Export RFC1918 on GTM

At some points you may want to audit your external GTM for any RFC1918 addresses and here is a simple script that will do the trick

SSH to your GTM and create a text file with the following contents (I name the file rfc1918audit.py)

# This script will give DNS records private ip addresses 10.x.x.x or 172.x.x.x or 192.168.x.x in external DNS (view)
import re,os
os.system('dnsxdump > xdump')
f = open('xdump', 'r')
for line in f:
    parts = line.split()
    if ( len(parts) > 4 and (parts[4].startswith( '172.' ) or parts[4].startswith( '192.168.' ) or parts[4].startswith( '10.' )) ):
        print parts[0], " ", parts[3], " ", parts[4]
os.remove('xdump')

Run the script

python /var/tmp/rfc1918audit.py > rfc1918audit.txt

Look at the output

less rfc1918audit.txt

And if you just want to know how many you have you can count the rows in your text file by running

wc -l rfc1918audit.txt

Hope that helps someone

Reference Material:

Python Modules Used

re

This module provides regular expression matching operations similar to those found in Perl.

Both patterns and strings to be searched can be Unicode strings as well as 8-bit strings. However, Unicode strings and 8-bit strings cannot be mixed: that is, you cannot match a Unicode string with a byte pattern or vice-versa; similarly, when asking for a substitution, the replacement string must be of the same type as both the pattern and the search string.

Regular expressions use the backslash character ('\') to indicate special forms or to allow special characters to be used without invoking their special meaning. This collides with Python’s usage of the same character for the same purpose in string literals; for example, to match a literal backslash, one might have to write '\\\\' as the pattern string, because the regular expression must be \\, and each backslash must be expressed as \\ inside a regular Python string literal.

The solution is to use Python’s raw string notation for regular expression patterns; backslashes are not handled in any special way in a string literal prefixed with 'r'. So r"\n" is a two-character string containing '\' and 'n', while "\n" is a one-character string containing a newline. Usually patterns will be expressed in Python code using this raw string notation.

It is important to note that most regular expression operations are available as module-level functions and methods on compiled regular expressions. The functions are shortcuts that don’t require you to compile a regex object first, but miss some fine-tuning parameters.

os

os.system(command)

Execute the command (a string) in a subshell. This is implemented by calling the Standard C function system(), and has the same limitations. Changes to sys.stdin, etc. are not reflected in the environment of the executed command. If command generates any output, it will be sent to the interpreter standard output stream.

On Unix, the return value is the exit status of the process encoded in the format specified for wait(). Note that POSIX does not specify the meaning of the return value of the C system()function, so the return value of the Python function is system-dependent.

The subprocess module provides more powerful facilities for spawning new processes and retrieving their results; using that module is preferable to using this function. See the Replacing Older Functions with the subprocess Module section in the subprocess documentation for some helpful recipes.

SUMMARY: run dnsxdump > xdump