aeppert

breakpoint_to_pcap

Overview

Given an input PCAP and a location in a Bro script, this script will filter the PCAP into a new file, which contains only the connections that visited that script location. This script can help filter a large PCAP to narrow down problematic connections, such as protocol violations, weirds, etc.

Example

aeppert

# Ron Sweeney
# Dev Arboretum
# Original Post: http://www.clubpacswestmi.net/articles/2007/4/1/a-ruby-hl7-sniffer

require 'pcap'
require 'Ethernet'
require 'rubygems'
require 'ruby-hl7'

aeppert

#include <stdlib.h>
#include <stdio.h>
#include <string.h>
#include <iostream>
#include <unistd.h>

#include <boost/thread.hpp>
#include <sys/mman.h>
#include <poll.h>
#include <arpa/inet.h>

aeppert

import BaseHTTPServer
from SimpleHTTPServer import SimpleHTTPRequestHandler
import sys
import base64

key = ""

class AuthHandler(SimpleHTTPRequestHandler):
    ''' Main class to present webpages and authentication. '''
    def do_HEAD(self):