# Process packets despite bad checksums.
redef ignore_checksums = T;
This will change significantly with Bro 2.2 when we have the file analysis
| <?xml version="1.0" encoding="UTF-8"?> | |
| <!DOCTYPE plist PUBLIC "-//Apple Computer//DTD PLIST 1.0//EN" | |
| "http://www.apple.com/DTDs/PropertyList-1.0.dtd"> | |
| <plist version="1.0"> | |
| <dict> | |
| <key>Label</key> | |
| <string>prehensile.networkwatcher</string> | |
| <key>ProgramArguments</key> | |
| <array> | |
| <string>/usr/bin/python</string> |
| #!/usr/bin/env python | |
| """ | |
| Example fabfile for PyMNtos September 2011 meeting. | |
| some examples of usage: | |
| $ fab -H somehost -- uname -a | |
| $ fab -H somehost run:'uname -a' | |
| $ fab -d example |
| (* ocamlfind ocamlopt -o exmpl -package curl -linkpkg exmpl.ml *) | |
| open Printf | |
| let _ = Curl.global_init Curl.CURLINIT_GLOBALALL | |
| (* | |
| ************************************************************************* | |
| ** Aux. functions | |
| ************************************************************************* | |
| *) |
| redef record fa_file += { | |
| is_my_extractor_going: bool &default=F; | |
| }; | |
| event file_over_new_connection(f: fa_file, c: connection, is_orig: bool) | |
| { | |
| if ( !f$is_my_extractor_going ) | |
| { | |
| f$is_my_extractor_going=T; | |
| if ( f$source == "HTTP" && is_orig == F ) |
| redef record fa_file += { | |
| is_my_extractor_going: bool &default=F; | |
| }; | |
| event file_over_new_connection(f: fa_file, c: connection, is_orig: bool) | |
| { | |
| if ( !f$is_my_extractor_going ) | |
| { | |
| f$is_my_extractor_going=T; | |
| if ( f$source == "HTTP" && is_orig == F ) |
| #!/usr/bin/awk -f | |
| # Parse IEEE OUI vendor list to JSON | |
| # http://standards.ieee.org/develop/regauth/oui/oui.txt | |
| # --- | |
| # Usage: | |
| # $ chmod +x parseoui.awk | |
| # $ wget http://standards.ieee.org/develop/regauth/oui/oui.txt | |
| # $ ./parseoui.awk oui.txt > oui.json | |
| BEGIN { |
| redef record HTTP::Info += { | |
| post_body: string &optional &log; | |
| }; | |
| redef record fa_file += { | |
| http_log: HTTP::Info &optional; | |
| }; | |
| event http_get_post_body(f: fa_file, data: string) |
| ##! Add the peer to the connection logs. | |
| module Conn; | |
| export { | |
| redef record Conn::Info += { | |
| peer: string &optional &log; | |
| }; | |
| } |
Allows you to use tables with the dashing framework.