#!/usr/bin/env python3

import os
import math
import sys
import time
import datetime

sys.path.append(os.path.dirname(sys.argv[0]) + '/../../dependencies')
sys.path.append(os.path.dirname(sys.argv[0]) + '/../share/nDPId')
sys.path.append(os.path.dirname(sys.argv[0]))
sys.path.append(sys.base_prefix + '/share/nDPId')
import nDPIsrvd
from nDPIsrvd import nDPIsrvdSocket, TermColor

global args
global whois_db

def set_attr_from_dict(some_object, some_dict, key_and_attr_name, default_value):
    try:
        setattr(some_object, key_and_attr_name, some_dict[key_and_attr_name])
    except KeyError:
        if default_value is not None and getattr(some_object, key_and_attr_name, None) is None:
            setattr(some_object, key_and_attr_name, default_value)

def set_attr_if_not_set(some_object, attr_name, value):
    try:
        getattr(some_object, attr_name)
    except AttributeError:
        setattr(some_object, attr_name, value)

class Stats:

    def __init__(self, nDPIsrvd_sock):
        self.statusbar_enabled = True
        self.start_time = time.time()
        self.nsock = nDPIsrvd_sock
        self.last_status_length = 0
        self.avg_xfer_json_bytes = 0.0
        self.expired_tot_l4_payload_len = 0
        self.total_flows        = 0
        self.risky_flows        = 0
        self.midstream_flows    = 0
        self.guessed_flows      = 0
        self.not_detected_flows = 0
        self.current_time  = 0.0
        self.json_lines    = 0
        self.spinner_state = 0

    def disableStatusbar(self):
        self.statusbar_enabled = False

    def updateSpinner(self):
        if self.current_time + 0.25 <= time.time():
            self.spinner_state += 1

    def __getSpinner(self):
        #spinner_states = ['-', '\\', '|', '/']
        #spinner_states = ['▉', '▊', '▋', '▌', '▍', '▎', '▏', '▎', '▍', '▌', '▋', '▊', '▉']
        spinner_states = ['←', '↖', '↑', '↗', '→', '↘', '↓', '↙']
        #spinner_states = ['▁', '▂', '▃', '▄', '▅', '▆', '▇', '█', '▇', '▆', '▅', '▄', '▃', '▁']
        #spinner_states = ['▖', '▘', '▝', '▗']
        #spinner_states = ['┤', '┘', '┴', '└', '├', '┌', '┬', '┐']
        return spinner_states[self.spinner_state % len(spinner_states)]

    def __getDataFromJson(self, json_dict, current_flow):
        if current_flow is None:
            return

        set_attr_from_dict(current_flow, json_dict, 'flow_src_tot_l4_payload_len', 0)
        set_attr_from_dict(current_flow, json_dict, 'flow_dst_tot_l4_payload_len', 0)
        if 'ndpi' in json_dict:
            set_attr_from_dict(current_flow, json_dict['ndpi'], 'flow_risk', {})
        else:
            set_attr_from_dict(current_flow, {}, 'flow_risk', {})
        set_attr_from_dict(current_flow, json_dict, 'midstream', 0)
        set_attr_from_dict(current_flow, json_dict, 'flow_event_name', '')
        set_attr_if_not_set(current_flow, 'guessed', 0)
        set_attr_if_not_set(current_flow, 'not_detected', 0)

        if current_flow.flow_event_name == 'detected' or \
           current_flow.flow_event_name == 'detection-update':
            current_flow.guessed = 0
        elif current_flow.flow_event_name == 'guessed':
            current_flow.guessed = 1
        elif current_flow.flow_event_name == 'not-detected':
            current_flow.not_detected = 1

    def update(self, json_dict, current_flow):
        self.updateSpinner()
        self.json_lines += 1
        self.current_time = time.time()
        self.avg_xfer_json_bytes = self.nsock.received_bytes / (self.current_time - self.start_time)
        self.__getDataFromJson(json_dict, current_flow)

    def updateOnCleanup(self, current_flow):
        self.total_flows += 1
        self.expired_tot_l4_payload_len += current_flow.flow_src_tot_l4_payload_len + current_flow.flow_dst_tot_l4_payload_len
        self.risky_flows += 1 if len(current_flow.flow_risk) > 0 else 0
        self.midstream_flows += 1 if current_flow.midstream != 0 else 0
        self.guessed_flows += 1 if current_flow.guessed != 0 else 0
        self.not_detected_flows += 1 if current_flow.not_detected != 0 else 0

    def __getStatsFromFlowMgr(self):
        alias_count = 0
        source_count = 0
        flow_count = 0
        flow_tot_l4_payload_len = 0.0
        risky = 0
        midstream = 0
        guessed = 0
        not_detected = 0

        instances = self.nsock.flow_mgr.instances
        for alias in instances:
            alias_count += 1
            for source in instances[alias]:
                source_count += 1
                for flow_id in instances[alias][source].flows:
                    flow_count += 1
                    current_flow = instances[alias][source].flows[flow_id]

                    try:
                        flow_src_tot_l4_payload_len = current_flow.flow_src_tot_l4_payload_len
                        flow_dst_tot_l4_payload_len = current_flow.flow_dst_tot_l4_payload_len
                        flow_risk = current_flow.flow_risk
                        midstream = current_flow.midstream
                        guessed = current_flow.guessed
                        not_detected = current_flow.not_detected
                    except AttributeError:
                        flow_src_tot_l4_payload_len = 0
                        flow_dst_tot_l4_payload_len = 0
                        flow_risk = []
                        midstream = 0
                        guessed = 0
                        not_detected = 0

                    flow_tot_l4_payload_len += flow_src_tot_l4_payload_len + flow_dst_tot_l4_payload_len
                    risky += 1 if len(flow_risk) > 0 else 0
                    midstream += 1 if midstream != 0 else 0
                    guessed += 1 if guessed != 0 else 0
                    not_detected = 1 if not_detected != 0 else 0

        return alias_count, source_count, flow_count, \
               flow_tot_l4_payload_len, \
               risky, midstream, guessed, not_detected

    @staticmethod
    def prettifyBytes(bytes_received, is_byte_unit = True):
        if not is_byte_unit:
            size_names = ['', 'K', 'M', 'G', 'T']
            divisor = 1000
        else:
            size_names = ['B', 'KiB', 'MiB', 'GiB', 'TiB']
            divisor = 1024

        if bytes_received == 0:
            i = 0
        else:
            i = min(int(math.floor(math.log(bytes_received, divisor))), len(size_names) - 1)
        p = math.pow(divisor, i)
        s = round(bytes_received / p, 2)

        if not is_byte_unit:
            return '{:.0f}{}'.format(s, ' ' + size_names[i] if len(size_names[i]) > 0 else size_names[i])
        else:
            return '{:.2f} {}'.format(s, size_names[i])

    def resetStatus(self):
        if self.statusbar_enabled is False:
            return

        sys.stdout.write('\r' + str(' ' * self.last_status_length) + '\r')
        sys.stdout.flush()

    def printStatus(self):
        if self.statusbar_enabled is False:
            return

        alias_count, source_count, flow_count, \
        tot_l4_payload_len, \
        risky, midstream, guessed, not_detected = self.__getStatsFromFlowMgr()

        out_str = '\r[n|tot|avg JSONs: {}|{}|{}/s] [tot l4: {}] ' \
            '[lss|srcs: {}|{}] ' \
            '[flws|rsky|mdstrm|!dtctd|gssd: {}|{}|{}|{}|{} / {}|{}|{}|{}|{}] [{}]' \
            ''.format(self.json_lines,
                      Stats.prettifyBytes(self.nsock.received_bytes),
                      Stats.prettifyBytes(self.avg_xfer_json_bytes),
                      Stats.prettifyBytes(tot_l4_payload_len + self.expired_tot_l4_payload_len),
                      alias_count, source_count,
                      flow_count, risky, midstream, not_detected, guessed,
                      flow_count + self.total_flows,
                      risky + self.risky_flows,
                      midstream + self.midstream_flows,
                      not_detected + self.not_detected_flows,
                      guessed + self.guessed_flows,
                      self.__getSpinner())
        self.last_status_length = len(out_str) - 1 # '\r'

        sys.stdout.write(out_str)
        sys.stdout.flush()

def prettifyEvent(color_list, whitespaces, text):
    term_attrs = str()
    for color in color_list:
        term_attrs += str(color)
    fmt = '{}{:>' + str(whitespaces) + '}{}'
    return fmt.format(term_attrs, text, TermColor.END)

def prettifyTimediff(epoch_ts1, epoch_ts2):
    dt1 = datetime.datetime.fromtimestamp(epoch_ts1)
    dt2 = datetime.datetime.fromtimestamp(epoch_ts2)
    seconds_diff = (dt2 - dt1).total_seconds()
    return '{:.>4}m{:.>3}s'.format(int(seconds_diff / 60), int(seconds_diff) % 60)

def checkEventFilter(json_dict):
    flow_events = {'new': args.new, 'end': args.end, 'idle': args.idle,
                   'guessed': args.guessed, 'detected': args.detected,
                   'detection-update': args.detection_update,
                   'not-detected': args.not_detected,
                   'update': args.update, 'analyse': args.analyse}

    if flow_events[json_dict['flow_event_name']] is True:
        return True

    if 'ndpi' in json_dict and 'flow_risk' in json_dict['ndpi']:
        if args.risky is True:
            return True

    if json_dict['midstream'] != 0:
        if args.midstream is True:
            return True

    flow_event_filter_disabled = True
    for flow_event in list(flow_events.values()) + [args.risky, args.midstream]:
        if flow_event is True:
            flow_event_filter_disabled = False
            break
    if flow_event_filter_disabled is True:
        return True

    return False

def whois(ip_str):
    if ip_str not in whois_db:
        try:
            whois_json = ipwhois.ipwhois.IPWhois(ip_str).lookup_whois()
            whois_db[ip_str] = whois_json['asn_description']
        except (ipwhois.exceptions.IPDefinedError, dns.resolver.NoResolverConfiguration):
            return None
    return whois_db[ip_str]

def onFlowCleanup(instance, current_flow, global_user_data):
    stats = global_user_data
    stats.updateOnCleanup(current_flow)

    return True

def limitFloatValue(value, fmt, limit):
    if float(value) < float(limit) and float(value) > 0.0:
        return '<' + str(fmt).format(limit)
    else:
        return ' ' + str(fmt).format(value)

def onJsonLineRecvd(json_dict, instance, current_flow, global_user_data):
    stats = global_user_data
    stats.update(json_dict, current_flow)

    if 'packet_event_id' in json_dict:
        return True

    stats.resetStatus()

    instance_and_source = ''
    if args.hide_instance_info is False:
        instance_and_source += '[{}][{}][{:.>2}] '.format(
                        TermColor.setColorByString(instance.alias),
                        TermColor.setColorByString(instance.source),
                        json_dict['thread_id'] if 'thread_id' in json_dict else '')
    else:
        instance_and_source += ' '

    basic_daemon_event_prefix = ''
    timestamp = ''
    if args.print_timestamp is True:
        if 'thread_ts_usec' in json_dict:
            timestamp += '[{}]'.format(time.strftime('%H:%M:%S',
                                       time.localtime(nDPIsrvd.toSeconds(json_dict['thread_ts_usec']))))
        elif 'global_ts_usec' in json_dict:
            timestamp += '[{}]'.format(time.strftime('%H:%M:%S',
                                       time.localtime(nDPIsrvd.toSeconds(json_dict['global_ts_usec']))))

    first_seen = ''
    if args.print_first_seen is True:
        basic_daemon_event_prefix += ' ' * 11
        if 'flow_first_seen' in json_dict:
            first_seen = '[' + prettifyTimediff(nDPIsrvd.toSeconds(json_dict['flow_first_seen']),
                                                nDPIsrvd.toSeconds(json_dict['thread_ts_usec'])) + ']'

    last_seen = ''
    if args.print_last_seen is True:
        basic_daemon_event_prefix +=  ' ' * 11
        if current_flow is not None:
            flow_last_seen = nDPIsrvd.FlowManager.getLastPacketTime(instance, current_flow.flow_id, json_dict)
            last_seen = '[' + prettifyTimediff(nDPIsrvd.toSeconds(flow_last_seen),
                                               nDPIsrvd.toSeconds(json_dict['thread_ts_usec'])) + ']'

    if 'daemon_event_id' in json_dict:
        if json_dict['daemon_event_name'] == 'status':
            color = [TermColor.WARNING]
            daemon_msg = list()
            daemon_msg += ['[Processed: {} pkts][ZLib][compressions: {}|diff: {} / {}]'.format(
                             json_dict['packets-processed'],
                             json_dict['total-compressions'], json_dict['current-compression-diff'], json_dict['total-compression-diff'])]
            daemon_msg += ['[Flows][active: {} / {}|skipped: {}|!detected: {}|guessed: {}|' \
                                   'detection-updates: {}|updates: {}]'.format(
                             json_dict['current-active-flows'], json_dict['total-active-flows'],
                             json_dict['total-skipped-flows'],
                             json_dict['total-not-detected-flows'], json_dict['total-guessed-flows'],
                             json_dict['total-detection-updates'], json_dict['total-updates'])]
        else:
            color = [TermColor.WARNING, TermColor.BLINK]
            daemon_msg = list()
            daemon_msg += [json_dict['daemon_event_name']]
        for dm in daemon_msg:
            print('{}{}{} {}: {}'.format(timestamp, basic_daemon_event_prefix, instance_and_source,
                                         prettifyEvent(color, 15, 'DAEMON-EVENT'), dm))
        stats.printStatus()
        return True
    if 'error_event_id' in json_dict:
        print('{}{}{} {}: {} [{}/{}]'.format(timestamp, basic_daemon_event_prefix, instance_and_source,
                                 prettifyEvent([TermColor.FAIL, TermColor.BLINK], 15, 'ERROR-EVENT'),
                                 json_dict['error_event_name'], json_dict['threshold_n'], json_dict['threshold_n_max']))
        stats.printStatus()
        return True
    elif 'flow_event_id' not in json_dict:
        stats.printStatus()
        return True

    if checkEventFilter(json_dict) is False:
        stats.printStatus()
        return True

    ndpi_proto_categ_breed = ''
    next_lines = []

    if 'ndpi' in json_dict:
        ndpi_proto_categ_breed += ' '

        if 'proto' in json_dict['ndpi']:
            if args.ignore_protocol is not None:
                for proto in args.ignore_protocol:
                    if json_dict['ndpi']['proto'].lower().startswith(proto.lower()) is True:
                        stats.printStatus()
                        return True
            ndpi_proto_categ_breed += '[' + str(json_dict['ndpi']['proto']) + ']'

        if 'proto_by_ip' in json_dict['ndpi']:
            if args.ignore_ip_protocol is not None:
                for proto in args.ignore_ip_protocol:
                    if json_dict['ndpi']['proto_by_ip'].lower().startswith(proto.lower()) is True:
                        stats.printStatus()
                        return True
            ndpi_proto_categ_breed += '[' + str(json_dict['ndpi']['proto_by_ip']) + ']'

        if 'category' in json_dict['ndpi']:
            if args.ignore_category is not None:
                for cat in args.ignore_category:
                    if json_dict['ndpi']['category'].lower().startswith(cat.lower()) is True:
                        stats.printStatus()
                        return True
            ndpi_proto_categ_breed += '[' + str(json_dict['ndpi']['category']) + ']'

        if 'breed' in json_dict['ndpi']:
            if args.ignore_breed is not None:
                for breed in args.ignore_breed:
                    if json_dict['ndpi']['breed'].lower().startswith(breed.lower()) is True:
                        stats.printStatus()
                        return True
            ndpi_proto_categ_breed += '[' + str(json_dict['ndpi']['breed']) + ']'

        if 'flow_risk' in json_dict['ndpi']:
            severity = 0
            cnt = 0

            next_lines += ['']
            for key in json_dict['ndpi']['flow_risk']:
                next_lines[0] += str(json_dict['ndpi']['flow_risk'][key]['risk']) + ', '
                if json_dict['ndpi']['flow_risk'][key]['severity'] == 'Low':
                    severity = max(severity, 1)
                elif json_dict['ndpi']['flow_risk'][key]['severity'] == 'Medium':
                    severity = max(severity, 2)
                elif json_dict['ndpi']['flow_risk'][key]['severity'] == 'High':
                    severity = max(severity, 3)
                elif json_dict['ndpi']['flow_risk'][key]['severity'] == 'Severe':
                    severity = max(severity, 4)
                cnt += 1

            if severity == 1:
                color = TermColor.WARNING + TermColor.BOLD
            elif severity == 2:
                color = TermColor.WARNING + TermColor.BOLD + TermColor.BLINK
            elif severity == 3:
                color = TermColor.FAIL + TermColor.BOLD
            elif severity == 4:
                color = TermColor.FAIL + TermColor.BOLD + TermColor.BLINK
            else:
                color = ''

            next_lines[0] = '{}{}{}: {}'.format(color, 'RISK', TermColor.END, next_lines[0][:-2])

    line_suffix = ''
    flow_event_name = ''
    flow_active_color = '' if json_dict['flow_state'] == 'finished' else TermColor.BOLD
    if json_dict['flow_event_name'] == 'guessed':
        flow_event_name += '{}{:>16}{}'.format(TermColor.HINT + flow_active_color,
                                               json_dict['flow_event_name'], TermColor.END)
    elif json_dict['flow_event_name'] == 'not-detected':
        flow_event_name += '{}{:>16}{}'.format(TermColor.WARNING + TermColor.BOLD + TermColor.BLINK,
                                               json_dict['flow_event_name'], TermColor.END)
    elif json_dict['flow_event_name'] == 'analyse':
        flow_event_name += '{}{:>16}{}'.format(TermColor.WARNING,
                                               json_dict['flow_event_name'], TermColor.END)
        if args.print_analyse_results is True:
            next_lines =  ['               {:>10}|{:>10}|{:>10}|{:>10}|{:>17}|{:>9}'.format(
                           'min', 'max', 'avg', 'stddev', 'variance', 'entropy')]
            next_lines += ['[IAT.........: {}|{}|{}|{}|{}|{}]'.format(
                               limitFloatValue(nDPIsrvd.toSeconds(json_dict['data_analysis']['iat']['min']),
                                               '{:>9.3f}', 0.001),
                               limitFloatValue(nDPIsrvd.toSeconds(json_dict['data_analysis']['iat']['max']),
                                               '{:>9.3f}', 0.001),
                               limitFloatValue(nDPIsrvd.toSeconds(json_dict['data_analysis']['iat']['avg']),
                                               '{:>9.3f}', 0.001),
                               limitFloatValue(nDPIsrvd.toSeconds(json_dict['data_analysis']['iat']['stddev']),
                                               '{:>9.3f}', 0.001),
                               limitFloatValue(nDPIsrvd.toSeconds(json_dict['data_analysis']['iat']['var']),
                                               '{:>16.3f}', 0.001),
                               limitFloatValue(json_dict['data_analysis']['iat']['ent'],
                                               '{:>8.3f}', 0.001)
                          )]
            next_lines += ['']
            next_lines[-1] += '[PKTLEN......: {}|{}|{}|{}|{}|{}]'.format(
                                  limitFloatValue(json_dict['data_analysis']['pktlen']['min'], '{:>9.3f}', 0.001),
                                  limitFloatValue(json_dict['data_analysis']['pktlen']['max'], '{:>9.3f}', 0.001),
                                  limitFloatValue(json_dict['data_analysis']['pktlen']['avg'], '{:>9.3f}', 0.001),
                                  limitFloatValue(json_dict['data_analysis']['pktlen']['stddev'],
                                                  '{:>9.3f}', 0.001),
                                  limitFloatValue(json_dict['data_analysis']['pktlen']['var'], '{:>16.3f}', 0.001),
                                  limitFloatValue(json_dict['data_analysis']['pktlen']['ent'], '{:>8.3f}', 0.001)
                              )
            next_lines += ['']
            next_lines[-1] += '[BINS(c->s)..: {}]'.format(','.join([str(n) for n in json_dict['data_analysis']['bins']['c_to_s']]))
            next_lines += ['']
            next_lines[-1] += '[BINS(s->c)..: {}]'.format(','.join([str(n) for n in json_dict['data_analysis']['bins']['s_to_c']]))
            next_lines += ['']
            next_lines[-1] += '[DIRECTIONS..: {}]'.format(','.join([str(n) for n in json_dict['data_analysis']['directions']]))
            next_lines += ['']
            iats = ''
            for n in json_dict['data_analysis']['iat']['data']:
                iats += '{:.1f},'.format(n / 1000.0)
            iats = iats[:-1]
            next_lines[-1] += '[IATS(ms)....: {}]'.format(iats)
            next_lines += ['']
            next_lines[-1] += '[PKTLENS.....: {}]'.format(','.join([str(n) for n in json_dict['data_analysis']['pktlen']['data']]))
            next_lines += ['']
            ents = ''
            for n in json_dict['data_analysis']['entropies']:
                ents += '{:.1f},'.format(n)
            ents = ents[:-1]
            next_lines[-1] += '[ENTROPIES...: {}]'.format(ents)
    else:
        if json_dict['flow_event_name'] == 'new':
            line_suffix = ''
            if json_dict['midstream'] != 0:
                line_suffix += ' [{}]'.format(TermColor.WARNING + TermColor.BLINK + 'MIDSTREAM' + TermColor.END)
            if args.ipwhois is True:
                src_whois = whois(json_dict['src_ip'].lower())
                dst_whois = whois(json_dict['dst_ip'].lower())
                line_suffix += ' ['
                if src_whois is not None:
                    line_suffix += '{}'.format(src_whois)
                if dst_whois is not None:
                    if src_whois is not None:
                        line_suffix += ' -> '
                    line_suffix += '{}'.format(dst_whois)
                if src_whois is None and dst_whois is None:
                    line_suffix += TermColor.WARNING + 'WHOIS empty' + TermColor.END
                line_suffix += ']'
        flow_event_name += '{}{:>16}{}'.format(flow_active_color, json_dict['flow_event_name'], TermColor.END)

    if 'ndpi' in json_dict and 'hostname' in json_dict['ndpi']:
        if args.ignore_hostname is not None:
            for hostname in args.ignore_hostname:
                if json_dict['ndpi']['hostname'].lower().endswith(hostname.lower()) is True:
                    stats.printStatus()
                    return True
        if args.print_hostname is True:
            line_suffix += '[{}]'.format(json_dict['ndpi']['hostname'])

    if args.print_bytes is True:
        src_color = ''
        dst_color = ''
        tot_color = ''
        if json_dict['flow_src_tot_l4_payload_len'] >= 1 * 1024 * 1024:
            tot_color = src_color = TermColor.HINT
            if json_dict['flow_src_tot_l4_payload_len'] >= 1 * 1024 * 1024 * 1024:
                src_color += TermColor.BOLD + TermColor.BLINK
        if json_dict['flow_dst_tot_l4_payload_len'] >= 1 * 1024 * 1024:
            tot_color = dst_color = TermColor.HINT
            if json_dict['flow_dst_tot_l4_payload_len'] >= 1 * 1024 * 1024 * 1024:
                dst_color += TermColor.BOLD + TermColor.BLINK
        line_suffix += '[' + src_color + Stats.prettifyBytes(json_dict['flow_src_tot_l4_payload_len']) + TermColor.END + ']' \
                       '[' + dst_color + Stats.prettifyBytes(json_dict['flow_dst_tot_l4_payload_len']) + TermColor.END +']' \
                       '[' + tot_color + Stats.prettifyBytes(json_dict['flow_src_tot_l4_payload_len'] + \
                                                             json_dict['flow_dst_tot_l4_payload_len']) + TermColor.END + ']'

    if args.print_packets is True:
        line_suffix += '[' + Stats.prettifyBytes(json_dict['flow_src_packets_processed'], False) + ']' \
                       '[' + Stats.prettifyBytes(json_dict['flow_dst_packets_processed'], False) + ']'

    if json_dict['l3_proto'] == 'ip4':
        print('{}{}{}{}{}: [{:.>6}] [{}][{:.>5}] [{:.>15}]{} -> [{:.>15}]{}{}{}' \
              ''.format(timestamp, first_seen, last_seen, instance_and_source, flow_event_name, 
              json_dict['flow_id'], json_dict['l3_proto'], json_dict['l4_proto'],
              json_dict['src_ip'].lower(),
              '[{:.>5}]'.format(json_dict['src_port']) if 'src_port' in json_dict else '',
              json_dict['dst_ip'].lower(),
              '[{:.>5}]'.format(json_dict['dst_port']) if 'dst_port' in json_dict else '',
              ndpi_proto_categ_breed, line_suffix))
    elif json_dict['l3_proto'] == 'ip6':
        print('{}{}{}{}{}: [{:.>6}] [{}][{:.>5}] [{:.>39}]{} -> [{:.>39}]{}{}{}' \
                ''.format(timestamp, first_seen, last_seen, instance_and_source, flow_event_name,
              json_dict['flow_id'], json_dict['l3_proto'], json_dict['l4_proto'],
              json_dict['src_ip'].lower(),
              '[{:.>5}]'.format(json_dict['src_port']) if 'src_port' in json_dict else '',
              json_dict['dst_ip'].lower(),
              '[{:.>5}]'.format(json_dict['dst_port']) if 'dst_port' in json_dict else '',
              ndpi_proto_categ_breed, line_suffix))
    else:
        raise RuntimeError('unsupported l3 protocol: {}'.format(json_dict['l3_proto']))

    for line in next_lines:
        print('{}{}{}{}{:>18}{}'.format(timestamp, first_seen, last_seen,
                                        instance_and_source, '', line))

    stats.printStatus()

    return True

if __name__ == '__main__':
    argparser = nDPIsrvd.defaultArgumentParser('Prettify and print events using the nDPIsrvd Python interface.', True)
    argparser.add_argument('--no-color', action='store_true', default=False,
                           help='Disable all terminal colors.')
    argparser.add_argument('--no-statusbar', action='store_true', default=False,
                           help='Disable informational status bar.')
    argparser.add_argument('--hide-instance-info', action='store_true', default=False,
                           help='Hide instance Alias/Source prefixed every line.')
    argparser.add_argument('--print-timestamp', action='store_true', default=False,
                           help='Print received event timestamps.')
    argparser.add_argument('--print-first-seen', action='store_true', default=False,
                           help='Print first seen flow time diff.')
    argparser.add_argument('--print-last-seen', action='store_true', default=False,
                           help='Print last seen flow time diff.')
    argparser.add_argument('--print-bytes', action='store_true', default=False,
                           help='Print received/transmitted source/dest bytes for every flow.')
    argparser.add_argument('--print-packets', action='store_true', default=False,
                           help='Print received/transmitted source/dest packets for every flow.')
    argparser.add_argument('--guessed',    action='store_true', default=False, help='Print only guessed flow events.')
    argparser.add_argument('--not-detected', action='store_true', default=False, help='Print only undetected flow events.')
    argparser.add_argument('--detected',   action='store_true', default=False, help='Print only detected flow events.')
    argparser.add_argument('--detection-update', action='store_true', default=False, help='Print only detection-update flow events.')
    argparser.add_argument('--risky',      action='store_true', default=False, help='Print only risky flow events.')
    argparser.add_argument('--midstream',  action='store_true', default=False, help='Print only midstream flow events.')
    argparser.add_argument('--new',        action='store_true', default=False, help='Print only new flow events.')
    argparser.add_argument('--end',        action='store_true', default=False, help='Print only end flow events.')
    argparser.add_argument('--idle',       action='store_true', default=False, help='Print only idle flow events.')
    argparser.add_argument('--update',     action='store_true', default=False, help='Print only update flow events.')
    argparser.add_argument('--analyse',    action='store_true', default=False, help='Print only analyse flow events.')
    argparser.add_argument('--detection',  action='store_true', default=False, help='Print only detected/guessed/not-detected flow events.')
    argparser.add_argument('--ipwhois',    action='store_true', default=False, help='Use Python-IPWhois to print additional location information.')
    argparser.add_argument('--print-hostname', action='store_true', default=False, help='Print detected hostnames if available.')
    argparser.add_argument('--print-analyse-results', action='store_true', default=False,
                           help='Print detailed results of analyse events.')
    argparser.add_argument('--ignore-protocol', action='append', help='Ignore printing lines with a certain protocol.')
    argparser.add_argument('--ignore-ip-protocol', action='append', help='Ignore printing lines with a certain IP protocol.')
    argparser.add_argument('--ignore-category', action='append', help='Ignore printing lines with a certain category.')
    argparser.add_argument('--ignore-breed', action='append', help='Ignore printing lines with a certain breed.')
    argparser.add_argument('--ignore-hostname', action='append', help='Ignore printing lines with a certain hostname.')
    args = argparser.parse_args()

    if args.no_color is True:
        TermColor.disableColor()

    if args.ipwhois is True:
        import dns, ipwhois
        whois_db = dict()

    if args.detection is True:
        args.detected = True
        args.guessed = True
        args.not_detected = True

    address = nDPIsrvd.validateAddress(args)

    sys.stderr.write('Recv buffer size: {}\n'.format(nDPIsrvd.NETWORK_BUFFER_MAX_SIZE))
    sys.stderr.write('Connecting to {} ..\n'.format(address[0]+':'+str(address[1]) if type(address) is tuple else address))

    nsock = nDPIsrvdSocket()
    nDPIsrvd.prepareJsonFilter(args, nsock)
    nsock.connect(address)
    nsock.timeout(1.0)
    stats = Stats(nsock)

    if args.no_statusbar is True:
        stats.disableStatusbar()

    while True:
        try:
            nsock.loop(onJsonLineRecvd, onFlowCleanup, stats)
        except nDPIsrvd.SocketConnectionBroken as err:
            sys.stderr.write('\n{}\n'.format(err))
            break
        except KeyboardInterrupt:
            print('\n\nKeyboard Interrupt: cleaned up {} flows.'.format(len(nsock.shutdown())))
            break
        except nDPIsrvd.SocketTimeout:
            stats.updateSpinner()
            stats.resetStatus()
            stats.printStatus()
