Skip to content

Instantly share code, notes, and snippets.

View aeppert's full-sized avatar

Aaron Eppert aeppert

52 followers · 13 following
View GitHub Profile
@aeppert
aeppert / time_elapsed.bro
Last active February 17, 2020 03:25
Calculate elapsed time given two times
export {
type timeSpan: record {
hours: int;
minutes: int;
seconds: int;
};
}
function calc_elapsed_time(t1: time, t2: time) : timeSpan
{
@aeppert
aeppert / keybase.md
Created March 21, 2016 14:15

Keybase proof

I hereby claim:

  • I am aeppert on github.
  • I am aeppert (https://keybase.io/aeppert) on keybase.
  • I have a public key whose fingerprint is 7D23 1BB4 89F1 19A6 59CB 6706 A16D BEB5 10E3 D194

To claim this, I am signing this object:

@aeppert
aeppert / sine_wave_test_influxdb.py
Last active March 2, 2016 22:01
Write sine wave points to Influxdb for testing.
#!/usr/bin/python
import argparse
from influxdb import InfluxDBClient
import math
import datetime
import time
USER = 'root'
@aeppert
aeppert / pcap_annotate_influxdb.py
Created March 2, 2016 21:37
Annotate an Influxdb database with a PCAP being played for correlation across test events
#!/usr/bin/python
import sys
from optparse import OptionParser
import ConfigParser
from influxdb import InfluxDBClient
G_VALID_STATUS = ['start', 'stop']
@aeppert
aeppert / extract_smtp_stream.bro
Created February 29, 2016 19:52 — forked from dcode/extract_smtp_stream.bro
Extracts SMTP stream going both directions using Bro. Similar to "Follow TCP Stream" in Wireshark.
event protocol_confirmation (c: connection, atype: Analyzer::Tag, aid: count)
{
if ( atype == Analyzer::ANALYZER_SMTP )
{
local both_file = generate_extraction_filename(Conn::extraction_prefix, c, "both.dat");
local both_f = open(both_file);
set_contents_file(c$id, CONTENTS_BOTH, both_f);
}
}
@aeppert
aeppert / force_bind_to_a_specific_local_port_and_ssl.py
Last active February 5, 2016 22:29
Force a binding to a specific local port and then SSL encapsulate everything outbound.
#!/usr/bin/python
import ssl
import socket
def get_outbound_ip():
ret = None
s = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
s.connect(("gmail.com", 80))
@aeppert
aeppert / log_lag.py
Created January 20, 2016 18:42 — forked from JustinAzoff/log_lag.py
Bro log lag
#!/usr/bin/env python
import os
import sys
import time
DEFAULT_LOG = "/bro/logs/current/conn.log"
def config():
print """
graph_category network
@aeppert
aeppert / readable_memory_ps.sh
Created December 30, 2015 19:49
ps -eo size,pid,user,command --sort -size | awk '{ hr=$1/1024 ; printf("%13.2f Mb ",hr) } { for ( x=4 ; x<=NF ; x++ ) { printf("%s ",$x) } print "" }'
@aeppert
aeppert / run_dowser.py
Created December 30, 2015 17:09
Function to launch Dowser
def launch_memory_usage_server(host="127.0.0.1", port=8080):
import cherrypy
import dowser
cherrypy.tree.mount(dowser.Root())
cherrypy.config.update({
'environment': 'embedded',
'server.socket_host': host,
'server.socket_port': port
})
@aeppert
aeppert / install-bro-w_pfring_and_options.sh
Created October 27, 2015 16:41 — forked from dcode/install-bro-w_pfring_and_options.sh
Install bro packages that include PF_RING and optional performance enhancements on CentOS 7
# Install epel
sudo yum -y install epel-release
# Install kernel headers for current kernel
sudo yum install -y kernel-devel-$(uname -r) kernel-headers-$(uname -r)
# Install ntop repos
cat << EOF | sudo tee /etc/yum.repos.d/ntop.repo
[ntop]
name=ntop packages