Bro script for extracting all TCP stream contents.

gistfile1.txt

@load base/utils/files

global conn_files: table[string] of file &synchronized;

redef tcp_content_deliver_all_orig = T;
redef tcp_content_deliver_all_resp = T;

event tcp_contents(c: connection, is_orig: bool, seq: count, contents: string)
  {
	local fname: string;
	local f: file;
	if (is_orig) {
		fname = generate_extraction_filename("contents", c, fmt("%s_%s", c$uid, "orig.dat"));
	} else {
		fname = generate_extraction_filename("contents", c, fmt("%s_%s", c$uid, "resp.dat"));
	}
	if (fname in conn_files) {
		f = conn_files[fname];
	} else {
		f = open(fname);
		conn_files[fname] = f;
	}
	write_file(f, contents);
	#print fmt("%f bytes total.", my_counter);
	}

event bro_done()
	{
	flush_all();
	}