Python定时检查域名(CNAME)解析是否有变化

╰+攻爆jí腚メ 2023-02-10 05:25 14阅读 0赞

需求背景：因客户需要及时知道他们CDN是否被攻击并自动跳切到高防网路，所以做了一个监控脚本。针对CNAME进行解析监控。把解析结果跟高防IP段做对比，结果为true，则表示CDN高速节点被打趴，自动跳切高防了。并发出告警；

喝水不忘挖井人，参考链接：

判断解析出来的IP是否属于某一个IP段  [https://blog.csdn.net/hackerie/article/details/80598436][https_blog.csdn.net_hackerie_article_details_80598436]

解析并把结果通过邮件发送 [https://blog.csdn.net/weixin\_33953249/article/details/93126542][https_blog.csdn.net_weixin_33953249_article_details_93126542]

运行环境：CentOS7, Python3.6

避免重复造轮子，引用的模块有：os  IPy

os.popen   os.system   运行shell命令

address in IPy.IP  判断IP是否属于某个网段

脚本源码如下：

#!/usr/bin/python
    # -*- coding: utf-8 -*-
    #此脚本用于检测CNAME是否跳切高防段
    import os
    import datetime as d
    import IPy
    #定义cname数组以及邮箱数组
    cname = ['ooxx1.cdn-ng.net','ooxx2.cdn-ng.net','ooxx3.cdn-ng.net']
    mail = ['123456@qq.com','hisen@XXX.net']
    nowtime = d.datetime.now().strftime("%Y.%m.%d-%H:%M:%S")
    #print(nowtime)
    #'''
    #cname解析检测模块
    def check_domain():
    	for i in cname:
    		address = os.popen("nslookup %s | grep -v '#53' | awk -F':' '/^Address/{print $2}' | awk '{print $1}' | head -n 1" % i).read().strip()
    		judge1 = address in IPy.IP('11.12.13.0/23')
    		judge2 = address in IPy.IP('111.112.113.0/24')
    		judge3 = address in IPy.IP('1.2.3.0/22')
    		alarm = os.popen('cat /root/cname_check/dns_%s' % i).read().strip()
    		if judge1 == 1 or judge2 == 1 or judge3 == 1 :   #解析地址属于任意一个高防段则为true
    			if int(alarm) == 1:
    				pass
    			else:
    				os.system('echo "XXXXCNAME:%s跳切高防! 解析地址为:%s; 时间:$(date)" >> /root/cname_check/log_%s' % (i,address,i))
    				os.system('echo "1" > /root/cname_check/dns_%s' % i)
    				for j in mail:
    					os.popen("echo 'CNAME:%s跳切高防,解析地址为:%s; 时间:%s'| mail -s 'CNAME:%s跳切高防' %s" %(i,address,nowtime,i,j))
    		elif int(alarm) == 1:
    			os.system('echo "OOOOCNAME:%s跳回高速! 解析地址为:%s; 时间:$(date)" >> /root/cname_check/log_%s' % (i,address,i))
    			os.system('echo "0" > /root/cname_check/dns_%s' % i)
    			for j in mail:
    				os.popen("echo 'CNAME:%s恢复高速,解析地址为:%s; 时间:%s' | mail -s 'CNAME:%s恢复高速' %s" %(i,address,nowtime,i,j))
    		else:
    			pass
    
    check_domain()
    #'''

然后写入定时任务，每分钟跑一次。因为CDN缓存关系，告警灵敏度可能会有2分钟左右误差。

![2020052017022257.png][]

![20200520170140572.png][]

[https_blog.csdn.net_hackerie_article_details_80598436]: https://blog.csdn.net/hackerie/article/details/80598436
[https_blog.csdn.net_weixin_33953249_article_details_93126542]: https://blog.csdn.net/weixin_33953249/article/details/93126542
[2020052017022257.png]: https://img-blog.csdnimg.cn/2020052017022257.png
[20200520170140572.png]: https://img-blog.csdnimg.cn/20200520170140572.png