Given an input PCAP and a location in a Bro script, this script will filter the PCAP into a new file, which contains only the connections that visited that script location. This script can help filter a large PCAP to narrow down problematic connections, such as protocol violations, weirds, etc.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| package main | |
| import ( | |
| "fmt" | |
| "time" | |
| "github.com/shirou/gopsutil/load" | |
| ) | |
| var currentLoad *load.AvgStat |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # Ron Sweeney | |
| # Dev Arboretum | |
| # Original Post: http://www.clubpacswestmi.net/articles/2007/4/1/a-ruby-hl7-sniffer | |
| require 'pcap' | |
| require 'Ethernet' | |
| require 'rubygems' | |
| require 'ruby-hl7' | |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| package main | |
| import ( | |
| "flag" | |
| "fmt" | |
| "github.com/google/gopacket" | |
| "github.com/google/gopacket/pcap" | |
| "log" | |
| ) |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| package main | |
| import ( | |
| "fmt" | |
| "os" | |
| ) | |
| func main() { | |
| err := os.Rename("/dir1/file1", "/dir2/file2") |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| #include <sstream> | |
| #include <iostream> | |
| #include <numeric> | |
| #include <string> | |
| #include <iostream> | |
| std::string &righttrim(std::string &s) { | |
| s.erase(std::find_if(s.rbegin(), s.rend(), | |
| std::not1(std::ptr_fun<int, int>(std::isspace))).base(), s.end()); | |
| return s; |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| package main | |
| import ( | |
| "crypto/tls" | |
| "crypto/x509" | |
| "flag" | |
| "fmt" | |
| "io/ioutil" | |
| "log" | |
| "net/http" |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| package main | |
| import ( | |
| "fmt" | |
| "time" | |
| ) | |
| func getDurationDiff(t time.Time, duration string) (time.Time, error) { | |
| dur, err := time.ParseDuration(fmt.Sprintf("-%s", duration)) | |
| if err != nil { | |
| return time.Now(), err |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| #!/bin/bash | |
| start() { | |
| echo "Starting" | |
| } | |
| stop() { | |
| echo "Stopping" | |
| } |