self._rows):
- for x in range(self._cols):
- i = (y * self._cols) + x
- self._char_buffer[i].char.unicode_char = ' '
- write_console_output(self._framebuffer,
- self._char_buffer,
- self._coord,
- self._size,
- byref(self._rect))
-
diff --git a/fibratus/thread.py b/fibratus/thread.py
deleted file mode 100644
index 980f05ae1..000000000
--- a/fibratus/thread.py
+++ /dev/null
@@ -1,504 +0,0 @@
-# Copyright 2015 by Nedim Sabic (RabbitStack)
-# All Rights Reserved.
-# http://rabbitstack.github.io
-#
-# Licensed under the Apache License, Version 2.0 (the "License"); you may
-# not use this file except in compliance with the License. You may obtain
-# a copy of the License at
-#
-# http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
-# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
-# License for the specific language governing permissions and limitations
-# under the License.
-
-from _ctypes import sizeof
-from ctypes import byref, cast
-from ctypes.wintypes import MAX_PATH
-import os
-
-from fibratus.kevent_types import CREATE_PROCESS, ENUM_PROCESS, TERMINATE_THREAD, TERMINATE_PROCESS, \
- CREATE_THREAD, ENUM_THREAD
-from fibratus.apidefs.process import *
-from fibratus.apidefs.cdefs import STATUS_SUCCESS
-from fibratus.apidefs.sys import close_handle, malloc, free
-from fibratus.common import DotD as ddict, NA
-
-
-class ThreadRegistry(object):
-
- def __init__(self, handle_repository, handles, image_meta_registry):
- self._threads = {}
- self.on_thread_added_callback = None
- self.handle_repository = handle_repository
- self.image_meta_registry = image_meta_registry
- self._handles = handles
-
- def add_thread(self, ketype, kti):
- """Adds a new process or thread to thread registry.
-
- Parameters
- ----------
-
- ketype: tuple
- kernel event type
- kti: dict
- event payload as coming from the
- kernel event stream collector
- """
- if ketype == CREATE_PROCESS or ketype == ENUM_PROCESS:
- parent_pid = int(kti.parent_id, 16)
- process_id = int(kti.process_id, 16)
- # we assume the process id is
- # equal to thread id (in a single
- # threaded process)
- thread_id = process_id
- name = kti.image_file_name
- comm = kti.command_line
-
- thread = ThreadInfo(process_id, thread_id,
- parent_pid,
- name,
- comm)
- if ketype == ENUM_PROCESS:
- thread.handles = [handle for handle in self._handles if handle.pid == process_id]
- if ketype == CREATE_PROCESS:
- image_meta = self.image_meta_registry.get_image_meta(thread.exe)
- if not image_meta:
- image_meta = self.image_meta_registry.add_image_meta(thread.exe)
- thread.image_meta = image_meta
- self._threads[process_id] = thread
-
- elif ketype == CREATE_THREAD or ketype == ENUM_THREAD:
- # new thread created in the
- # context of the existing process
- # `procces_id` is the parent
- # of this thread
- process_id = int(kti.process_id, 16)
- parent_pid = process_id
- thread_id = int(kti.t_thread_id, 16)
-
- if parent_pid in self._threads:
- # copy info from the process
- # which created this thread
- pthread = self._threads[parent_pid]
- # increment the number of threads
- # for this process
- pthread.increment_child_count()
-
- name = pthread.name
- comm = pthread.comm
-
- thread = ThreadInfo(process_id, thread_id,
- parent_pid,
- name,
- comm)
- thread.ustack_base = hex(kti.user_stack_base)
- thread.kstack_base = hex(kti.stack_base)
- thread.base_priority = kti.base_priority
- thread.io_priority = kti.io_priority
- self._threads[thread_id] = thread
- else:
- # the parent process has not been found
- # query the os for process information
- handle = open_process(PROCESS_QUERY_INFORMATION | PROCESS_QUERY_LIMITED_INFORMATION | PROCESS_VM_READ,
- False,
- parent_pid)
- info = {}
- if handle:
- info = self._query_process_info(handle)
- close_handle(handle)
- else:
- if get_last_error() == ERROR_ACCESS_DENIED:
- if parent_pid == 0:
- info = ddict(name='idle',
- comm='idle',
- parent_id=0)
- else:
- # the access to protected / system process
- # can't be done with PROCESS_VM_READ or PROCESS_QUERY_INFORMATION
- # flags. Open the process again but with
- # restricted access rights, so we can get the process image file name
- handle = open_process(PROCESS_QUERY_LIMITED_INFORMATION,
- False,
- parent_pid)
- if handle:
- info = self._query_process_info(handle, False)
- close_handle(handle)
-
- # add a new thread and the parent process
- # we just found to avoid continuous lookup
- name = info.name if len(info) > 0 and info.name else NA
- comm = info.comm if len(info) > 0 and info.comm else NA
- ppid = info.parent_pid if len(info) > 0 and info.parent_pid else NA
-
- thread = ThreadInfo(process_id, thread_id,
- process_id,
- name,
- comm)
- thread.ustack_base = hex(kti.user_stack_base)
- thread.kstack_base = hex(kti.stack_base)
- thread.base_priority = kti.base_priority
- thread.io_priority = kti.io_priority
-
- parent = ThreadInfo(process_id, process_id,
- ppid,
- name,
- comm)
- # enumerate parent handles
- parent.handles = self.handle_repository.query_handles(process_id)
-
- self._threads[thread_id] = thread
- self._threads[parent_pid] = parent
-
- if self.on_thread_added_callback and callable(self.on_thread_added_callback):
- self.on_thread_added_callback(thread)
-
- def remove_thread(self, ketype, kti):
- """Removes the thread or process from the registry.
-
- Parameters
- ----------
-
- ketype: tuple
- kernel event type
- kti: dict
- event payload as coming from the
- kernel event stream collector
- """
- if ketype == TERMINATE_THREAD:
- thread_id = int(kti.t_thread_id, 16)
- if thread_id in self._threads:
- # remove the thread and
- # decrement the child count of
- # the parent process
- if self._threads[thread_id].child_count == 0:
- thread = self._threads.pop(thread_id)
- if thread and thread.pid in self._threads:
- parent = self._threads[thread.pid]
- parent.decrement_child_count()
- elif ketype == TERMINATE_PROCESS:
- # the process has exited
- # remove all of its threads
- process_id = int(kti.process_id, 16)
- if process_id in self._threads:
- proc = self._threads.pop(process_id)
- if proc.child_count > 0:
- self._threads = dict((k, v) for k, v in self._threads.items()
- if v.child_count == 0 and k != process_id)
-
- def init_thread_kevent(self, kevent, ketype, kti):
- """Initialize kernel event.
-
- Parameters
- ----------
-
- kevent: KEvent
- instance of `KEvent` class
- ketype: tuple
- kernel event type
- kti: dict
- kernel event payload
- """
- if ketype == CREATE_THREAD or ketype == TERMINATE_THREAD:
- tid = int(kti.t_thread_id, 16)
- thread = self.get_thread(tid)
- if thread:
- kevent.params = dict(pid=thread.pid,
- tid=tid,
- kstack_base=hex(kti.stack_base),
- ustack_base=hex(kti.user_stack_base),
- io_priority=kti.io_priority,
- base_priority=kti.base_priority)
- kevent.pid = thread.pid
- kevent.tid = tid
- else:
- pid = int(kti.process_id, 16)
- thread = self.get_thread(pid)
- if thread:
- kparams = dict(pid=pid,
- name=thread.name,
- comm=thread.comm,
- exe=thread.exe,
- ppid=thread.ppid)
- if thread.image_meta:
- # include image meta info
- image_meta = dict(arch=thread.image_meta.arch,
- timestamp=thread.image_meta.timestamp,
- num_sections=thread.image_meta.num_sections,
- sections=thread.image_meta.sections,
- imports=thread.image_meta.imports,
- org=thread.image_meta.org,
- description=thread.image_meta.description,
- version=thread.image_meta.version,
- internal_name=thread.image_meta.internal_name,
- copyright=thread.image_meta.copyright)
- kparams['image_meta'] = image_meta
- kevent.params = kparams
- kevent.pid = thread.ppid
-
- def set_thread_added_callback(self, callback):
- self.on_thread_added_callback = callback
-
- def get_thread(self, tid):
- return self._threads[tid] if tid in self._threads else None
-
- @property
- def threads(self):
- return self._threads
-
- def _query_process_info(self, handle, read_peb=True):
- """Gets an extended proc info.
-
- Parameters
- -----------
-
- handle: HANDLE
- handle to process for which the info
- should be acquired
- read_peb: boolean
- true in case the process PEB should be read
-
- """
- pbi_buff = malloc(sizeof(PROCESS_BASIC_INFORMATION))
- status = zw_query_information_process(handle,
- PROCESS_BASIC_INFO,
- pbi_buff,
- sizeof(PROCESS_BASIC_INFORMATION),
- byref(ULONG()))
-
- info = {}
-
- if status == STATUS_SUCCESS:
- pbi = cast(pbi_buff, POINTER(PROCESS_BASIC_INFORMATION))
- ppid = pbi.contents.inherited_from_unique_process_id
- if read_peb:
- # read the PEB to get the process parameters.
- # Because the PEB structure resides
- # in the address space of another process
- # we must read the memory block in order
- # to access the structure's fields
- peb_addr = pbi.contents.peb_base_address
- peb_buff = read_process_memory(handle, peb_addr, sizeof(PEB))
- if peb_buff:
- peb = cast(peb_buff, POINTER(PEB))
- # read the RTL_USER_PROCESS_PARAMETERS struct
- # which contains the command line and the image
- # name of the process
- pp = peb.contents.process_parameters
- pp_buff = read_process_memory(handle,
- pp,
- sizeof(RTL_USER_PROCESS_PARAMETERS))
- if pp_buff:
- pp = cast(pp_buff, POINTER(RTL_USER_PROCESS_PARAMETERS))
-
- comm = pp.contents.command_line.buffer
- comm_len = pp.contents.command_line.length
- exe = pp.contents.image_path_name.buffer
- exe_len = pp.contents.image_path_name.length
-
- # these memory reads are required
- # to copy the command line and image name buffers
- cb = read_process_memory(handle, comm, comm_len)
- eb = read_process_memory(handle, exe, exe_len)
-
- if cb and eb:
- # cast the buffers to
- # UNICODE strings
- comm = cast(cb, c_wchar_p).value
- exe = cast(eb, c_wchar_p).value
-
- # the image name contains the full path
- # split the string to get the exec name
- name = exe[exe.rfind('\\') + 1:]
- info = ddict(name=name,
- comm=comm,
- parent_pid=ppid)
- free(cb)
- free(eb)
- free(pp_buff)
-
- free(peb_buff)
- else:
- # query only the process image file name
- exe = ctypes.create_unicode_buffer(MAX_PATH)
- size = DWORD(MAX_PATH)
- name = None
- status = query_full_process_image_name(handle,
- 0,
- exe,
- byref(size))
- if status:
- exe = exe.value
- name = exe[exe.rfind('\\') + 1:]
- info = ddict(name=name if name else NA,
- comm=exe if type(exe) is str else None,
- parent_pid=ppid)
- if pbi_buff:
- free(pbi_buff)
-
- return info
-
-
-class ThreadInfo(object):
- """Represents the state of thread or process.
- """
- def __init__(self, pid, tid, ppid, name, comm):
- """Creates an instance of `ThreadInfo` class.
-
- Parameters
- ----------
-
- pid: int
- process identifier
- tid: int
- thread identifier in the scope of
- an existing process
- ppid: int
- parent process identifier
- name: str
- process name (cmd.exe)
- comm: str
- the full command line of a process
- (C:\Windows\system32\cmd.exe /cdir /-C /W)
-
- Attributes
- ----------
-
- exe: str
- the full name of the executable
- (C:\Windows\system32\cmd.exe)
- args: list
- command line arguments for the process
- (/cdir, /-C, /W)
- child_count: int
- the number of threads for this process
- handles: list
- a list of handles which owns the process
- ustack_base: int
- the base address of the thread user-space stack
- kstack_base: int
- the base address of the thread kernel-space stack
- io_priority: int
- thread I/O priority
- base_priority: int
- thread CPU priority
- """
- self._pid = pid
- self._tid = tid
- self._ppid = ppid
-
- # get the executable from the
- # full file system path
- head, _ = os.path.split(comm[0:comm.find('exe')])
- self._exe = '%s\%s' % (head, name)
- self._exe = self._exe.replace("\"", '')
-
- if 'SystemRoot' in self._exe:
- sys_root = os.path.expandvars("%SystemRoot%")
- self._exe = self._exe.replace('%SystemRoot%', sys_root)\
- .replace('\\SystemRoot', sys_root)
-
- self._name = name.lower() if NA not in name else NA
- self._comm = comm
- # the command line arguments
- # are separated by blank space
- self._args = comm.split()[1:]
- self._child_count = 0
- self._handles = []
-
- self._ustack_base = 0x0
- self._kstack_base = 0x0
- self._io_priority = 0
- self._base_priority = 0
-
- self._image_meta = None
-
- @property
- def pid(self):
- return self._pid
-
- @property
- def ppid(self):
- return self._ppid
-
- @property
- def tid(self):
- return self._tid
-
- @property
- def exe(self):
- return self._exe
-
- @property
- def name(self):
- return self._name
-
- @property
- def comm(self):
- return self._comm
-
- @property
- def args(self):
- return self._args
-
- @property
- def child_count(self):
- return self._child_count
-
- @property
- def handles(self):
- return self._handles
-
- @handles.setter
- def handles(self, handles):
- self._handles = handles
-
- @property
- def ustack_base(self):
- return self._ustack_base
-
- @ustack_base.setter
- def ustack_base(self, ustack_base):
- self._ustack_base = ustack_base
-
- @property
- def kstack_base(self):
- return self._kstack_base
-
- @kstack_base.setter
- def kstack_base(self, kstack_base):
- self._kstack_base = kstack_base
-
- @property
- def io_priority(self):
- return self._io_priority
-
- @io_priority.setter
- def io_priority(self, io_priority):
- self._io_priority = io_priority
-
- @property
- def base_priority(self):
- return self._base_priority
-
- @base_priority.setter
- def base_priority(self, base_priority):
- self._base_priority = base_priority
-
- @property
- def image_meta(self):
- return self._image_meta
-
- @image_meta.setter
- def image_meta(self, image_meta):
- self._image_meta = image_meta
-
- def increment_child_count(self):
- self._child_count += 1
-
- def decrement_child_count(self):
- if self._child_count != 0:
- self._child_count -= 1
diff --git a/fibratus/version.py b/fibratus/version.py
deleted file mode 100644
index 5981fb911..000000000
--- a/fibratus/version.py
+++ /dev/null
@@ -1,21 +0,0 @@
-# Copyright 2015 by Nedim Sabic (RabbitStack)
-# All Rights Reserved.
-# http://rabbitstack.github.io
-
-# Licensed under the Apache License, Version 2.0 (the "License"); you may
-# not use this file except in compliance with the License. You may obtain
-# a copy of the License at
-#
-# http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
-# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
-# License for the specific language governing permissions and limitations
-# under the License.
-
-_MAJOR_ = 0
-_MINOR_ = 7
-_REV_ = 2
-
-VERSION = '%s.%s.%s' % (_MAJOR_, _MINOR_, _REV_)
diff --git a/filaments/anomalous_process_netio.py b/filaments/anomalous_process_netio.py
deleted file mode 100644
index 6c345580b..000000000
--- a/filaments/anomalous_process_netio.py
+++ /dev/null
@@ -1,44 +0,0 @@
-# Copyright 2015/2016 by Nedim Sabic (RabbitStack)
-# All Rights Reserved.
-# http://rabbitstack.github.io
-
-# Licensed under the Apache License, Version 2.0 (the "License"); you may
-# not use this file except in compliance with the License. You may obtain
-# a copy of the License at
-#
-# http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
-# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
-# License for the specific language governing permissions and limitations
-# under the License.
-
-"""
-An unusual process attempts to make a network request or it accepts
-the incoming connection.
-"""
-
-activations = []
-processes = ['notepad.exe', 'calc.exe', 'mspaint.exe']
-
-
-def on_init():
- set_filter('Send', 'Accept', 'Recv', 'Connect')
-
-
-def on_next_kevent(kevent):
- if kevent.thread:
- process_name = kevent.thread.name
- if process_name in processes:
- triggered = True if process_name in activations else False
- if not triggered:
- message = 'Unusual network activity of kind %s ' \
- 'detected from %s process. ' \
- 'The source ip address is %s and ' \
- 'the destination ip address is %s' \
- % (kevent.name, process_name,
- kevent.params.ip_src,
- kevent.params.ip_dst)
- smtp.emit(message, subject='Anomalous network activity detected')
- activations.append(process_name)
diff --git a/filaments/elasticsearch_indexing.py b/filaments/elasticsearch_indexing.py
deleted file mode 100644
index 478b991aa..000000000
--- a/filaments/elasticsearch_indexing.py
+++ /dev/null
@@ -1,56 +0,0 @@
-# Copyright 2016 by Nedim Sabic (RabbitStack)
-# All Rights Reserved.
-#
-# Licensed under the Apache License, Version 2.0 (the "License"); you may
-# not use this file except in compliance with the License. You may obtain
-# a copy of the License at
-#
-# http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
-# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
-# License for the specific language governing permissions and limitations
-# under the License.
-
-
-"""
-Performs the indexing of the kernel's event stream to
-Elasticsearch on interval basis. When the scheduled
-interval elapses, the list of documents aggregated
-are indexed to Elasticsearch.
-"""
-
-from datetime import datetime
-documents = []
-
-
-def on_init():
- set_filter('CreateThread', 'CreateProcess', 'TerminateThread', 'TerminateProcess',
- 'CreateFile', 'DeleteFile', 'WriteFile', 'RenameFile', 'Recv', 'Send',
- 'Accept', 'Connect', 'Disconnect', 'LoadImage', 'UnloadImage',
- 'RegCreateKey', 'RegDeleteKey', 'RegSetValue')
- set_interval(1)
-
-
-def on_next_kevent(kevent):
- doco = {'image': kevent.thread.name,
- 'thread': {
- 'exe': kevent.thread.exe,
- 'comm': kevent.thread.comm,
- 'pid': kevent.thread.pid,
- 'tid': kevent.tid,
- 'ppid': kevent.thread.ppid},
- 'category': kevent.category,
- 'name': kevent.name,
- 'ts': '%s %s' % (datetime.now().strftime('%m/%d/%Y'),
- kevent.timestamp.strftime('%H:%M:%S.%f')),
- 'cpuid': kevent.cpuid,
- 'params': kevent.params}
- documents.append(doco)
-
-
-def on_interval():
- if len(documents) > 0:
- elasticsearch.emit(documents)
- documents.clear()
diff --git a/filaments/fishy_netio.py b/filaments/fishy_netio.py
new file mode 100644
index 000000000..87451de3f
--- /dev/null
+++ b/filaments/fishy_netio.py
@@ -0,0 +1,73 @@
+# Copyright 2019-2020 by Nedim Sabic (RabbitStack)
+# All Rights Reserved.
+# http://rabbitstack.github.io
+
+# Licensed under the Apache License, Version 2.0 (the "License"); you may
+# not use this file except in compliance with the License. You may obtain
+# a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+# License for the specific language governing permissions and limitations
+# under the License.
+
+"""
+Anomalous process attempts to make a network request or it accepts an inbound connection
+"""
+
+from utils.dotdict import dotdictify
+
+__pids__ = []
+__procs__ = [
+ 'calc.exe',
+ 'notepad.exe',
+ 'mspaint.exe',
+]
+
+
+def on_init():
+ kfilter("kevt.category = 'net' and ps.name in (%s)" % (', '.join([f'\'{ps}\'' for ps in __procs__])))
+
+
+@dotdictify
+def on_next_kevent(kevent):
+ print(kevent)
+ notify = True if kevent.pid in __pids__ else False
+ if not notify:
+ emit_alert(
+ f'Anomalous network I/O detected to {kevent.kparams.dip}:{kevent.kparams.dport}',
+ text(kevent),
+ severity='critical',
+ tags=['anomalous netio']
+ )
+ __pids__.append(kevent.pid)
+
+
+def text(kevent):
+ return """
+
+ Source IP: %s
+ Source port: %s
+ Destination IP: %s
+ Destination port: %s
+ Protocol: %s
+
+ Process ==================================================================================
+
+ Name: %s
+ Comm: %s
+ Cwd: %s
+ User: %s
+
+ """ % (
+ kevent.kparams.sip,
+ kevent.kparams.sport,
+ kevent.kparams.dip,
+ kevent.kparams.dport,
+ kevent.kparams.dport_name,
+ kevent.exe,
+ kevent.comm,
+ kevent.cwd, kevent.sid)
diff --git a/filaments/registry_persistence.py b/filaments/registry_persistence.py
new file mode 100644
index 000000000..74f813163
--- /dev/null
+++ b/filaments/registry_persistence.py
@@ -0,0 +1,91 @@
+# Copyright 2019-2020 by Nedim Sabic (RabbitStack)
+# All Rights Reserved.
+# http://rabbitstack.github.io
+
+# Licensed under the Apache License, Version 2.0 (the "License"); you may
+# not use this file except in compliance with the License. You may obtain
+# a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+# License for the specific language governing permissions and limitations
+# under the License.
+
+"""
+Surfaces registry operations that would allow a process to execute on system startup
+"""
+
+import os
+from utils.dotdict import dotdictify
+
+__keys__ = [
+ r'HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run',
+ r'HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run',
+ r'HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce',
+ r'HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce',
+ r'HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunServices',
+ r'HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunServices',
+
+ r'HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon',
+ r'HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce',
+
+ r'HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Debug',
+ r'HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Debug',
+
+ r'HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce',
+
+ r'HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnceEx\0001',
+ r'HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnceEx\0001\Depend'
+]
+
+WINLOGON_KEY = r'HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon'
+
+
+def on_init():
+ kfilter("kevt.name = 'RegSetValue'")
+
+
+@dotdictify
+def on_next_kevent(kevent):
+ key = os.path.dirname(kevent.kparams.key_name)
+
+ # We check if the value being modified under the Winlogon key is Userinit.
+ # The Userinit registry value defines which programs are run by Winlogon
+ # when a user logs in to the system. Typically, Winlogon runs Userinit.exe,
+ # which in turn runs logon scripts, reestablishes network connections,
+ # and then starts explorer. Attackers can prepend the userinit.exe executable
+ # with their own malicious binary/script.
+ if key.lower() == WINLOGON_KEY.lower() and os.path.basename(kevent.kparams.key_name) != 'Userinit':
+ return
+
+ if any(k.lower() == key.lower() for k in __keys__):
+ emit_alert(
+ f'Registry persistence gained via {kevent.kparams.key_name}',
+ text(kevent),
+ severity='medium',
+ tags=['registry persistence']
+ )
+
+
+def text(kevent):
+ return """
+
+ Key content: %s
+ Key type: %s
+
+ Process ==================================================================================
+
+ Name: %s
+ Comm: %s
+ Cwd: %s
+ User: %s
+
+ """ % (
+ kevent.kparams.value,
+ kevent.kparams.type,
+ kevent.exe,
+ kevent.comm,
+ kevent.cwd, kevent.sid)
diff --git a/filaments/registry_persistence_detection.py b/filaments/registry_persistence_detection.py
deleted file mode 100644
index 27557e103..000000000
--- a/filaments/registry_persistence_detection.py
+++ /dev/null
@@ -1,41 +0,0 @@
-# Copyright 2015/2016 by Nedim Sabic (RabbitStack)
-# All Rights Reserved.
-# http://rabbitstack.github.io
-
-# Licensed under the Apache License, Version 2.0 (the "License"); you may
-# not use this file except in compliance with the License. You may obtain
-# a copy of the License at
-#
-# http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
-# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
-# License for the specific language governing permissions and limitations
-# under the License.
-
-"""
-Triggers when a process creates the registry value which
-would enable it to execute on system startup.
-"""
-
-
-keys = ['Run', 'RunOnce', 'RunServices', 'RunServicesOnce', 'Userinit']
-
-
-def on_init():
- set_filter('RegSetValue')
-
-
-def on_next_kevent(kevent):
- if kevent.thread:
- process_name = kevent.thread.name
- key = kevent.params.key
- if key in keys:
- message = 'The process %s has created a ' \
- 'persistent registry value , ' \
- 'under %s with content %s' \
- % (process_name,
- '%s/%s' % (kevent.params.hive, key),
- kevent.params.value)
- smtp.emit(message, subject='Registry persistence detected')
diff --git a/filaments/top_in_packets.py b/filaments/top_in_packets.py
index a6f80dcd8..fa51db168 100644
--- a/filaments/top_in_packets.py
+++ b/filaments/top_in_packets.py
@@ -1,4 +1,4 @@
-# Copyright 2016 by Nedim Sabic (RabbitStack)
+# Copyright 2019-2020 by Nedim Sabic (RabbitStack)
# All Rights Reserved.
# http://rabbitstack.github.io
@@ -15,29 +15,29 @@
# under the License.
"""
-Shows the top TCP / UDP incoming packets.
+Shows the top TCP / UDP inbound packets by IP/port tuple
"""
import collections
+from utils.dotdict import dotdictify
-connections = collections.Counter()
+__connections__ = collections.Counter()
def on_init():
- set_filter('Recv')
+ kfilter("kevt.name = 'Recv'")
columns(["Source", "Count"])
sort_by('Count')
- set_interval(1)
- title('Top incoming TCP/UDP packets')
+ interval(1)
+@dotdictify
def on_next_kevent(kevent):
- src = ['%s:%d' % (kevent.params.ip_dst, kevent.params.dport)]
- connections.update(src)
+ src = ['%s:%d' % (kevent.kparams.sip, kevent.kparams.sport)]
+ __connections__.update(src)
def on_interval():
- for ip, count in connections.items():
+ for ip, count in __connections__.copy().items():
add_row([ip, count])
- render_tabular()
-
+ render_table()
\ No newline at end of file
diff --git a/filaments/top_registry_io_process.py b/filaments/top_keys.py
similarity index 61%
rename from filaments/top_registry_io_process.py
rename to filaments/top_keys.py
index afc519e5a..d8580bae8 100644
--- a/filaments/top_registry_io_process.py
+++ b/filaments/top_keys.py
@@ -14,29 +14,32 @@
# License for the specific language governing permissions and limitations
# under the License.
+
"""
-Shows top processes by registry I/O activity.
+Shows top keys by number of registry operations
"""
import collections
+from utils.dotdict import dotdictify
-processes_registry_io = collections.Counter()
+__keys__ = collections.Counter()
def on_init():
- set_filter('RegOpenKey', 'RegQueryKey', 'RegCreateKey', 'RegQueryValue', 'RegSetValue', 'RegDeleteValue')
- columns(["Process", "#Ops"])
+ kfilter("kevt.category = 'registry'")
+ columns(["Key", "#Ops"])
sort_by('#Ops')
- set_interval(1)
- limit(20)
+ interval(1)
+@dotdictify
def on_next_kevent(kevent):
- process = ['%s (%d)' % (kevent.thread.name, kevent.thread.pid)]
- processes_registry_io.update(process)
+ key = kevent.kparams.key_name
+ if key:
+ __keys__.update((key, ))
def on_interval():
- for process, io in processes_registry_io.items():
- add_row([process, io])
- render_tabular()
+ for key, count in __keys__.copy().items():
+ add_row([key, count])
+ render_table()
\ No newline at end of file
diff --git a/filaments/top_out_packets.py b/filaments/top_out_packets.py
index 436957825..ac00e10b2 100644
--- a/filaments/top_out_packets.py
+++ b/filaments/top_out_packets.py
@@ -1,4 +1,4 @@
-# Copyright 2015 by Nedim Sabic (RabbitStack)
+# Copyright 2019-2020 by Nedim Sabic (RabbitStack)
# All Rights Reserved.
# http://rabbitstack.github.io
@@ -15,29 +15,29 @@
# under the License.
"""
-Shows the top TCP / UDP outbound packets.
+Shows the top TCP / UDP outbound packets by IP/port tuple
"""
import collections
+from utils.dotdict import dotdictify
-connections = collections.Counter()
+__connections__ = collections.Counter()
def on_init():
- set_filter('Send')
+ kfilter("kevt.name = 'Send'")
columns(["Destination", "Count"])
sort_by('Count')
- set_interval(1)
- title('Top outbound TCP/UDP packets')
+ interval(1)
+@dotdictify
def on_next_kevent(kevent):
- dst = ['%s:%d' % (kevent.params.ip_dst, kevent.params.dport)]
- connections.update(dst)
+ dst = ['%s:%d' % (kevent.kparams.dip, kevent.kparams.dport)]
+ __connections__.update(dst)
def on_interval():
- for ip, count in connections.items():
+ for ip, count in __connections__.copy().items():
add_row([ip, count])
- render_tabular()
-
+ render_table()
\ No newline at end of file
diff --git a/filaments/utils/dotdict.py b/filaments/utils/dotdict.py
new file mode 100644
index 000000000..bda93f304
--- /dev/null
+++ b/filaments/utils/dotdict.py
@@ -0,0 +1,17 @@
+# https://stackoverflow.com/questions/2352181/how-to-use-a-dot-to-access-members-of-dictionary
+class dotdict(dict):
+ """dot.notation access to dictionary attributes"""
+ __getattr__ = dict.get
+ __setattr__ = dict.__setitem__
+ __delattr__ = dict.__delitem__
+
+
+def dotdictify(fn):
+ """
+ The decorator for converting the dict parameter to dot notation access dictionary.
+ """
+ def __wrap(kevent):
+ kevent = dotdict(kevent)
+ kevent.kparams = dotdict(kevent.kparams)
+ return fn(kevent)
+ return __wrap
diff --git a/filaments/created_files.py b/filaments/watch_files.py
similarity index 64%
rename from filaments/created_files.py
rename to filaments/watch_files.py
index 0b52bf1ce..e0cc8c3eb 100644
--- a/filaments/created_files.py
+++ b/filaments/watch_files.py
@@ -1,4 +1,4 @@
-# Copyright 2015/2016 by Nedim Sabic (RabbitStack)
+# Copyright 2019-2020 by Nedim Sabic (RabbitStack)
# All Rights Reserved.
# http://rabbitstack.github.io
@@ -15,23 +15,24 @@
# under the License.
"""
-Monitors the files created by processes
+Watches files and directories created in the file system
"""
-files = []
+from utils.dotdict import dotdictify
+
+__files__ = []
def on_init():
- set_filter('CreateFile')
+ kfilter("kevt.name = 'CreateFile' and file.operation = 'create'")
columns(["Process", "File"])
+@dotdictify
def on_next_kevent(kevent):
- if kevent.params.operation == 'CREATE' \
- and kevent.params.file_type == 'FILE':
- files.append((kevent.thread.name, kevent.params.file, ))
- for f in files:
+ file_name = kevent.kparams.file_name
+ if file_name:
+ __files__.append((kevent.exe, file_name, ))
+ for f in __files__:
add_row([f[0], f[1]])
- render_tabular()
-
-
+ render_table()
\ No newline at end of file
diff --git a/go.mod b/go.mod
new file mode 100644
index 000000000..04c1f767e
--- /dev/null
+++ b/go.mod
@@ -0,0 +1,36 @@
+module github.com/rabbitstack/fibratus
+
+require (
+ github.com/Microsoft/go-winio v0.4.14
+ github.com/akavel/rsrc v0.9.0 // indirect
+ github.com/briandowns/spinner v1.11.1
+ github.com/dustin/go-humanize v1.0.0
+ github.com/go-openapi/strfmt v0.19.4 // indirect
+ github.com/hashicorp/go-version v1.2.1
+ github.com/hillu/go-yara v1.2.1
+ github.com/inconshreveable/mousetrap v1.0.0 // indirect
+ github.com/jedib0t/go-pretty/v6 v6.0.1
+ github.com/magiconair/properties v1.8.1
+ github.com/mitchellh/mapstructure v1.1.2
+ github.com/olivere/elastic/v7 v7.0.20
+ github.com/phayes/freeport v0.0.0-20180830031419-95f893ade6f2
+ github.com/pkg/errors v0.9.1
+ github.com/rifflock/lfshook v0.0.0-20180920164130-b9218ef580f5
+ github.com/sirupsen/logrus v1.4.1
+ github.com/spf13/cobra v0.0.3
+ github.com/spf13/pflag v1.0.3
+ github.com/spf13/viper v1.6.2
+ github.com/streadway/amqp v1.0.0
+ github.com/stretchr/testify v1.5.1
+ github.com/valyala/bytebufferpool v1.0.0
+ github.com/valyala/gozstd v1.6.4
+ github.com/xeipuuv/gojsonschema v1.2.0
+ golang.org/x/sys v0.0.0-20190507160741-ecd444e8653b
+ golang.org/x/text v0.3.2
+ gopkg.in/alexcesaro/quotedprintable.v3 v3.0.0-20150716171945-2caba252f4dc // indirect
+ gopkg.in/gomail.v2 v2.0.0-20160411212932-81ebce5c23df
+ gopkg.in/natefinch/lumberjack.v2 v2.0.0
+ gopkg.in/yaml.v2 v2.2.4
+)
+
+go 1.15
diff --git a/go.sum b/go.sum
new file mode 100644
index 000000000..c9a772480
--- /dev/null
+++ b/go.sum
@@ -0,0 +1,283 @@
+cloud.google.com/go v0.26.0/go.mod h1:aQUYkXzVsufM+DwF1aE+0xfcU+56JwCaLick0ClmMTw=
+github.com/BurntSushi/toml v0.3.1 h1:WXkYYl6Yr3qBf1K79EBnL4mak0OimBfB0XUf9Vl28OQ=
+github.com/BurntSushi/toml v0.3.1/go.mod h1:xHWCNGjB5oqiDr8zfno3MHue2Ht5sIBksp03qcyfWMU=
+github.com/Microsoft/go-winio v0.4.14 h1:+hMXMk01us9KgxGb7ftKQt2Xpf5hH/yky+TDA+qxleU=
+github.com/Microsoft/go-winio v0.4.14/go.mod h1:qXqCSQ3Xa7+6tgxaGTIe4Kpcdsi+P8jBhyzoq1bpyYA=
+github.com/OneOfOne/xxhash v1.2.2/go.mod h1:HSdplMjZKSmBqAxg5vPj2TmRDmfkzw+cTzAElWljhcU=
+github.com/akavel/rsrc v0.9.0 h1:HwUDC0+tMFWqN4D5G+o5siGD4oVsC3jn6zM8ocjc3nY=
+github.com/akavel/rsrc v0.9.0/go.mod h1:uLoCtb9J+EyAqh+26kdrTgmzRBFPGOolLWKpdxkKq+c=
+github.com/alecthomas/template v0.0.0-20160405071501-a0175ee3bccc/go.mod h1:LOuyumcjzFXgccqObfd/Ljyb9UuFJ6TxHnclSeseNhc=
+github.com/alecthomas/units v0.0.0-20151022065526-2efee857e7cf/go.mod h1:ybxpYRFXyAe+OPACYpWeL0wqObRcbAqCMya13uyzqw0=
+github.com/armon/consul-api v0.0.0-20180202201655-eb2c6b5be1b6/go.mod h1:grANhF5doyWs3UAsr3K4I6qtAmlQcZDesFNEHPZAzj8=
+github.com/asaskevich/govalidator v0.0.0-20180720115003-f9ffefc3facf/go.mod h1:lB+ZfQJz7igIIfQNfa7Ml4HSf2uFQQRzpGGRXenZAgY=
+github.com/asaskevich/govalidator v0.0.0-20190424111038-f61b66f89f4a h1:idn718Q4B6AGu/h5Sxe66HYVdqdGu2l9Iebqhi/AEoA=
+github.com/asaskevich/govalidator v0.0.0-20190424111038-f61b66f89f4a/go.mod h1:lB+ZfQJz7igIIfQNfa7Ml4HSf2uFQQRzpGGRXenZAgY=
+github.com/aws/aws-sdk-go v1.34.13/go.mod h1:5zCpMtNQVjRREroY7sYe8lOMRSxkhG6MZveU8YkpAk0=
+github.com/beorn7/perks v0.0.0-20180321164747-3a771d992973/go.mod h1:Dwedo/Wpr24TaqPxmxbtue+5NUziq4I4S80YR8gNf3Q=
+github.com/beorn7/perks v1.0.0/go.mod h1:KWe93zE9D1o94FZ5RNwFwVgaQK1VOXiVxmqh+CedLV8=
+github.com/briandowns/spinner v1.11.1 h1:OixPqDEcX3juo5AjQZAnFPbeUA0jvkp2qzB5gOZJ/L0=
+github.com/briandowns/spinner v1.11.1/go.mod h1:QOuQk7x+EaDASo80FEXwlwiA+j/PPIcX3FScO+3/ZPQ=
+github.com/cespare/xxhash v1.1.0/go.mod h1:XrSqR1VqqWfGrhpAt58auRo0WTKS1nRRg3ghfAqPWnc=
+github.com/client9/misspell v0.3.4/go.mod h1:qj6jICC3Q7zFZvVWo7KLAzC3yx5G7kyvSDkc90ppPyw=
+github.com/coreos/bbolt v1.3.2/go.mod h1:iRUV2dpdMOn7Bo10OQBFzIJO9kkE559Wcmn+qkEiiKk=
+github.com/coreos/etcd v3.3.10+incompatible/go.mod h1:uF7uidLiAD3TWHmW31ZFd/JWoc32PjwdhPthX9715RE=
+github.com/coreos/go-semver v0.2.0/go.mod h1:nnelYz7RCh+5ahJtPPxZlU+153eP4D4r3EedlOD2RNk=
+github.com/coreos/go-systemd v0.0.0-20190321100706-95778dfbb74e/go.mod h1:F5haX7vjVVG0kc13fIWeqUViNPyEJxv/OmvnBo0Yme4=
+github.com/coreos/pkg v0.0.0-20180928190104-399ea9e2e55f/go.mod h1:E3G3o1h8I7cfcXa63jLwjI0eiQQMgzzUDFVpN/nH/eA=
+github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
+github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
+github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
+github.com/dgrijalva/jwt-go v3.2.0+incompatible/go.mod h1:E3ru+11k8xSBh+hMPgOLZmtrrCbhqsmaPHjLKYnJCaQ=
+github.com/dgryski/go-sip13 v0.0.0-20181026042036-e10d5fee7954/go.mod h1:vAd38F8PWV+bWy6jNmig1y/TA+kYO4g3RSRF0IAv0no=
+github.com/dustin/go-humanize v1.0.0 h1:VSnTsYCnlFHaM2/igO1h6X3HA71jcobQuxemgkq4zYo=
+github.com/dustin/go-humanize v1.0.0/go.mod h1:HtrtbFcZ19U5GC7JDqmcUSB87Iq5E25KnS6fMYU6eOk=
+github.com/fatih/color v1.7.0 h1:DkWD4oS2D8LGGgTQ6IvwJJXSL5Vp2ffcQg58nFV38Ys=
+github.com/fatih/color v1.7.0/go.mod h1:Zm6kSWBoL9eyXnKyktHP6abPY2pDugNf5KwzbycvMj4=
+github.com/fortytw2/leaktest v1.3.0 h1:u8491cBMTQ8ft8aeV+adlcytMZylmA5nnwwkRZjI8vw=
+github.com/fortytw2/leaktest v1.3.0/go.mod h1:jDsjWgpAGjm2CA7WthBh/CdZYEPF31XHquHwclZch5g=
+github.com/fsnotify/fsnotify v1.4.7 h1:IXs+QLmnXW2CcXuY+8Mzv/fWEsPGWxqefPtCP5CnV9I=
+github.com/fsnotify/fsnotify v1.4.7/go.mod h1:jwhsz4b93w/PPRr/qN1Yymfu8t87LnFCMoQvtojpjFo=
+github.com/ghodss/yaml v1.0.0/go.mod h1:4dBDuWmgqj2HViK6kFavaiC9ZROes6MMH2rRYeMEF04=
+github.com/globalsign/mgo v0.0.0-20180905125535-1ca0a4f7cbcb/go.mod h1:xkRDCp4j0OGD1HRkm4kmhM+pmpv3AKq5SU7GMg4oO/Q=
+github.com/globalsign/mgo v0.0.0-20181015135952-eeefdecb41b8/go.mod h1:xkRDCp4j0OGD1HRkm4kmhM+pmpv3AKq5SU7GMg4oO/Q=
+github.com/go-kit/kit v0.8.0/go.mod h1:xBxKIO96dXMWWy0MnWVtmwkA9/13aqxPnvrjFYMA2as=
+github.com/go-logfmt/logfmt v0.3.0/go.mod h1:Qt1PoO58o5twSAckw1HlFXLmHsOX5/0LbT9GBnD5lWE=
+github.com/go-logfmt/logfmt v0.4.0/go.mod h1:3RMwSq7FuexP4Kalkev3ejPJsZTpXXBr9+V4qmtdjCk=
+github.com/go-openapi/errors v0.17.0/go.mod h1:LcZQpmvG4wyF5j4IhA73wkLFQg+QJXOQHVjmcZxhka0=
+github.com/go-openapi/errors v0.19.0/go.mod h1:LcZQpmvG4wyF5j4IhA73wkLFQg+QJXOQHVjmcZxhka0=
+github.com/go-openapi/errors v0.19.2 h1:a2kIyV3w+OS3S97zxUndRVD46+FhGOUBDFY7nmu4CsY=
+github.com/go-openapi/errors v0.19.2/go.mod h1:qX0BLWsyaKfvhluLejVpVNwNRdXZhEbTA4kxxpKBC94=
+github.com/go-openapi/strfmt v0.19.0/go.mod h1:+uW+93UVvGGq2qGaZxdDeJqSAqBqBdl+ZPMF/cC8nDY=
+github.com/go-openapi/strfmt v0.19.4 h1:eRvaqAhpL0IL6Trh5fDsGnGhiXndzHFuA05w6sXH6/g=
+github.com/go-openapi/strfmt v0.19.4/go.mod h1:eftuHTlB/dI8Uq8JJOyRlieZf+WkkxUuk0dgdHXr2Qk=
+github.com/go-sql-driver/mysql v1.5.0/go.mod h1:DCzpHaOWr8IXmIStZouvnhqoel9Qv2LBy8hT2VhHyBg=
+github.com/go-stack/stack v1.8.0 h1:5SgMzNM5HxrEjV0ww2lTmX6E2Izsfxas4+YHWRs3Lsk=
+github.com/go-stack/stack v1.8.0/go.mod h1:v0f6uXyyMGvRgIKkXu+yp6POWl0qKG85gN/melR3HDY=
+github.com/gogo/protobuf v1.1.1/go.mod h1:r8qH/GZQm5c6nD/R0oafs1akxWv10x8SbQlK7atdtwQ=
+github.com/gogo/protobuf v1.2.1/go.mod h1:hp+jE20tsWTFYpLwKvXlhS1hjn+gTNwPg2I6zVXpSg4=
+github.com/golang/glog v0.0.0-20160126235308-23def4e6c14b/go.mod h1:SBH7ygxi8pfUlaOkMMuAQtPIUF8ecWP5IEl/CR7VP2Q=
+github.com/golang/groupcache v0.0.0-20190129154638-5b532d6fd5ef/go.mod h1:cIg4eruTrX1D+g88fzRXU5OdNfaM+9IcxsU14FzY7Hc=
+github.com/golang/groupcache v0.0.0-20190702054246-869f871628b6/go.mod h1:cIg4eruTrX1D+g88fzRXU5OdNfaM+9IcxsU14FzY7Hc=
+github.com/golang/mock v1.1.1/go.mod h1:oTYuIxOrZwtPieC+H1uAHpcLFnEyAGVDL/k47Jfbm0A=
+github.com/golang/protobuf v1.2.0/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U=
+github.com/golang/protobuf v1.3.1/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U=
+github.com/google/btree v1.0.0/go.mod h1:lNA+9X1NB3Zf8V7Ke586lFgjr2dZNuvo3lPJSGZ5JPQ=
+github.com/google/go-cmp v0.2.0/go.mod h1:oXzfMopK8JAjlY9xF4vHSVASa0yLyX7SntLO5aqRK0M=
+github.com/google/go-cmp v0.3.0 h1:crn/baboCvb5fXaQ0IJ1SGTsTVrWpDsCWC8EGETZijY=
+github.com/google/go-cmp v0.3.0/go.mod h1:8QqcDgzrUqlUb/G2PQTWiueGozuR1884gddMywk6iLU=
+github.com/google/go-cmp v0.5.2 h1:X2ev0eStA3AbceY54o37/0PQ/UWqKEiiO2dKL5OPaFM=
+github.com/google/go-cmp v0.5.2/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
+github.com/google/uuid v1.1.1 h1:Gkbcsh/GbpXz7lPftLA3P6TYMwjCLYm83jiFQZF/3gY=
+github.com/google/uuid v1.1.1/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
+github.com/gopherjs/gopherjs v0.0.0-20181017120253-0766667cb4d1 h1:EGx4pi6eqNxGaHF6qqu48+N2wcFQ5qg5FXgOdqsJ5d8=
+github.com/gopherjs/gopherjs v0.0.0-20181017120253-0766667cb4d1/go.mod h1:wJfORRmW1u3UXTncJ5qlYoELFm8eSnnEO6hX4iZ3EWY=
+github.com/gorilla/websocket v1.4.0/go.mod h1:E7qHFY5m1UJ88s3WnNqhKjPHQ0heANvMoAMk2YaljkQ=
+github.com/grpc-ecosystem/go-grpc-middleware v1.0.0/go.mod h1:FiyG127CGDf3tlThmgyCl78X/SZQqEOJBCDaAfeWzPs=
+github.com/grpc-ecosystem/go-grpc-prometheus v1.2.0/go.mod h1:8NvIoxWQoOIhqOTXgfV/d3M/q6VIi02HzZEHgUlZvzk=
+github.com/grpc-ecosystem/grpc-gateway v1.9.0/go.mod h1:vNeuVxBJEsws4ogUvrchl83t/GYV9WGTSLVdBhOQFDY=
+github.com/hashicorp/go-version v1.2.1 h1:zEfKbn2+PDgroKdiOzqiE8rsmLqU2uwi5PB5pBJ3TkI=
+github.com/hashicorp/go-version v1.2.1/go.mod h1:fltr4n8CU8Ke44wwGCBoEymUuxUHl09ZGVZPK5anwXA=
+github.com/hashicorp/hcl v1.0.0 h1:0Anlzjpi4vEasTeNFn2mLJgTSwt0+6sfsiTG8qcWGx4=
+github.com/hashicorp/hcl v1.0.0/go.mod h1:E5yfLk+7swimpb2L/Alb/PJmXilQ/rhwaUYs4T20WEQ=
+github.com/hillu/go-yara v1.2.1 h1:th+MRa37XEuugX/eeSgfNRwf+lYNuClt28AJGrGhzdc=
+github.com/hillu/go-yara v1.2.1/go.mod h1:KLxCsvD3F8cgVK866UDHi961qbzP+twKjhNdDsuz/2M=
+github.com/inconshreveable/mousetrap v1.0.0 h1:Z8tu5sraLXCXIcARxBp/8cbvlwVa7Z1NHg9XEKhtSvM=
+github.com/inconshreveable/mousetrap v1.0.0/go.mod h1:PxqpIevigyE2G7u3NXJIT2ANytuPF1OarO4DADm73n8=
+github.com/jedib0t/go-pretty/v6 v6.0.1 h1:uUMwi75B5+yaLy6sldJusQYXXkTttIxnsDBzNYL+XdI=
+github.com/jedib0t/go-pretty/v6 v6.0.1/go.mod h1:Qu/2Or3TWvmQjNOb13IwTwj8msdvAmiPANdOUTt7Z+Q=
+github.com/jmespath/go-jmespath v0.3.0/go.mod h1:9QtRXoHjLGCJ5IBSaohpXITPlowMeeYCZ7fLUTSywik=
+github.com/jonboulle/clockwork v0.1.0/go.mod h1:Ii8DK3G1RaLaWxj9trq07+26W01tbo22gdxWY5EU2bo=
+github.com/josharian/intern v1.0.0 h1:vlS4z54oSdjm0bgjRigI+G1HpF+tI+9rE5LLzOg8HmY=
+github.com/josharian/intern v1.0.0/go.mod h1:5DoeVV0s6jJacbCEi61lwdGj/aVlrQvzHFFd8Hwg//Y=
+github.com/jtolds/gls v4.20.0+incompatible h1:xdiiI2gbIgH/gLH7ADydsJ1uDOEzR8yvV7C0MuV77Wo=
+github.com/jtolds/gls v4.20.0+incompatible/go.mod h1:QJZ7F/aHp+rZTRtaJ1ow/lLfFfVYBRgL+9YlvaHOwJU=
+github.com/julienschmidt/httprouter v1.2.0/go.mod h1:SYymIcj16QtmaHHD7aYtjjsJG7VTCxuUUipMqKk8s4w=
+github.com/kisielk/errcheck v1.1.0/go.mod h1:EZBBE59ingxPouuu3KfxchcWSUPOHkagtvWXihfKN4Q=
+github.com/kisielk/gotool v1.0.0/go.mod h1:XhKaO+MFFWcvkIS/tQcRk01m1F5IRFswLeQ+oQHNcck=
+github.com/konsorten/go-windows-terminal-sequences v1.0.1 h1:mweAR1A6xJ3oS2pRaGiHgQ4OO8tzTaLawm8vnODuwDk=
+github.com/konsorten/go-windows-terminal-sequences v1.0.1/go.mod h1:T0+1ngSBFLxvqU3pZ+m/2kptfBszLMUkC4ZK/EgS/cQ=
+github.com/kr/logfmt v0.0.0-20140226030751-b84e30acd515/go.mod h1:+0opPa2QZZtGFBFZlji/RkVcI2GknAs/DXo4wKdlNEc=
+github.com/kr/pretty v0.1.0 h1:L/CwN0zerZDmRFUapSPitk6f+Q3+0za1rQkzVuMiMFI=
+github.com/kr/pretty v0.1.0/go.mod h1:dAy3ld7l9f0ibDNOQOHHMYYIIbhfbHSm3C4ZsoJORNo=
+github.com/kr/pty v1.1.1/go.mod h1:pFQYn66WHrOpPYNljwOMqo10TkYh1fy3cYio2l3bCsQ=
+github.com/kr/text v0.1.0 h1:45sCR5RtlFHMR4UwH9sdQ5TC8v0qDQCHnXt+kaKSTVE=
+github.com/kr/text v0.1.0/go.mod h1:4Jbv+DJW3UT/LiOwJeYQe1efqtUx/iVham/4vfdArNI=
+github.com/magiconair/properties v1.8.1 h1:ZC2Vc7/ZFkGmsVC9KvOjumD+G5lXy2RtTKyzRKO2BQ4=
+github.com/magiconair/properties v1.8.1/go.mod h1:PppfXfuXeibc/6YijjN8zIbojt8czPbwD3XqdrwzmxQ=
+github.com/mailru/easyjson v0.0.0-20180823135443-60711f1a8329/go.mod h1:C1wdFJiN94OJF2b5HbByQZoLdCWB1Yqtg26g4irojpc=
+github.com/mailru/easyjson v0.0.0-20190403194419-1ea4449da983/go.mod h1:C1wdFJiN94OJF2b5HbByQZoLdCWB1Yqtg26g4irojpc=
+github.com/mailru/easyjson v0.7.6 h1:8yTIVnZgCoiM1TgqoeTl+LfU5Jg6/xL3QhGQnimLYnA=
+github.com/mailru/easyjson v0.7.6/go.mod h1:xzfreul335JAWq5oZzymOObrkdz5UnU4kGfJJLY9Nlc=
+github.com/mattn/go-colorable v0.1.2 h1:/bC9yWikZXAL9uJdulbSfyVNIR3n3trXl+v8+1sx8mU=
+github.com/mattn/go-colorable v0.1.2/go.mod h1:U0ppj6V5qS13XJ6of8GYAs25YV2eR4EVcfRqFIhoBtE=
+github.com/mattn/go-isatty v0.0.8 h1:HLtExJ+uU2HOZ+wI0Tt5DtUDrx8yhUqDcp7fYERX4CE=
+github.com/mattn/go-isatty v0.0.8/go.mod h1:Iq45c/XA43vh69/j3iqttzPXn0bhXyGjM0Hdxcsrc5s=
+github.com/mattn/go-runewidth v0.0.9 h1:Lm995f3rfxdpd6TSmuVCHVb/QhupuXlYr8sCI/QdE+0=
+github.com/mattn/go-runewidth v0.0.9/go.mod h1:H031xJmbD/WCDINGzjvQ9THkh0rPKHF+m2gUSrubnMI=
+github.com/matttproud/golang_protobuf_extensions v1.0.1/go.mod h1:D8He9yQNgCq6Z5Ld7szi9bcBfOoFv/3dc6xSMkL2PC0=
+github.com/mitchellh/mapstructure v1.1.2 h1:fmNYVwqnSfB9mZU6OS2O6GsXM+wcskZDuKQzvN1EDeE=
+github.com/mitchellh/mapstructure v1.1.2/go.mod h1:FVVH3fgwuzCH5S8UJGiWEs2h04kUh9fWfEaFds41c1Y=
+github.com/mwitkow/go-conntrack v0.0.0-20161129095857-cc309e4a2223/go.mod h1:qRWi+5nqEBWmkhHvq77mSJWrCKwh8bxhgT7d/eI7P4U=
+github.com/oklog/ulid v1.3.1/go.mod h1:CirwcVhetQ6Lv90oh/F+FBtV6XMibvdAFo93nm5qn4U=
+github.com/olivere/elastic/v7 v7.0.20 h1:5FFpGPVJlBSlWBOdict406Y3yNTIpVpAiUvdFZeSbAo=
+github.com/olivere/elastic/v7 v7.0.20/go.mod h1:Kh7iIsXIBl5qRQOBFoylCsXVTtye3keQU2Y/YbR7HD8=
+github.com/opentracing/opentracing-go v1.2.0/go.mod h1:GxEUsuufX4nBwe+T+Wl9TAgYrxe9dPLANfrWvHYVTgc=
+github.com/pelletier/go-toml v1.2.0 h1:T5zMGML61Wp+FlcbWjRDT7yAxhJNAiPPLOFECq181zc=
+github.com/pelletier/go-toml v1.2.0/go.mod h1:5z9KED0ma1S8pY6P1sdut58dfprrGBbd/94hg7ilaic=
+github.com/phayes/freeport v0.0.0-20180830031419-95f893ade6f2 h1:JhzVVoYvbOACxoUmOs6V/G4D5nPVUW73rKvXxP4XUJc=
+github.com/phayes/freeport v0.0.0-20180830031419-95f893ade6f2/go.mod h1:iIss55rKnNBTvrwdmkUpLnDpZoAHvWaiq5+iMmen4AE=
+github.com/pkg/errors v0.8.0/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
+github.com/pkg/errors v0.8.1 h1:iURUrRGxPUNPdy5/HRSm+Yj6okJ6UtLINN0Q9M4+h3I=
+github.com/pkg/errors v0.8.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
+github.com/pkg/errors v0.9.1 h1:FEBLx1zS214owpjy7qsBeixbURkuhQAwrK5UwLGTwt4=
+github.com/pkg/errors v0.9.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
+github.com/pkg/profile v1.2.1/go.mod h1:hJw3o1OdXxsrSjjVksARp5W95eeEaEfptyVZyv6JUPA=
+github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
+github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
+github.com/prometheus/client_golang v0.9.1/go.mod h1:7SWBe2y4D6OKWSNQJUaRYU/AaXPKyh/dDVn+NZz0KFw=
+github.com/prometheus/client_golang v0.9.3/go.mod h1:/TN21ttK/J9q6uSwhBd54HahCDft0ttaMvbicHlPoso=
+github.com/prometheus/client_model v0.0.0-20180712105110-5c3871d89910/go.mod h1:MbSGuTsp3dbXC40dX6PRTWyKYBIrTGTE9sqQNg2J8bo=
+github.com/prometheus/client_model v0.0.0-20190129233127-fd36f4220a90/go.mod h1:xMI15A0UPsDsEKsMN9yxemIoYk6Tm2C1GtYGdfGttqA=
+github.com/prometheus/common v0.0.0-20181113130724-41aa239b4cce/go.mod h1:daVV7qP5qjZbuso7PdcryaAu0sAZbrN9i7WWcTMWvro=
+github.com/prometheus/common v0.4.0/go.mod h1:TNfzLD0ON7rHzMJeJkieUDPYmFC7Snx/y86RQel1bk4=
+github.com/prometheus/procfs v0.0.0-20181005140218-185b4288413d/go.mod h1:c3At6R/oaqEKCNdg8wHV1ftS6bRYblBhIjjI8uT2IGk=
+github.com/prometheus/procfs v0.0.0-20190507164030-5867b95ac084/go.mod h1:TjEm7ze935MbeOT/UhFTIMYKhuLP4wbCsTZCD3I8kEA=
+github.com/prometheus/tsdb v0.7.1/go.mod h1:qhTCs0VvXwvX/y3TZrWD7rabWM+ijKTux40TwIPHuXU=
+github.com/rifflock/lfshook v0.0.0-20180920164130-b9218ef580f5 h1:mZHayPoR0lNmnHyvtYjDeq0zlVHn9K/ZXoy17ylucdo=
+github.com/rifflock/lfshook v0.0.0-20180920164130-b9218ef580f5/go.mod h1:GEXHk5HgEKCvEIIrSpFI3ozzG5xOKA2DVlEX/gGnewM=
+github.com/rogpeppe/fastuuid v0.0.0-20150106093220-6724a57986af/go.mod h1:XWv6SoW27p1b0cqNHllgS5HIMJraePCO15w5zCzIWYg=
+github.com/sirupsen/logrus v1.2.0/go.mod h1:LxeOpSwHxABJmUn/MG1IvRgCAasNZTLOkJPxbbu5VWo=
+github.com/sirupsen/logrus v1.4.1 h1:GL2rEmy6nsikmW0r8opw9JIRScdMF5hA8cOYLH7In1k=
+github.com/sirupsen/logrus v1.4.1/go.mod h1:ni0Sbl8bgC9z8RoU9G6nDWqqs/fq4eDPysMBDgk/93Q=
+github.com/smartystreets/assertions v0.0.0-20180927180507-b2de0cb4f26d h1:zE9ykElWQ6/NYmHa3jpm/yHnI4xSofP+UP6SpjHcSeM=
+github.com/smartystreets/assertions v0.0.0-20180927180507-b2de0cb4f26d/go.mod h1:OnSkiWE9lh6wB0YB77sQom3nweQdgAjqCqsofrRNTgc=
+github.com/smartystreets/assertions v1.1.1 h1:T/YLemO5Yp7KPzS+lVtu+WsHn8yoSwTfItdAd1r3cck=
+github.com/smartystreets/assertions v1.1.1/go.mod h1:tcbTF8ujkAEcZ8TElKY+i30BzYlVhC/LOxJk7iOWnoo=
+github.com/smartystreets/go-aws-auth v0.0.0-20180515143844-0c1422d1fdb9/go.mod h1:SnhjPscd9TpLiy1LpzGSKh3bXCfxxXuqd9xmQJy3slM=
+github.com/smartystreets/goconvey v1.6.4 h1:fv0U8FUIMPNf1L9lnHLvLhgicrIVChEkdzIKYqbNC9s=
+github.com/smartystreets/goconvey v1.6.4/go.mod h1:syvi0/a8iFYH4r/RixwvyeAJjdLS9QV7WQ/tjFTllLA=
+github.com/smartystreets/gunit v1.4.2/go.mod h1:ZjM1ozSIMJlAz/ay4SG8PeKF00ckUp+zMHZXV9/bvak=
+github.com/soheilhy/cmux v0.1.4/go.mod h1:IM3LyeVVIOuxMH7sFAkER9+bJ4dT7Ms6E4xg4kGIyLM=
+github.com/spaolacci/murmur3 v0.0.0-20180118202830-f09979ecbc72/go.mod h1:JwIasOWyU6f++ZhiEuf87xNszmSA2myDM2Kzu9HwQUA=
+github.com/spf13/afero v1.1.2 h1:m8/z1t7/fwjysjQRYbP0RD+bUIF/8tJwPdEZsI83ACI=
+github.com/spf13/afero v1.1.2/go.mod h1:j4pytiNVoe2o6bmDsKpLACNPDBIoEAkihy7loJ1B0CQ=
+github.com/spf13/cast v1.3.0 h1:oget//CVOEoFewqQxwr0Ej5yjygnqGkvggSE/gB35Q8=
+github.com/spf13/cast v1.3.0/go.mod h1:Qx5cxh0v+4UWYiBimWS+eyWzqEqokIECu5etghLkUJE=
+github.com/spf13/cobra v0.0.3 h1:ZlrZ4XsMRm04Fr5pSFxBgfND2EBVa1nLpiy1stUsX/8=
+github.com/spf13/cobra v0.0.3/go.mod h1:1l0Ry5zgKvJasoi3XT1TypsSe7PqH0Sj9dhYf7v3XqQ=
+github.com/spf13/jwalterweatherman v1.0.0 h1:XHEdyB+EcvlqZamSM4ZOMGlc93t6AcsBEu9Gc1vn7yk=
+github.com/spf13/jwalterweatherman v1.0.0/go.mod h1:cQK4TGJAtQXfYWX+Ddv3mKDzgVb68N+wFjFa4jdeBTo=
+github.com/spf13/pflag v1.0.3 h1:zPAT6CGy6wXeQ7NtTnaTerfKOsV6V6F8agHXFiazDkg=
+github.com/spf13/pflag v1.0.3/go.mod h1:DYY7MBk1bdzusC3SYhjObp+wFpr4gzcvqqNjLnInEg4=
+github.com/spf13/viper v1.6.2 h1:7aKfF+e8/k68gda3LOjo5RxiUqddoFxVq4BKBPrxk5E=
+github.com/spf13/viper v1.6.2/go.mod h1:t3iDnF5Jlj76alVNuyFBk5oUMCvsrkbvZK0WQdfDi5k=
+github.com/streadway/amqp v1.0.0 h1:kuuDrUJFZL1QYL9hUNuCxNObNzB0bV/ZG5jV3RWAQgo=
+github.com/streadway/amqp v1.0.0/go.mod h1:AZpEONHx3DKn8O/DFsRAY58/XVQiIPMTMB1SddzLXVw=
+github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
+github.com/stretchr/objx v0.1.1 h1:2vfRuCMp5sSVIDSqO8oNnWJq7mPa6KVP3iPIwFBuy8A=
+github.com/stretchr/objx v0.1.1/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
+github.com/stretchr/objx v0.2.0 h1:Hbg2NidpLE8veEBkEZTL3CvlkUIVzuU9jDplZO54c48=
+github.com/stretchr/objx v0.2.0/go.mod h1:qt09Ya8vawLte6SNmTgCsAVtYtaKzEcn8ATUoHMkEqE=
+github.com/stretchr/testify v1.2.2/go.mod h1:a8OnRcib4nhh0OaRAV+Yts87kKdq0PP7pXfy6kDkUVs=
+github.com/stretchr/testify v1.3.0 h1:TivCn/peBQ7UY8ooIcPgZFpTNSz0Q2U6UrFlUfqbe0Q=
+github.com/stretchr/testify v1.3.0/go.mod h1:M5WIy9Dh21IEIfnGCwXGc5bZfKNJtfHm1UVUgZn+9EI=
+github.com/stretchr/testify v1.4.0 h1:2E4SXV/wtOkTonXsotYi4li6zVWxYlZuYNCXe9XRJyk=
+github.com/stretchr/testify v1.4.0/go.mod h1:j7eGeouHqKxXV5pUuKE4zz7dFj8WfuZ+81PSLYec5m4=
+github.com/stretchr/testify v1.5.1 h1:nOGnQDM7FYENwehXlg/kFVnos3rEvtKTjRvOWSzb6H4=
+github.com/stretchr/testify v1.5.1/go.mod h1:5W2xD1RspED5o8YsWQXVCued0rvSQ+mT+I5cxcmMvtA=
+github.com/subosito/gotenv v1.2.0 h1:Slr1R9HxAlEKefgq5jn9U+DnETlIUa6HfgEzj0g5d7s=
+github.com/subosito/gotenv v1.2.0/go.mod h1:N0PQaV/YGNqwC0u51sEeR/aUtSLEXKX9iv69rRypqCw=
+github.com/tidwall/pretty v1.0.0 h1:HsD+QiTn7sK6flMKIvNmpqz1qrpP3Ps6jOKIKMooyg4=
+github.com/tidwall/pretty v1.0.0/go.mod h1:XNkn88O1ChpSDQmQeStsy+sBenx6DDtFZJxhVysOjyk=
+github.com/tmc/grpc-websocket-proxy v0.0.0-20190109142713-0ad062ec5ee5/go.mod h1:ncp9v5uamzpCO7NfCPTXjqaC+bZgJeR0sMTm6dMHP7U=
+github.com/ugorji/go v1.1.4/go.mod h1:uQMGLiO92mf5W77hV/PUCpI3pbzQx3CRekS0kk+RGrc=
+github.com/valyala/bytebufferpool v1.0.0 h1:GqA5TC/0021Y/b9FG4Oi9Mr3q7XYx6KllzawFIhcdPw=
+github.com/valyala/bytebufferpool v1.0.0/go.mod h1:6bBcMArwyJ5K/AmCkWv1jt77kVWyCJ6HpOuEn7z0Csc=
+github.com/valyala/gozstd v1.6.4 h1:nFLddjEf90SFl5cVWyElSHozQDsbvLljPK703/skBS0=
+github.com/valyala/gozstd v1.6.4/go.mod h1:y5Ew47GLlP37EkTB+B4s7r6A5rdaeB7ftbl9zoYiIPQ=
+github.com/xeipuuv/gojsonpointer v0.0.0-20180127040702-4e3ac2762d5f h1:J9EGpcZtP0E/raorCMxlFGSTBrsSlaDGf3jU/qvAE2c=
+github.com/xeipuuv/gojsonpointer v0.0.0-20180127040702-4e3ac2762d5f/go.mod h1:N2zxlSyiKSe5eX1tZViRH5QA0qijqEDrYZiPEAiq3wU=
+github.com/xeipuuv/gojsonreference v0.0.0-20180127040603-bd5ef7bd5415 h1:EzJWgHovont7NscjpAxXsDA8S8BMYve8Y5+7cuRE7R0=
+github.com/xeipuuv/gojsonreference v0.0.0-20180127040603-bd5ef7bd5415/go.mod h1:GwrjFmJcFw6At/Gs6z4yjiIwzuJ1/+UwLxMQDVQXShQ=
+github.com/xeipuuv/gojsonschema v1.2.0 h1:LhYJRs+L4fBtjZUfuSZIKGeVu0QRy8e5Xi7D17UxZ74=
+github.com/xeipuuv/gojsonschema v1.2.0/go.mod h1:anYRn/JVcOK2ZgGU+IjEV4nwlhoK5sQluxsYJ78Id3Y=
+github.com/xiang90/probing v0.0.0-20190116061207-43a291ad63a2/go.mod h1:UETIi67q53MR2AWcXfiuqkDkRtnGDLqkBTpCHuJHxtU=
+github.com/xordataexchange/crypt v0.0.3-0.20170626215501-b2862e3d0a77/go.mod h1:aYKd//L2LvnjZzWKhF00oedf4jCCReLcmhLdhm1A27Q=
+go.etcd.io/bbolt v1.3.2/go.mod h1:IbVyRI1SCnLcuJnV2u8VeU0CEYM7e686BmAb1XKL+uU=
+go.mongodb.org/mongo-driver v1.0.3 h1:GKoji1ld3tw2aC+GX1wbr/J2fX13yNacEYoJ8Nhr0yU=
+go.mongodb.org/mongo-driver v1.0.3/go.mod h1:u7ryQJ+DOzQmeO7zB6MHyr8jkEQvC8vH7qLUO4lqsUM=
+go.opencensus.io v0.22.4/go.mod h1:yxeiOL68Rb0Xd1ddK5vPZ/oVn4vY4Ynel7k9FzqtOIw=
+go.uber.org/atomic v1.4.0/go.mod h1:gD2HeocX3+yG+ygLZcrzQJaqmWj9AIm7n08wl/qW/PE=
+go.uber.org/multierr v1.1.0/go.mod h1:wR5kodmAFQ0UK8QlbwjlSNy0Z68gJhDJUG5sjR94q/0=
+go.uber.org/zap v1.10.0/go.mod h1:vwi/ZaCAaUcBkycHslxD9B2zi4UTXhF60s6SWpuDF0Q=
+golang.org/x/crypto v0.0.0-20180904163835-0709b304e793/go.mod h1:6SG95UA2DQfeDnfUPMdvaQW0Q7yPrPDi9nlGo2tz2b4=
+golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2 h1:VklqNMn3ovrHsnt90PveolxSbWFaJdECFbxSq0Mqo2M=
+golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
+golang.org/x/exp v0.0.0-20190121172915-509febef88a4/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
+golang.org/x/lint v0.0.0-20181026193005-c67002cb31c3/go.mod h1:UVdnD1Gm6xHRNCYTkRU2/jEulfH38KcIWyp/GAMgvoE=
+golang.org/x/lint v0.0.0-20190227174305-5b3e6a55c961/go.mod h1:wehouNa3lNwaWXcvxsM5YxQ5yQlVC4a0KAMCusXpPoU=
+golang.org/x/lint v0.0.0-20190313153728-d0100b6bd8b3/go.mod h1:6SW0HCj/g11FgYtHlgUYUwCkIfeOF89ocIRzGO/8vkc=
+golang.org/x/net v0.0.0-20180724234803-3673e40ba225/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
+golang.org/x/net v0.0.0-20180826012351-8a410e7b638d/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
+golang.org/x/net v0.0.0-20181114220301-adae6a3d119a/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
+golang.org/x/net v0.0.0-20181220203305-927f97764cc3/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
+golang.org/x/net v0.0.0-20190213061140-3a22650c66bd/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
+golang.org/x/net v0.0.0-20190311183353-d8887717615a/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
+golang.org/x/net v0.0.0-20190522155817-f3200d17e092/go.mod h1:HSz+uSET+XFnRR8LxR5pz3Of3rY3CfYBVs4xY44aLks=
+golang.org/x/net v0.0.0-20190620200207-3b0461eec859/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
+golang.org/x/net v0.0.0-20200202094626-16171245cfb2/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
+golang.org/x/oauth2 v0.0.0-20180821212333-d2e6202438be/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U=
+golang.org/x/sync v0.0.0-20180314180146-1d60e4601c6f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
+golang.org/x/sync v0.0.0-20181108010431-42b317875d0f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
+golang.org/x/sync v0.0.0-20181221193216-37e7f081c4d4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
+golang.org/x/sync v0.0.0-20190227155943-e225da77a7e6/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
+golang.org/x/sys v0.0.0-20180816055513-1c9583448a9c/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
+golang.org/x/sys v0.0.0-20180830151530-49385e6e1522/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
+golang.org/x/sys v0.0.0-20180905080454-ebe1bf3edb33/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
+golang.org/x/sys v0.0.0-20181107165924-66b7b1311ac8/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
+golang.org/x/sys v0.0.0-20181116152217-5ac8a444bdc5/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
+golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
+golang.org/x/sys v0.0.0-20190222072716-a9d3bda3a223/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
+golang.org/x/sys v0.0.0-20190502145724-3ef323f4f1fd/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20190507160741-ecd444e8653b h1:ag/x1USPSsqHud38I9BAC88qdNLDHHtQ4mlgQIZPPNA=
+golang.org/x/sys v0.0.0-20190507160741-ecd444e8653b/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/text v0.3.0 h1:g61tztE5qeGQ89tm6NTjjM9VPIm088od1l6aSorWRWg=
+golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
+golang.org/x/text v0.3.2 h1:tW2bmiBqwgJj/UpqtC8EpXEZVYOwU0yG4iWbprSVAcs=
+golang.org/x/text v0.3.2/go.mod h1:bEr9sfX3Q8Zfm5fL9x+3itogRgK3+ptLWKqgva+5dAk=
+golang.org/x/time v0.0.0-20190308202827-9d24e82272b4/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
+golang.org/x/tools v0.0.0-20180221164845-07fd8470d635/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
+golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
+golang.org/x/tools v0.0.0-20190114222345-bf090417da8b/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
+golang.org/x/tools v0.0.0-20190226205152-f727befe758c/go.mod h1:9Yl7xja0Znq3iFh3HoIrodX9oNMXvdceNzlUR8zjMvY=
+golang.org/x/tools v0.0.0-20190311212946-11955173bddd/go.mod h1:LCzVGOaR6xXOjkQ3onu1FJEFr0SW1gC7cKk1uF8kGRs=
+golang.org/x/tools v0.0.0-20190328211700-ab21143f2384/go.mod h1:LCzVGOaR6xXOjkQ3onu1FJEFr0SW1gC7cKk1uF8kGRs=
+golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543 h1:E7g+9GITq07hpfrRu66IVDexMakfv52eLZ2CXBWiKr4=
+golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
+google.golang.org/appengine v1.1.0/go.mod h1:EbEs0AVv82hx2wNQdGPgUI5lhzA/G0D9YwlJXL52JkM=
+google.golang.org/appengine v1.4.0/go.mod h1:xpcJRLb0r/rnEns0DIKYYv+WjYCduHsrkT7/EB5XEv4=
+google.golang.org/genproto v0.0.0-20180817151627-c66870c02cf8/go.mod h1:JiN7NxoALGmiZfu7CAH4rXhgtRTLTxftemlI0sWmxmc=
+google.golang.org/genproto v0.0.0-20190425155659-357c62f0e4bb/go.mod h1:VzzqZJRnGkLBvHegQrXjBqPurQTc5/KpmUdxsrq26oE=
+google.golang.org/grpc v1.19.0/go.mod h1:mqu4LbDTu4XGKhr4mRzUsmM4RtVoemTSY81AxZiDr8c=
+google.golang.org/grpc v1.20.1/go.mod h1:10oTOabMzJvdu6/UiuZezV6QK5dSlG84ov/aaiqXj38=
+google.golang.org/grpc v1.21.0/go.mod h1:oYelfM1adQP15Ek0mdvEgi9Df8B9CZIaU1084ijfRaM=
+gopkg.in/alecthomas/kingpin.v2 v2.2.6/go.mod h1:FMv+mEhP44yOT+4EoQTLFTRgOQ1FBLkstjWtayDeSgw=
+gopkg.in/alexcesaro/quotedprintable.v3 v3.0.0-20150716171945-2caba252f4dc h1:2gGKlE2+asNV9m7xrywl36YYNnBG5ZQ0r/BOOxqPpmk=
+gopkg.in/alexcesaro/quotedprintable.v3 v3.0.0-20150716171945-2caba252f4dc/go.mod h1:m7x9LTH6d71AHyAX77c9yqWCCa3UKHcVEj9y7hAtKDk=
+gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405 h1:yhCVgyC4o1eVCa2tZl7eS0r+SDo693bJlVdllGtEeKM=
+gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
+gopkg.in/check.v1 v1.0.0-20180628173108-788fd7840127 h1:qIbj1fsPNlZgppZ+VLlY7N33q108Sa+fhmuc+sWQYwY=
+gopkg.in/check.v1 v1.0.0-20180628173108-788fd7840127/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
+gopkg.in/gomail.v2 v2.0.0-20160411212932-81ebce5c23df h1:n7WqCuqOuCbNr617RXOY0AWRXxgwEyPp2z+p0+hgMuE=
+gopkg.in/gomail.v2 v2.0.0-20160411212932-81ebce5c23df/go.mod h1:LRQQ+SO6ZHR7tOkpBDuZnXENFzX8qRjMDMyPD6BRkCw=
+gopkg.in/ini.v1 v1.51.0 h1:AQvPpx3LzTDM0AjnIRlVFwFFGC+npRopjZxLJj6gdno=
+gopkg.in/ini.v1 v1.51.0/go.mod h1:pNLf8WUiyNEtQjuu5G5vTm06TEv9tsIgeAvK8hOrP4k=
+gopkg.in/natefinch/lumberjack.v2 v2.0.0 h1:1Lc07Kr7qY4U2YPouBjpCLxpiyxIVoxqXgkXLknAOE8=
+gopkg.in/natefinch/lumberjack.v2 v2.0.0/go.mod h1:l0ndWWf7gzL7RNwBG7wST/UCcT4T24xpD6X8LsfU/+k=
+gopkg.in/resty.v1 v1.12.0/go.mod h1:mDo4pnntr5jdWRML875a/NmxYqAlA73dVijT2AXvQQo=
+gopkg.in/yaml.v2 v2.0.0-20170812160011-eb3733d160e7/go.mod h1:JAlM8MvJe8wmxCU4Bli9HhUf9+ttbYbLASfIpnQbh74=
+gopkg.in/yaml.v2 v2.2.1/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
+gopkg.in/yaml.v2 v2.2.2/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
+gopkg.in/yaml.v2 v2.2.4 h1:/eiJrUcujPVeJ3xlSWaiNi3uSVmDGBK1pDHUHAnao1I=
+gopkg.in/yaml.v2 v2.2.4/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
+honnef.co/go/tools v0.0.0-20190102054323-c2f93a96b099/go.mod h1:rf3lG4BRIbNafJWhAfAdb/ePZxsR/4RtNHQocxwk9r4=
diff --git a/kstream/__init__.py b/kstream/__init__.py
deleted file mode 100644
index b4b9e2a2a..000000000
--- a/kstream/__init__.py
+++ /dev/null
@@ -1,14 +0,0 @@
-# Copyright 2016 by Nedim Sabic (RabbitStack)
-# All Rights Reserved.
-#
-# Licensed under the Apache License, Version 2.0 (the "License"); you may
-# not use this file except in compliance with the License. You may obtain
-# a copy of the License at
-#
-# http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
-# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
-# License for the specific language governing permissions and limitations
-# under the License.
\ No newline at end of file
diff --git a/kstream/includes/__init__.py b/kstream/includes/__init__.py
deleted file mode 100644
index b4b9e2a2a..000000000
--- a/kstream/includes/__init__.py
+++ /dev/null
@@ -1,14 +0,0 @@
-# Copyright 2016 by Nedim Sabic (RabbitStack)
-# All Rights Reserved.
-#
-# Licensed under the Apache License, Version 2.0 (the "License"); you may
-# not use this file except in compliance with the License. You may obtain
-# a copy of the License at
-#
-# http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
-# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
-# License for the specific language governing permissions and limitations
-# under the License.
\ No newline at end of file
diff --git a/kstream/includes/etw.pxd b/kstream/includes/etw.pxd
deleted file mode 100644
index c7f948886..000000000
--- a/kstream/includes/etw.pxd
+++ /dev/null
@@ -1,97 +0,0 @@
-# Copyright 2016 by Nedim Sabic (RabbitStack)
-# http://rabbitstack.github.io
-# All Rights Reserved.
-#
-# Licensed under the Apache License, Version 2.0 (the "License"); you may
-# not use this file except in compliance with the License. You may obtain
-# a copy of the License at
-#
-# http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
-# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
-# License for the specific language governing permissions and limitations
-# under the License.
-
-from .windows cimport *
-
-cdef extern from "evntcons.h":
-
- enum: EVENT_HEADER_FLAG_32_BIT_HEADER
- enum: PROCESS_TRACE_MODE_EVENT_RECORD
-
- ctypedef struct EVENT_TRACE_PROPERTIES:
- pass
- ctypedef struct ETW_BUFFER_CONTEXT:
- UCHAR cpuid "ProcessorNumber"
- UCHAR Alignment
- USHORT LoggerId
-
- ctypedef struct EVENT_DESCRIPTOR:
- USHORT Id
- UCHAR Version
- UCHAR Channel
- UCHAR Level
- UCHAR opcode "Opcode"
- USHORT Task
- ULONGLONG Keyword
-
- ctypedef struct EVENT_HEADER:
- USHORT Size
- USHORT HeaderType
- USHORT flags "Flags"
- USHORT EventProperty
- ULONG thread_id "ThreadId"
- ULONG process_id "ProcessId"
- LARGE_INTEGER timestamp "TimeStamp"
- GUID ProviderId
- EVENT_DESCRIPTOR descriptor "EventDescriptor"
- ULONG KernelTime
- ULONG UserTime
- ULONGLONG ProcessorTime
- GUID ActivityId
-
- ctypedef struct LINKAGE:
- USHORT Linkage
- USHORT Reserverd2
- ctypedef struct EVENT_HEADER_EXTENDED_DATA_ITEM:
- USHORT Reserved1
- USHORT ExtType
- LINKAGE Linkage
- USHORT DataSize
- ULONGLONG DataPtr
-
- ctypedef struct EVENT_RECORD:
- EVENT_HEADER header "EventHeader"
- ETW_BUFFER_CONTEXT buffer_ctx "BufferContext"
- USHORT ExtendedDataCount
- USHORT UserDataLength
- EVENT_HEADER_EXTENDED_DATA_ITEM* ExtendedData
- PVOID UserData
- PVOID user_ctx "UserContext"
-
-cdef extern from "evntrace.h":
-
- ctypedef VOID (__stdcall *PEVENT_RECORD_CALLBACK) (EVENT_RECORD* e)
-
- ctypedef ULONG64 TRACEHANDLE
-
- enum: INVALID_PROCESSTRACE_HANDLE
- enum: EVENT_TRACE_REAL_TIME_MODE
-
- ctypedef struct EVENT_TRACE_LOGFILE:
- LPTSTR LogFileName
- LPSTR logger_name "LoggerName"
- ULONG LogFileMode
- ULONG trace_mode "ProcessTraceMode"
- PEVENT_RECORD_CALLBACK callback "EventRecordCallback"
- PVOID context "Context"
-
- TRACEHANDLE open_trace "OpenTrace"(EVENT_TRACE_LOGFILE* logfile)
-
- ULONG close_trace "CloseTrace"(TRACEHANDLE handle)
-
- ULONG process_trace "ProcessTrace"(TRACEHANDLE* handle, ULONG count,
- FILETIME* start,
- FILETIME* end)
\ No newline at end of file
diff --git a/kstream/includes/python.pxd b/kstream/includes/python.pxd
deleted file mode 100644
index 0a869d2dc..000000000
--- a/kstream/includes/python.pxd
+++ /dev/null
@@ -1,141 +0,0 @@
-# Copyright 2016 by Nedim Sabic (RabbitStack)
-# http://rabbitstack.github.io
-# All Rights Reserved.
-#
-# Licensed under the Apache License, Version 2.0 (the "License"); you may
-# not use this file except in compliance with the License. You may obtain
-# a copy of the License at
-#
-# http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
-# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
-# License for the specific language governing permissions and limitations
-# under the License.
-
-from cpython.ref cimport PyObject
-from libc.stddef cimport wchar_t
-from .windows cimport WCHAR, CHAR, BYTE, ULONGLONG, LONGLONG, ULONG, LONG, SHORT, USHORT, ntohs, htonl, inet_ntoa, \
- in_addr, FLOAT, DOUBLE, DWORD, INT32
-from .string cimport wstring, sprintf
-from cython.operator cimport dereference as deref
-
-cdef extern from "python.h":
- PyObject* PyUnicode_FromString(const char* u) nogil
- PyObject* PyUnicode_FromWideChar (wchar_t* w, Py_ssize_t size) nogil
- wchar_t* PyUnicode_AsWideCharString(PyObject* unicode, Py_ssize_t* size) nogil
- long PyLong_AsLong(PyObject *obj) nogil
- PyObject* Py_BuildValue(char* format, ...) nogil
-
- PyObject* PyTuple_New(Py_ssize_t len) nogil
- PyObject* PyTuple_GetItem(PyObject* p, Py_ssize_t pos) nogil
- int PyTuple_SetItem(PyObject* p, Py_ssize_t pos, PyObject* o) nogil
-
- void Py_XDECREF(PyObject* o) nogil
- void Py_XINCREF(PyObject* o)
-
- void PyMem_Free(void *p) nogil
-
-
-cdef inline PyObject* _unicode(wchar_t* wchars) nogil:
- return PyUnicode_FromWideChar(wchars, -1)
-
-
-cdef inline PyObject* _ansi(char* chars) nogil:
- return PyUnicode_FromString(chars)
-
-
-cdef inline PyObject* _unicodec(void* buf) nogil:
- return Py_BuildValue('u', (buf)[0])
-
-
-cdef inline PyObject* _ansic(void* buf) nogil:
- return Py_BuildValue('s', (buf)[0])
-
-
-cdef inline PyObject* _i8(void* buf) nogil:
- return Py_BuildValue('h', (buf)[0])
-
-
-cdef inline PyObject* _u8(void* buf) nogil:
- return Py_BuildValue('b', (buf)[0])
-
-
-cdef inline PyObject* _u8_hex(void* buf) nogil:
- cdef char hx[200]
- sprintf(hx, "%02x", (buf)[0])
- return _ansi(hx)
-
-
-cdef inline PyObject* _i16_hex(void* buf) nogil:
- cdef char hx[200]
- sprintf(hx, "%02x", (buf)[0])
- return _ansi(hx)
-
-
-cdef inline PyObject* _i64_hex(void* buf) nogil:
- cdef char hx[200]
- sprintf(hx, "%02x", (buf)[0])
- return _ansi(hx)
-
-
-cdef inline PyObject* _i64(void* buf) nogil:
- return Py_BuildValue('L', (buf)[0])
-
-
-cdef inline PyObject* _u64(void* buf) nogil:
- return Py_BuildValue('K', (buf)[0])
-
-
-cdef inline PyObject* _i32(void* buf) nogil:
- return Py_BuildValue('i', (buf)[0])
-
-
-cdef inline PyObject* _i32_hex(void* buf) nogil:
- cdef char hx[200]
- sprintf(hx, "0x%x", (buf)[0])
- return _ansi(hx)
-
-
-cdef inline PyObject* _u32(void* buf) nogil:
- return Py_BuildValue('k', (buf)[0])
-
-
-cdef inline PyObject* _i16(void* buf) nogil:
- return Py_BuildValue('h', (buf)[0])
-
-
-cdef inline PyObject* _u16(void* buf) nogil:
- return Py_BuildValue('h', (buf)[0])
-
-
-cdef inline PyObject* _float(void* buf) nogil:
- return Py_BuildValue('f', (buf)[0])
-
-
-cdef inline PyObject* _double(void* buf) nogil:
- return Py_BuildValue('d', (buf)[0])
-
-
-cdef inline PyObject* _ntohs(void* buf) nogil:
- return Py_BuildValue('h', ntohs((buf)[0]))
-
-
-cdef inline PyObject* _wstring(wstring ws):
- return PyUnicode_FromWideChar(ws.data(), ws.size())
-
-
-cdef inline wchar_t* _wchar_t(PyObject* o) nogil:
- cdef Py_ssize_t size
- return PyUnicode_AsWideCharString(o, &size)
-
-
-cdef inline PyObject* ip_addr(void* buf) nogil:
- cdef in_addr addr
- addr.S_un.S_addr = (buf)[0]
- return Py_BuildValue('s', inet_ntoa(addr))
-
-
-cdef inline wstring deref_prop(prop_name):
- return deref(new wstring(_wchar_t(prop_name)))
\ No newline at end of file
diff --git a/kstream/includes/stdlib.pxd b/kstream/includes/stdlib.pxd
deleted file mode 100644
index e68e0ebfb..000000000
--- a/kstream/includes/stdlib.pxd
+++ /dev/null
@@ -1,19 +0,0 @@
-# Copyright 2016 by Nedim Sabic (RabbitStack)
-# http://rabbitstack.github.io
-# All Rights Reserved.
-#
-# Licensed under the Apache License, Version 2.0 (the "License"); you may
-# not use this file except in compliance with the License. You may obtain
-# a copy of the License at
-#
-# http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
-# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
-# License for the specific language governing permissions and limitations
-# under the License.
-
-cdef extern from "stdlib.h":
- void free(void* ptr) nogil
- void* malloc(size_t size) nogil
\ No newline at end of file
diff --git a/kstream/includes/string.pxd b/kstream/includes/string.pxd
deleted file mode 100644
index cd09ae751..000000000
--- a/kstream/includes/string.pxd
+++ /dev/null
@@ -1,41 +0,0 @@
-# Copyright 2016 by Nedim Sabic (RabbitStack)
-# http://rabbitstack.github.io
-# All Rights Reserved.
-#
-# Licensed under the Apache License, Version 2.0 (the "License"); you may
-# not use this file except in compliance with the License. You may obtain
-# a copy of the License at
-#
-# http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
-# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
-# License for the specific language governing permissions and limitations
-# under the License.
-
-from libc.stddef cimport wchar_t
-
-cdef extern from "wchar.h":
- int wprintf(const wchar_t *, ...) nogil
- int printf( const char* format, ... ) nogil
- int sprintf (char* str, const char* format, ... ) nogil
- long strtol(const char* nptr, char** endptr, int base) nogil
- long wcstol(const wchar_t* nptr, wchar_t** endptr, int base) nogil
- wchar_t* _wcslwr(wchar_t * s) nogil
- int wcscmp(const wchar_t* string1, const wchar_t* string2) nogil
- size_t wcslen (const wchar_t* wcs)
-
-cdef extern from "" namespace "std" nogil:
-
- cdef cppclass wstring "std::wstring":
- wstring() except +
- wstring(wchar_t *) except +
- wstring(wchar_t *, size_t) except +
- wstring(wstring&) except +
-
- const wchar_t* data()
- size_t size()
-
- int compare(wstring&)
-
diff --git a/kstream/includes/tdh.pxd b/kstream/includes/tdh.pxd
deleted file mode 100644
index d5bfc6bbc..000000000
--- a/kstream/includes/tdh.pxd
+++ /dev/null
@@ -1,148 +0,0 @@
-# Copyright 2016 by Nedim Sabic (RabbitStack)
-# http://rabbitstack.github.io
-# All Rights Reserved.
-#
-# Licensed under the Apache License, Version 2.0 (the "License"); you may
-# not use this file except in compliance with the License. You may obtain
-# a copy of the License at
-#
-# http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
-# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
-# License for the specific language governing permissions and limitations
-# under the License.
-
-from .windows cimport ULONG
-from .etw cimport *
-
-cdef extern from "tdh.h":
-
- ctypedef ULONG TDHAPI
-
- ctypedef enum TDH_IN_TYPE:
- TDH_INTYPE_NULL = 0
- TDH_INTYPE_UNICODESTRING = 1
- TDH_INTYPE_ANSISTRING = 2
- TDH_INTYPE_INT8 = 3
- TDH_INTYPE_UINT8 = 4
- TDH_INTYPE_INT16 = 5
- TDH_INTYPE_UINT16 = 6
- TDH_INTYPE_INT32 = 7
- TDH_INTYPE_UINT32 = 8
- TDH_INTYPE_INT64 = 9
- TDH_INTYPE_UINT64 = 10
- TDH_INTYPE_FLOAT = 11
- TDH_INTYPE_DOUBLE = 12
- TDH_INTYPE_BOOLEAN = 13
- TDH_INTYPE_BINARY = 14
- TDH_INTYPE_GUID = 15
- TDH_INTYPE_POINTER = 16
- TDH_INTYPE_FILETIME = 17
- TDH_INTYPE_SYSTEMTIME = 18
- TDH_INTYPE_SID = 19
- TDH_INTYPE_HEXINT32 = 20
- TDH_INTYPE_HEXINT64 = 21
- TDH_INTYPE_COUNTEDSTRING = 300
- TDH_INTYPE_COUNTEDANSISTRING = 301
- TDH_INTYPE_REVERSEDCOUNTEDSTRING = 302
- TDH_INTYPE_REVERSEDCOUNTEDANSISTRING = 303
- TDH_INTYPE_NONNULLTERMINATEDSTRING = 304
- TDH_INTYPE_NONNULLTERMINATEDANSISTRING = 305
- TDH_INTYPE_UNICODECHAR = 306
- TDH_INTYPE_ANSICHAR = 307
- TDH_INTYPE_SIZET = 308
- TDH_INTYPE_HEXDUMP = 309
- TDH_INTYPE_WBEMSID = 310
-
- ctypedef enum TDH_OUT_TYPE:
- TDH_OUTTYPE_NULL = 0
- TDH_OUTTYPE_STRING = 1
- TDH_OUTTYPE_DATETIME = 2
- TDH_OUTTYPE_BYTE = 3
- TDH_OUTTYPE_UNSIGNEDBYTE = 4
- TDH_OUTTYPE_SHORT = 5
- TDH_OUTTYPE_UNSIGNEDSHORT = 6
- TDH_OUTTYPE_INT = 6
- TDH_OUTTYPE_UNSIGNEDINT = 7
- TDH_OUTTYPE_LONG = 8
- TDH_OUTTYPE_UNSIGNEDLONG = 9
- TDH_OUTTYPE_FLOAT = 10
- TDH_OUTTYPE_DOUBLE = 11
- TDH_OUTTYPE_BOOLEAN = 12
- TDH_OUTTYPE_GUID = 13
- TDH_OUTTYPE_HEXBINARY = 14
- TDH_OUTTYPE_HEXINT8 = 15
- TDH_OUTTYPE_HEXINT16 = 16
- TDH_OUTTYPE_HEXINT32 = 17
- TDH_OUTTYPE_HEXINT64 = 18
- TDH_OUTTYPE_PID = 19
- TDH_OUTTYPE_TID = 20
- TDH_OUTTYPE_PORT = 21
- TDH_OUTTYPE_IPV4 = 22
- TDH_OUTTYPE_IPV6 = 23
- TDH_OUTTYPE_SOCKETADDRESS = 24
- TDH_OUTTYPE_CIMDATETIME = 25
- TDH_OUTTYPE_ETWTIME = 26
- TDH_OUTTYPE_XML = 27
- TDH_OUTYTPE_ERRORCODE = 28,
- TDH_OUTTYPE_REDUCEDSTRING = 300
-
- ctypedef enum PROPERTY_FLAGS:
- PropertyStruct = 0x1
- PropertyParamLength = 0x2
- PropertyParamCount = 0x4
- PropertyWBEMXmlFragment = 0x8
- PropertyParamFixedLength = 0x10
-
-
- ctypedef struct NON_STRUCT_TYPE:
- USHORT in_type "InType"
- USHORT out_type "OutType"
-
- ctypedef struct EVENT_PROPERTY_INFO:
- ULONG name_offset "NameOffset"
- NON_STRUCT_TYPE non_struct_type "nonStructType"
-
- ctypedef struct TRACE_PROVIDER_INFO:
- GUID ProviderGuid
- USHORT PropertyCount
-
-
- ctypedef struct TDH_CONTEXT:
- pass
-
- ctypedef struct PROPERTY_DATA_DESCRIPTOR:
- ULONGLONG property_name "PropertyName"
- ULONG array_index "ArrayIndex"
- ULONG reserved "Reserved"
-
-
- ctypedef struct TRACE_EVENT_INFO:
- GUID ProviderGuid
- GUID event_guid "EventGuid"
- ULONG ProviderNameOffset
- ULONG OpcodeNameOffset
- ULONG PropertyCount
- ULONG property_count "TopLevelPropertyCount"
- EVENT_PROPERTY_INFO properties "EventPropertyInfoArray"[1]
-
-
- TDHAPI tdh_get_event_information "TdhGetEventInformation"(EVENT_RECORD* e, ULONG cc,
- TDH_CONTEXT* ctx,
- TRACE_EVENT_INFO* buf,
- ULONG* buf_size) nogil
-
- ULONG tdh_get_property_size "TdhGetPropertySize"(EVENT_RECORD* e, ULONG cc,
- TDH_CONTEXT* ctx,
- ULONG count,
- PROPERTY_DATA_DESCRIPTOR* descriptor,
- ULONG *size) nogil
-
- ULONG tdh_get_property "TdhGetProperty"(EVENT_RECORD* e, ULONG cc,
- TDH_CONTEXT* ctx,
- ULONG count,
- PROPERTY_DATA_DESCRIPTOR* descriptor,
- ULONG buf_size,
- BYTE* buf) nogil
diff --git a/kstream/includes/windows.pxd b/kstream/includes/windows.pxd
deleted file mode 100644
index 2dfa9354a..000000000
--- a/kstream/includes/windows.pxd
+++ /dev/null
@@ -1,121 +0,0 @@
-# Copyright 2016 by Nedim Sabic (RabbitStack)
-# http://rabbitstack.github.io
-# All Rights Reserved.
-#
-# Licensed under the Apache License, Version 2.0 (the "License"); you may
-# not use this file except in compliance with the License. You may obtain
-# a copy of the License at
-#
-# http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
-# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
-# License for the specific language governing permissions and limitations
-# under the License.
-
-from libc.stddef cimport wchar_t
-
-cdef extern from "windows.h":
- ctypedef unsigned long ULONG
- ctypedef unsigned char BYTE
- ctypedef unsigned long DWORD
- ctypedef signed int INT32
- ctypedef unsigned short WORD
- ctypedef float FLOAT
- ctypedef double DOUBLE
- ctypedef char CHAR
- ctypedef unsigned char UCHAR
- ctypedef void VOID
- ctypedef void* PVOID
- ctypedef PVOID HANDLE
- ctypedef short SHORT
- ctypedef unsigned short USHORT
- ctypedef long long LONGLONG
- ctypedef char* LPSTR
- ctypedef unsigned long long ULONGLONG
- ctypedef long LONG
- ctypedef void* PVOID
- ctypedef DWORD* LPDWORD
- ctypedef int BOOL
- ctypedef const char* LPCTSTR
- ctypedef const wchar_t* LPWSTR
- ctypedef wchar_t* LPCWSTR
- ctypedef unsigned long long ULONG64
- ctypedef wchar_t* WCHAR
- ctypedef WCHAR* LPTSTR
- ctypedef wchar_t* LPSIDSTR
- ctypedef LPWSTR LPOLESTR
- ctypedef long HRESULT
-
- enum: ERROR_SUCCESS
- enum: ERROR_CANCELLED
-
- enum: THREAD_QUERY_INFORMATION
- enum: THREAD_QUERY_LIMITED_INFORMATION
-
- ctypedef struct GUID:
- DWORD Data1
- WORD Data2
- WORD Data3
- BYTE Data4[8]
-
- ctypedef const GUID & REFGUID
-
- ctypedef struct U:
- DWORD LowPart
- LONG HighPart
- ctypedef union LARGE_INTEGER:
- DWORD low"LowPart"
- LONG high "HighPart"
- U u
- LONGLONG QuadPart
-
- ctypedef struct FILETIME:
- DWORD low_date "dwLowDateTime"
- DWORD high_date "dwHighDateTime"
-
- ctypedef struct SYSTEMTIME:
- WORD year "wYear"
- WORD month "wMonth"
- WORD day_of_week "wDayOfWeek"
- WORD day "wDay"
- WORD hour "wHour"
- WORD minute "wMinute"
- WORD second "wSecond"
- WORD millis "wMilliseconds"
-
- ctypedef struct TIME_ZONE_INFORMATION:
- LONG Bias
- WCHAR StandardName[32]
- SYSTEMTIME StandardDate
- LONG StandardBias
- WCHAR DaylightName[32]
- SYSTEMTIME DaylightDate
- LONG DaylightBias
-
- int string_from_guid "StringFromGUID2"(REFGUID guid, LPOLESTR lpsz, int cch) nogil
-
- BOOL filetime_to_systemtime "FileTimeToSystemTime"(FILETIME *ft, SYSTEMTIME *st) nogil
-
- BOOL systemtime_to_tz_specific_localtime "SystemTimeToTzSpecificLocalTime"(TIME_ZONE_INFORMATION *zone,
- SYSTEMTIME *uni_time,
- SYSTEMTIME *local_time) nogil
-
- HANDLE open_thread "OpenThread"(DWORD desired_access, BOOL inherit_handle, DWORD thread_id) nogil
-
- DWORD get_process_id_of_thread "GetProcessIdOfThread"(HANDLE thread) nogil
-
- BOOL close_handle "CloseHandle"(HANDLE handle) nogil
-
-cdef extern from "winsock.h":
- USHORT ntohs(USHORT netshort) nogil
- ULONG htonl(ULONG hostlong) nogil
-
- ctypedef union S_un:
- ULONG S_addr
- ctypedef struct in_addr:
- S_un S_un
-
- char* inet_ntoa(in_addr addr) nogil
-
diff --git a/kstream/kstreamc.pxd b/kstream/kstreamc.pxd
deleted file mode 100644
index db1b78898..000000000
--- a/kstream/kstreamc.pxd
+++ /dev/null
@@ -1,32 +0,0 @@
-# Copyright 2016 by Nedim Sabic (RabbitStack)
-# http://rabbitstack.github.io
-# All Rights Reserved.
-#
-# Licensed under the Apache License, Version 2.0 (the "License"); you may
-# not use this file except in compliance with the License. You may obtain
-# a copy of the License at
-#
-# http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
-# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
-# License for the specific language governing permissions and limitations
-# under the License.
-
-from kstream.ktuple cimport build_ktuple
-from cpython.ref cimport PyObject
-
-
-
-cdef class KEventStreamCollector:
- cdef:
-
- EVENT_TRACE_LOGFILE ktrace
- TRACEHANDLE handle
- int pointer_size
-
-
-from kstream.includes.etw cimport *
-from kstream.includes.tdh cimport *
-
diff --git a/kstream/kstreamc.pyx b/kstream/kstreamc.pyx
deleted file mode 100644
index 270c9c310..000000000
--- a/kstream/kstreamc.pyx
+++ /dev/null
@@ -1,648 +0,0 @@
-# Copyright 2015 by Nedim Sabic (RabbitStack)
-# http://rabbitstack.github.io
-# All Rights Reserved.
-#
-# Licensed under the Apache License, Version 2.0 (the "License"); you may
-# not use this file except in compliance with the License. You may obtain
-# a copy of the License at
-#
-# http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
-# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
-# License for the specific language governing permissions and limitations
-# under the License.
-
-import re
-import os
-import traceback
-
-from libcpp.unordered_map cimport unordered_map
-from cython.operator cimport dereference as deref, preincrement as inc
-from libcpp.vector cimport vector
-from libcpp.utility cimport pair
-
-from cpython cimport PyBytes_AsString
-from cpython.exc cimport PyErr_CheckSignals
-
-from kstream.includes.etw cimport *
-from kstream.includes.tdh cimport *
-from kstream.includes.windows cimport *
-from kstream.includes.python cimport *
-from kstream.includes.stdlib cimport *
-from kstream.includes.string cimport *
-from kstream.time cimport sys_time
-from kstream.ktuple cimport build_ktuple
-from kstream.process cimport PROCESS_INFO, THREAD_INFO, pid_from_tid
-
-
-cdef enum:
- GUID_LENGTH = 36
- INVALID_PID = 4294967295
-
-cdef PyObject* ENUM_PROCESS = build_ktuple('{3d6fa8d0-fe05-11d0-9dda-00c04fd7ba7c}', 3)
-cdef PyObject* ENUM_THREAD = build_ktuple('{3d6fa8d1-fe05-11d0-9dda-00c04fd7ba7c}', 3)
-cdef PyObject* ENUM_IMAGE = build_ktuple('{2cb15d1d-5fc1-11d2-abe1-00a0c911f518}', 3)
-cdef PyObject* REG_CREATE_KCB = build_ktuple('{ae53722e-c863-11d2-8659-00c04fa321a1}', 22)
-cdef PyObject* REG_DELETE_KCB = build_ktuple('{ae53722e-c863-11d2-8659-00c04fa321a1}', 23)
-
-cdef PyObject* CREATE_PROCESS = build_ktuple('{3d6fa8d0-fe05-11d0-9dda-00c04fd7ba7c}', 1)
-cdef PyObject* CREATE_THREAD = build_ktuple('{3d6fa8d1-fe05-11d0-9dda-00c04fd7ba7c}', 1)
-cdef PyObject* TERMINATE_THREAD = build_ktuple('{3d6fa8d1-fe05-11d0-9dda-00c04fd7ba7c}', 2)
-cdef PyObject* TERMINATE_PROCESS = build_ktuple('{3d6fa8d0-fe05-11d0-9dda-00c04fd7ba7c}', 2)
-
-cdef PyObject* CREATE_FILE = build_ktuple('{90cbdc39-4a3e-11d1-84f4-0000f80464e3}', 64)
-cdef PyObject* WRITE_FILE = build_ktuple('{90cbdc39-4a3e-11d1-84f4-0000f80464e3}', 68)
-cdef PyObject* READ_FILE = build_ktuple('{90cbdc39-4a3e-11d1-84f4-0000f80464e3}', 67)
-cdef PyObject* DELETE_FILE = build_ktuple('{90cbdc39-4a3e-11d1-84f4-0000f80464e3}', 70)
-cdef PyObject* CLOSE_FILE = build_ktuple('{90cbdc39-4a3e-11d1-84f4-0000f80464e3}', 66)
-cdef PyObject* RENAME_FILE = build_ktuple('{90cbdc39-4a3e-11d1-84f4-0000f80464e3}', 71)
-cdef PyObject* SET_FILE_INFORMATION = build_ktuple('{90cbdc39-4a3e-11d1-84f4-0000f80464e3}', 69)
-
-cdef PyObject* UNLOAD_IMAGE = build_ktuple('{2cb15d1d-5fc1-11d2-abe1-00a0c911f518}', 2)
-
-cdef wstring PID_PROP = deref_prop("PID")
-cdef wstring PPID_PROP = deref_prop("ParentId")
-cdef wstring PROCESS_ID_PROP = deref_prop("ProcessId")
-cdef wstring FS_THREAD_ID_PROP = deref_prop("TTID")
-cdef wstring THREAD_ID_PROP = deref_prop("TThreadId")
-cdef wstring IMAGE_FILE_NAME_PROP = deref_prop("ImageFileName")
-
-REGISTRY_KGUID = '{ae53722e-c863-11d2-8659-00c04fa321a1}'
-FS_KGUID = '{90cbdc39-4a3e-11d1-84f4-0000f80464e3}'
-
-
-cdef class KEventStreamCollector:
- """Kernel event stream collector.
-
-
- Collects events from the kernel event stream and invokes
- a python callback method for each event delivered
- to the collector.
-
- The main motivation behind this Cython extension are the perfomance reasons, where
- ETW can generate a huge volume of events, and the parsing
- process is very CPU intensive.
-
- Use
- ---
-
- kevt_stream_collector = KEventStreamCollector(logger_name)
-
- Register a python callback:
-
- def next_kevt(ktype, cpuid, ts, kparams):
- # your logic here
- kevt_stream_collector.open_kstream(next_kevt)
-
-
- """
- cdef EVENT_TRACE_LOGFILE ktrace
- cdef TRACEHANDLE handle
- cdef int pointer_size
-
- cdef vector[PyObject*]* ktuple_filters
- cdef vector[wchar_t*]* skips
- cdef unordered_map[ULONG, PROCESS_INFO]* proc_map
- cdef unordered_map[ULONG, THREAD_INFO]* thread_map
-
- cdef ULONG pid_filter
- cdef wchar_t* image_filter
- cdef ULONG own_pid
-
- cdef next_kevt_callback
- cdef on_kstream_open_callback
- cdef klogger
- cdef regex
-
- def __init__(self, klogger):
- self.klogger = klogger
- self.handle = 0
- self.next_kevt_callback = None
- self.on_kstream_open_callback = None
- self.ktrace.logger_name = PyBytes_AsString(self.klogger)
- self.regex = re.compile('((?<=[a-z0-9])[A-Z]|(?!^)[A-Z](?=[a-z]))')
- self.pointer_size = 8
- self.ktuple_filters = new vector[PyObject*]()
- self.proc_map = new unordered_map[ULONG, PROCESS_INFO]()
- self.thread_map = new unordered_map[ULONG, THREAD_INFO]()
- self.skips = new vector[wchar_t*]()
- self.pid_filter = 0
- self.image_filter = NULL
- self.own_pid = os.getpid()
-
- def open_kstream(self, callback):
- """Initializes the kernel event stream.
-
- Sets the event record callback and open
- the trace to consume from kernel event
- stream.
-
- Parameters
- ----------
-
- callback: callable
- A python method which is called
- when kernel event is consumed successfully
-
- """
- self.next_kevt_callback = callback
-
- self.ktrace.trace_mode = EVENT_TRACE_REAL_TIME_MODE | PROCESS_TRACE_MODE_EVENT_RECORD
- self.ktrace.callback = self.process_kevent_callback
- # because `process_kevent` callback is the instance
- # method and the ETW API expects a callback function with
- # single parameter, the `self` argument refers to
- # an invalid context. We need to inject the reference
- # to this instance into `Context` member.
- self.ktrace.context = self
-
- self.handle = open_trace(&self.ktrace)
-
- if self.on_kstream_open_callback:
- self.on_kstream_open_callback()
-
- # foward the kernel event stream
- # to the consumer and start the processing
- status = process_trace(&self.handle, 1,
- NULL,
- NULL)
- if status != ERROR_SUCCESS or status != ERROR_CANCELLED:
- if status != INVALID_PROCESSTRACE_HANDLE:
- close_trace(self.handle)
- else:
- raise RuntimeError('ERROR - Unable to open kernel event stream. Error %s' % status)
-
- def close_kstream(self):
- close_trace(self.handle)
-
- def set_kstream_open_callback(self, callback):
- self.on_kstream_open_callback = callback
-
- def add_skip(self, skip):
- self.skips.push_back(_wchar_t(skip))
-
- def add_ktuple_filter(self, ktuple):
- kguid, opcode = ktuple
- self.ktuple_filters.push_back(build_ktuple(kguid, opcode))
-
- def add_pid_filter(self, pid):
- self.pid_filter = int(pid) if pid else 0
-
- def add_image_filter(self, image):
- self.image_filter = _wchar_t(image) if image else NULL
-
- cdef process_kevent_callback(self, EVENT_RECORD* kevent_trace):
- with nogil:
- (kevent_trace.user_ctx)._process_kevent(kevent_trace)
-
- cdef void _process_kevent(self, EVENT_RECORD* kevent_trace) nogil except *:
- """Kernel event stream callback.
-
- Parameters
- ----------
-
- kevent_trace: EVENT_RECORD
- The pointer to kernel event metadata
-
- """
- cdef TRACE_EVENT_INFO* info = malloc(4096)
-
- # the allocation has failed probably
- # because there is no enough memory
- if info == NULL:
- return
-
- cdef EVENT_HEADER kevt_hdr = kevent_trace.header
- cdef ULONG buffer_size = 4096
- cdef unordered_map[wstring, PyObject*] params
- cdef ULONG property_size
- cdef PROPERTY_DATA_DESCRIPTOR descriptor
- cdef BOOL dropped = False
- cdef PROCESS_INFO pi
- cdef THREAD_INFO ti
-
- status = tdh_get_event_information(kevent_trace, 0,
- NULL,
- info,
- &buffer_size)
-
- cpuid = kevent_trace.buffer_ctx.cpuid
- opcode = kevt_hdr.descriptor.opcode
- pid = kevt_hdr.process_id
- tid = kevt_hdr.thread_id
-
- ktuple = self.__wrap_ktuple(info.event_guid, opcode)
- # this shouldn't happen, but just in
- # case simply discard the kernel event
- if ktuple == NULL:
- free(info)
- return
- dropped = self.__apply_filters(pid, tid, ktuple, params, True)
-
- if dropped:
- with gil:
- free(info)
- Py_XDECREF(ktuple)
- return
-
- if (kevt_hdr.flags & EVENT_HEADER_FLAG_32_BIT_HEADER) == \
- EVENT_HEADER_FLAG_32_BIT_HEADER:
- self.pointer_size = 4
- else:
- self.pointer_size = 8
-
- if status == ERROR_SUCCESS:
- props = info.properties
- for i from 0 <= i < info.property_count:
- prop = props[i]
-
- property_name = info + prop.name_offset
-
- descriptor.property_name = info + \
- prop.name_offset
- descriptor.array_index = 0xFFFFFFFF
-
- # get the property size which
- # is used to allocate the buffer
- tdh_get_property_size(kevent_trace, 0,
- NULL,
- 1,
- &descriptor,
- &property_size)
- property_buffer = malloc(property_size)
- if property_buffer == NULL:
- return
-
- # fill the property buffer
- status = tdh_get_property(kevent_trace, 0,
- NULL,
- 1,
- &descriptor,
- property_size,
- property_buffer)
- # get the property value and store it in the map
- if status == ERROR_SUCCESS:
- if property_name != NULL:
- mapk = new wstring(property_name)
- params[deref(mapk)] = \
- self.__parse_property(prop.non_struct_type.in_type,
- prop.non_struct_type.out_type,
- property_buffer)
- del mapk
- free(property_buffer)
- else:
- if property_buffer != NULL:
- free(property_buffer)
-
- free(info)
- ts = sys_time(kevt_hdr.timestamp)
-
- # build a tiny state machine around the
- # currently running processes/threads on the system
- if self.__ktuple_equals(ktuple, ENUM_PROCESS) or \
- self.__ktuple_equals(ktuple, CREATE_PROCESS):
- pi.pid = wcstol(_wchar_t(params.at(PROCESS_ID_PROP)), NULL, 16)
- pi.ppid = wcstol(_wchar_t(params.at(PPID_PROP)), NULL, 16)
- pi.name = _wchar_t(params.at(IMAGE_FILE_NAME_PROP))
- k = new pair[ULONG, PROCESS_INFO](wcstol(_wchar_t(params.at(PROCESS_ID_PROP)), NULL, 16),
- pi)
- self.proc_map.insert(deref(k))
- del k
- elif self.__ktuple_equals(ktuple, ENUM_THREAD) or \
- self.__ktuple_equals(ktuple, CREATE_THREAD):
- ti.tid = wcstol(_wchar_t(params.at(THREAD_ID_PROP)), NULL, 16)
- ti.pid = wcstol(_wchar_t(params.at(PROCESS_ID_PROP)), NULL, 16)
- tk = new pair[ULONG, THREAD_INFO](wcstol(_wchar_t(params.at(THREAD_ID_PROP)), NULL, 16),
- ti)
- self.thread_map.insert(deref(tk))
- del tk
- elif self.__ktuple_equals(ktuple, TERMINATE_THREAD):
- prop_tid = wcstol(_wchar_t(params.at(THREAD_ID_PROP)), NULL, 16)
- self.thread_map.erase(prop_tid)
- elif self.__ktuple_equals(ktuple, TERMINATE_PROCESS):
- # defer the removal of the pid to be able to capture
- # `TerminateProcess` if the image filter is set
- if self.image_filter == NULL:
- prop_pid = wcstol(_wchar_t(params.at(PROCESS_ID_PROP)), NULL, 16)
- self.proc_map.erase(prop_pid)
- elif self.__ktuple_equals(ktuple, CREATE_FILE) or \
- self.__ktuple_equals(ktuple, WRITE_FILE) or \
- self.__ktuple_equals(ktuple, READ_FILE) or \
- self.__ktuple_equals(ktuple, DELETE_FILE) or \
- self.__ktuple_equals(ktuple, CLOSE_FILE) or \
- self.__ktuple_equals(ktuple, RENAME_FILE) or \
- self.__ktuple_equals(ktuple, SET_FILE_INFORMATION):
- # on some Windows versions the value of
- # the PID attribute is invalid for the
- # file system kernel events
- if pid == INVALID_PID:
- prop_fs_tid = params.at(FS_THREAD_ID_PROP)
- if prop_fs_tid != NULL:
- # try to resolve the pid from the thread id
- pid = pid_from_tid(PyLong_AsLong(prop_fs_tid),
- self.thread_map)
- elif self.__ktuple_equals(ktuple, UNLOAD_IMAGE):
- # on Windows 7 the pid field of the event header
- # is invalid, so use the pid found in the event params
- if pid == INVALID_PID:
- p = params.at(PROCESS_ID_PROP)
- if p != NULL:
- pid = PyLong_AsLong(p)
-
- dropped = self.__apply_filters(pid, tid, ktuple, params, False)
- # now we can erase the pid
- if self.image_filter != NULL and \
- self.__ktuple_equals(ktuple, TERMINATE_PROCESS):
- prop_pid = wcstol(_wchar_t(params.at(PROCESS_ID_PROP)), NULL, 16)
- self.proc_map.erase(prop_pid)
- if dropped:
- with gil:
- # decrement references to avoid memory leaks
- if self.image_filter != NULL:
- self._decref_params(params)
- Py_XDECREF(ktuple)
- return
- with gil:
- # check for pending signals.
- # The default behaviour is to
- # raise `KeyboardInterrupt` exception
- # which will be propagated to the caller
- if PyErr_CheckSignals() > 0:
- self.close_kstream()
- return
- try:
- timestamp = '%d-%d-%d %d:%02d:%02d.%d' % (ts.year, ts.month,
- ts.day, ts.hour,
- ts.minute, ts.second,
- ts.millis)
- # convert the property name from
- # camel case to underscore so we have
- # PEP 8 compliant coding style
- kparams = {self._underscore(self._decref(_wstring(kparam.first))): self._decref(kparam.second)
- for kparam in params
- if kparam.second != NULL}
- kguid, opc =