Skip to content

Instantly share code, notes, and snippets.

View aeppert's full-sized avatar

Aaron Eppert aeppert

52 followers · 13 following
View GitHub Profile
@aeppert
aeppert / bro_conn_uid_modify.bro
Last active February 17, 2020 03:32
Modify Bro's conn_uid inline
export {
global g_rolling_conn_counter: int = 0;
global probeid: int = 12345;
}
event new_connection(c: connection) &priority=20
{
local uid_1 = fmt("%08x", to_int(strftime("%s", c$start_time)));
local uid_2 = fmt("%08x", g_rolling_conn_counter);
local uid_3 = fmt("%08x", probeid);
@aeppert
aeppert / to_hex.cc
Last active September 9, 2015 14:11
to_hex template
// Header:
// template <class T> std::string to_hex(T t, std::string prefix = "", bool pad = true, int8 custom_len = -1);
#include <sstream>
#include <string>
#include <limits>
template <class T> std::string to_hex(T t, std::string prefix, bool pad, int8 custom_len)
{
@aeppert
aeppert / split_tokens.cc
Created September 8, 2015 19:13
split_tokens in C++
#include <string>
#include <sstream>
#include <vector>
std::vector<std::string> split_tokens(const std::string &s, char delim) {
std::stringstream ss(s);
std::string item;
std::vector<std::string> tokens;
while (getline(ss, item, delim)) {
if(item.length() > 0) {
@aeppert
aeppert / change_default_writer.bro
Created September 11, 2015 17:26
Globally redefine the default log writer in Bro
export {
redef Log::default_writer = Log::WRITER_TCPLOG;
}
@aeppert
aeppert / ignore_ssl_cert_validation.py
Created October 1, 2015 17:06
Work around SSL cert validation decorator
def disable_ssl_cert_validation(func):
def inner(*args, **kwargs):
default_context = None
ret = None
try:
default_context = ssl._create_default_https_context
ssl._create_default_https_context = ssl._create_unverified_context
ret = func(*args, **kwargs)
finally:
ssl._create_default_https_context = default_context
@aeppert
aeppert / port_ping.py
Created October 1, 2015 17:08
Attempt to verify a host is alive via connecting to a supplied TCP port
def port_ping(host, port):
ret = False
sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
try:
sock.connect((socket.gethostbyname(host), int(port)))
sock.close()
ret = True
except socket.error:
ret = False
return ret
@aeppert
aeppert / install-bro-w_pfring_and_options.sh
Created October 27, 2015 16:41 — forked from dcode/install-bro-w_pfring_and_options.sh
Install bro packages that include PF_RING and optional performance enhancements on CentOS 7
# Install epel
sudo yum -y install epel-release
# Install kernel headers for current kernel
sudo yum install -y kernel-devel-$(uname -r) kernel-headers-$(uname -r)
# Install ntop repos
cat << EOF | sudo tee /etc/yum.repos.d/ntop.repo
[ntop]
name=ntop packages
@aeppert
aeppert / run_dowser.py
Created December 30, 2015 17:09
Function to launch Dowser
def launch_memory_usage_server(host="127.0.0.1", port=8080):
import cherrypy
import dowser
cherrypy.tree.mount(dowser.Root())
cherrypy.config.update({
'environment': 'embedded',
'server.socket_host': host,
'server.socket_port': port
})
@aeppert
aeppert / readable_memory_ps.sh
Created December 30, 2015 19:49
ps -eo size,pid,user,command --sort -size | awk '{ hr=$1/1024 ; printf("%13.2f Mb ",hr) } { for ( x=4 ; x<=NF ; x++ ) { printf("%s ",$x) } print "" }'
@aeppert
aeppert / log_lag.py
Created January 20, 2016 18:42 — forked from JustinAzoff/log_lag.py
Bro log lag
#!/usr/bin/env python
import os
import sys
import time
DEFAULT_LOG = "/bro/logs/current/conn.log"
def config():
print """
graph_category network