Darkstat DB parser patch

Here is the note to parse the Darkstat DB.

Phil's original post: http://phil.lavin.me.uk/2011/11/parsing-a-darkstat-database-with-php/#comment-207432
Darkstat's official DB format doc: https://unix4lyfe.org/gitweb/darkstat/blob_plain/98907547c4c1b4b4dda1dc10d20643e2b680b352:/export-format.txt


I tried to parse the Darkstat DB by Phil's code and found issues. However the blogger is not update since 2014 so let's hack this by myself.

There are two bugs in the PHP source code:

  1. IPv6 address reader:
    IPv6 address is 128 bit long but the "readaddr_ipv6" function read 512 bits (8x8 bytes) hence the code stopped once IPv6 header is shown.
    function readaddr_ipv6($db) { 
        $ip = array(); 
         
        for($i = 0; $i < 8; $i++) { 
            $ip[] = bin2hex(fread($db, 2));
            //$ip[] = bin2hex(fread($db, 8));  //scott marked
        } 
         
        return implode(':', $ip); 
    } 
    
  2. IP family decoder
    Raw data is "0x04" and "0x06" but PHP can not read the raw data directly. A diction lookup is added to fix this:
    // Configurable data 
    $families = array(4 => "\x04", 6 => "\x06");
    // End configurable data 
    
    function parse_darkstat_db($filename) { 
    ...
                #$family = fread($db, 1); //marked by scott
                $family = array_search(fread($db, 1), $families); 
    ...
    }
    


留言

這個網誌中的熱門文章

RTC & CMOS 技術詳解

[自由網路] 如何取得 Google Drive (真實)外連位址 (Direct Link)

教你三招突破網管封鎖