#!/usr/bin/ruby -w
browser.cache.disk.parent_directory /var/lock
network.proxy.socks_remote_dns = true
background no
#font Sans:size=6
font Sans:size=8
use_xft yes
xftalpha 0.9
update_interval 3.0
total_run_times 0
own_window yes
own_window_type normal
own_window_transparent yes
own_window_hints undecorated,below,sticky,skip_taskbar,skip_pager
double_buffer yes
minimum_size 290 5
maximum_width 290
draw_shades yes
draw_outline no
draw_borders no
draw_graph_borders yes
default_color white
#default_shade_color white
default_outline_color blue
alignment top_left
gap_x 5
gap_y 32
no_buffers yes
uppercase no
cpu_avg_samples 2
override_utf8_locale no
uppercase yes # set to yes if you want all text to be in uppercase
TEXT
${color white}
${alignc}$sysname kernel $kernel
${alignc}${exec cat /etc/issue.net} on $machine host $nodename
${execi 1000 cat /proc/cpuinfo | grep 'model name' | sed -e 's/model name.*: //'}${freq_dyn}Mhz
Processes: ${alignr}$processes ($running_processes running)
Uptime: $alignr$uptime
CPU ${alignr}${cpu cpu1}%
${cpugraph 000000 ff0000}$color
${cpubar 4 cpu1}
Ram ${alignr}$mem / $memmax ($memperc%)
${membar 4}
swap ${alignr}$swap / $swapmax ($swapperc%)
${swapbar 4}
Highest CPU $alignr CPU% MEM%
${top name 1}$alignr${top cpu 1}${top mem 1}
${top name 2}$alignr${top cpu 2}${top mem 2}
${top name 3}$alignr${top cpu 3}${top mem 3}
Highest MEM $alignr CPU% MEM%
${top_mem name 1}$alignr${top_mem cpu 1}${top_mem mem 1}
${top_mem name 2}$alignr${top_mem cpu 2}${top_mem mem 2}
${top_mem name 3}$alignr${top_mem cpu 3}${top_mem mem 3}
${color white}Filesystem ${hr 1}${color}
Root: ${alignr}${fs_free /} / ${fs_size /}
${fs_bar 4 /}
Home: ${alignr}${fs_free /home} / ${fs_size /home}
${fs_bar 4 /home}
${color white}NETWORK ${hr 1}${color}
Public IP:${color white} $alignr${color RED}${execi 180 wget -O - http://ip.tupeux.com | tail}$color
Down ${downspeed ra0} k/s ${alignr}Up ${upspeed eth0} k/s
${downspeedgraph ra0 23,85 000000 ff0000} ${alignr}${upspeedgraph ra0 23,85 000000 00ff00}$color
Total ${totaldown ra0} ${alignr}Total ${totalup eth0}
Port(s) / Connections:
Inbound: ${tcp_portmon 1 32767 count} ${alignr}Outbound: ${tcp_portmon 32768 61000 count}
Outbound Connection ${alignr} Remote Service/Port
${tcp_portmon 32768 61000 rhost 0} ${alignr} ${tcp_portmon 32768 61000 rservice 0}
${tcp_portmon 32768 61000 rhost 1} ${alignr} ${tcp_portmon 32768 61000 rservice 1}
${tcp_portmon 32768 61000 rhost 2} ${alignr} ${tcp_portmon 32768 61000 rservice 2}
${tcp_portmon 32768 61000 rhost 3} ${alignr} ${tcp_portmon 32768 61000 rservice 3}
${tcp_portmon 32768 61000 rhost 4} ${alignr} ${tcp_portmon 32768 61000 rservice 4}
${tcp_portmon 32768 61000 rhost 5} ${alignr} ${tcp_portmon 32768 61000 rservice 5}
Ruby Oneliner
ruby -e '1000.times {|i| print `nslookup #{"smsclubnet.com"}`}' | grep Address | grep -v \#53 | awk '{print $2}'>> waledac_list-IP
Resultant Product
cat waledac_list-IP | wc -l
1000
cat waledac_list-IP | sort -u | wc -l
185
185 Fast Flux IP Addresses Sampling
112.76.132.115
113.131.247.137
115.23.21.130
115.43.127.170
115.88.199.200
115.88.229.37
115.92.199.45
116.12.40.99
116.41.12.69
118.129.47.130
118.218.233.130
118.232.218.209
118.32.88.41
118.35.41.130
118.43.5.51
119.204.10.150
119.246.58.44
119.77.227.84
119.77.244.133
Reverse Look up of sample
ruby -e 'File.foreach("sample_list") {|i| print `nslookup #{i}`}'
** server can't find 51.5.43.118.in-addr.arpa.: NXDOMAIN
Server: 208.67.222.222
Address: 208.67.222.222#53
** server can't find 150.10.204.119.in-addr.arpa.: NXDOMAIN
Server: 208.67.222.222
Address: 208.67.222.222#53
** server can't find 44.58.246.119.in-addr.arpa.: NXDOMAIN
Server: 208.67.222.222
Address: 208.67.222.222#53
** server can't find 84.227.77.119.in-addr.arpa.: NXDOMAIN
Server: 208.67.222.222
Address: 208.67.222.222#53
** server can't find 133.244.77.119.in-addr.arpa.: NXDOMAIN
ruby -e 'File.foreach("list") {|i| print `nslookup #{i}`}'
cat list
2.50:264
5.00:806
7.5:2714
10:4169
12.50:1396
15:129
BEGIN CODE
================
awk '{a[NR] = $2; sum+= $2 }
END {
for (i = 1; i <= NR; i++)
printf "%s(%2.2f %)\n", a[i],(100 * a[i])/sum
}
' FS=":" list.txt
================
END CODE
Resultant Product
=============
264(2.79 %)
806(8.50 %)
2714(28.63 %)
4169(43.99 %)
1396(14.73 %)
129(1.36 %)
