Author Topic: bro-cut command  (Read 1522 times)

golfreeze

  • Administrator
  • Hero Member
  • *****
  • Posts: 2072
    • View Profile
    • นั่งสมาธิ สติปัฏฐานสี่ พาเที่ยววัด แนะนำวัด แจกcd ธรรมะฟรี
    • Email
bro-cut command
« on: มิถุนายน 19, 2018, 11:10:09 AM »
bro-cut command ใช้เป็นตัว parse เพื่อแยกข้อความออกมา จาก content รวม

Bro, a powerful network security monitor, which by default churns out ASCII logs in a easily parseable whitespace separated (column) format from network traffic, live or PCAP. Because this logs are in the aforementioned format it makes them very hackable with the standard unix toolset. If you’re an experienced unix user with ample networking knowledge you probably have all the know-how to immediately pull useful data from Bro logs. If you’re not familiar with the standard unix toolset e.g. cat, grep, awk, uniq, sort, head, tailetc., digging through Bro logs is a great way to learn these tools and also to gain a better understanding of network traffic.

https://www.bro.org/sphinx-git/logs/index.html
https://blog.rapid7.com/2016/06/02/working-with-bro-logs-queries-by-example/

# cat conn.log | bro-cut id.orig_h id.orig_p id.resp_h duration
141.142.220.202   5353    224.0.0.251     -
fe80::217:f2ff:fed7:cf65  5353    ff02::fb        -
141.142.220.50    5353    224.0.0.251     -
141.142.220.118   43927   141.142.2.2     0.000435
141.142.220.118   37676   141.142.2.2     0.000420
141.142.220.118   40526   141.142.2.2     0.000392
141.142.220.118   32902   141.142.2.2     0.000317
141.142.220.118   59816   141.142.2.2     0.000343
141.142.220.118   59714   141.142.2.2     0.000375
141.142.220.118   58206   141.142.2.2     0.000339
[...]