Skip to content

Instantly share code, notes, and snippets.

@aeppert
Last active February 17, 2020 03:32
Show Gist options
  • Select an option

  • Save aeppert/b6b44088b20db6b4a4e3 to your computer and use it in GitHub Desktop.

Select an option

Save aeppert/b6b44088b20db6b4a4e3 to your computer and use it in GitHub Desktop.
Modify Bro's conn_uid inline
export {
global g_rolling_conn_counter: int = 0;
global probeid: int = 12345;
}
event new_connection(c: connection) &priority=20
{
local uid_1 = fmt("%08x", to_int(strftime("%s", c$start_time)));
local uid_2 = fmt("%08x", g_rolling_conn_counter);
local uid_3 = fmt("%08x", probeid);
if (g_rolling_conn_counter == 0xFFFFFFFE) {
g_rolling_conn_counter = 0;
} else {
g_rolling_conn_counter += 1;
}
c$uid = string_cat(uid_1, uid_2, uid_3);
}
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment