Given an input PCAP and a location in a Bro script, this script will filter the PCAP into a new file, which contains only the connections that visited that script location. This script can help filter a large PCAP to narrow down problematic connections, such as protocol violations, weirds, etc.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| package main | |
| import ( | |
| "fmt" | |
| "os" | |
| ) | |
| func main() { | |
| err := os.Rename("/dir1/file1", "/dir2/file2") |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| package main | |
| import ( | |
| "flag" | |
| "fmt" | |
| "github.com/google/gopacket" | |
| "github.com/google/gopacket/pcap" | |
| "log" | |
| ) |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # Ron Sweeney | |
| # Dev Arboretum | |
| # Original Post: http://www.clubpacswestmi.net/articles/2007/4/1/a-ruby-hl7-sniffer | |
| require 'pcap' | |
| require 'Ethernet' | |
| require 'rubygems' | |
| require 'ruby-hl7' | |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| package main | |
| import ( | |
| "fmt" | |
| "time" | |
| "github.com/shirou/gopsutil/load" | |
| ) | |
| var currentLoad *load.AvgStat |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| #!/bin/bash | |
| for i in `find . -type f -name "$1"` | |
| do | |
| mv $i $i.pcap | |
| tshark -r $i.pcap -q -z io,phs > $i-summary.txt | |
| done |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| set theApp to "Chrome" | |
| set appHeight to 720 | |
| set appWidth to 1280 | |
| tell application "Finder" | |
| set screenResolution to bounds of window of desktop | |
| end tell | |
| set screenWidth to item 3 of screenResolution | |
| set screenHeight to item 4 of screenResolution |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| #include <stdio.h> | |
| #include <stdlib.h> | |
| #include <cxxabi.h> | |
| #include <link.h> | |
| #include <string> | |
| #include <vector> | |
| #include <iostream> | |
| using namespace std; |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| #include <vector> | |
| #include <iostream> | |
| #include <map> | |
| #include <functional> | |
| #include <numeric> | |
| using namespace std; | |
| #define VIN_LEN 17 | |
| #define VIN_CHECKDIGIT_POS 8 |