joaoceron

import pandas as pd
import numpy as np
def search(df, *words):  #1
    """
    Return a sub-DataFrame of those rows whose Name column match all the words.
    """
    return df[np.logical_and.reduce([df['Name'].str.contains(word) for word in words])]   # 2


df = pd.DataFrame({'Name':['Virginia Google Governor',

joaoceron

from ripe.atlas.cousteau import ProbeRequest

# find all the probes for a list of countries 
filters = {"country_code__in":"AU,BR,CH,DE,ES,FR,IT,JP,NL,RU,SE,GB,US,ZA"}
probes = ProbeRequest(**filters)

result = []
# get the dualstack probes only
for probe in probes:
    if (probe["address_v4"] and probe["address_v6"]):         

joaoceron

# insert pandas Dataframe into InfluxDB
import sys
from influxdb import InfluxDBClient

dbname = "test"
user = "admin"
pwd = "admin"
host = "localhost"
port = 8086

joaoceron

# mirai signature
"tcp[4:4] == ip[16:4]"

joaoceron

bacnet                   	     Gets various information from a BACnet device.
s7                       	     Communicate using the S7 protocol and grab the device identifications.
iec-61850                	     MMS protocol
codesys                  	     Grab a banner for Codesys daemons
dnp3                     	     A dump of data from a DNP3 outstation
fox                      	     Grabs a banner for proprietary FOX protocol by Tridium
secure-fox               	     Grabs a banner for proprietary FOX protocol by Tridium
ethernetip               	     Grab information from a device supporting EtherNet/IP over TCP
ethernetip-udp           	     Grab information from a device supporting EtherNet/IP over UDP
general-electric-srtp    	     Check whether the GE SRTP service is active on the device.

joaoceron

# create database
mongo admin --host localhost -u admin -p admin --eval "db.getSiblingDB('mydb');"
use mydb
db.createUser( { user: "user1", pwd: "pass", roles: [ "readWrite", "dbAdmin" ], passwordDigestor:"server" } )
db.createCollection("log", { capped : true, size : 5242880, max : 5000 } )

joaoceron

!apt install proj-bin libproj-dev libgeos-dev
!pip install --upgrade plotly
!pip install --upgrade geopandas
!pip install --upgrade pyshp
!pip install --upgrade shapely
!pip install --upgrade geoplot
!pip3 install maxminddb-geolite2 --user

joaoceron

df_flows.dst_ip.replace({r'(\d+)\.(\d+)\.(\d+)\.(\d+)': r'\1.X.X.\4'}, regex=True)

joaoceron

Configuration

apt-get install libpcap-dev
apt-get install automake
apt-get install automake-1.15

https://tools.netsa.cert.org/yaf/yafdpi.html

joaoceron

tshark -r input_file.pcap -2R "< Wireshark Filter >" -T fields -e < Wireshark Field > -e <Wireshark Field>
## By using combination of "-T fields" and "-e" options, tshark will only print the fields you're interested in.

ip.src
ip.dst

tcp.srcport (udp.srcport)
tcp.dstport (udp.dstport)

## I want to check the number of TCP streams in the packet.