pcap-2-bro's Introduction

pcap-2-bro

Replay PCAP through a rock sensor

Command Line Options

-w --workers NUMBER (number of threads to allocate to pool)
-d --directory /path/to/dir (top directory if using the -r option or directory that contains Pcap files)
-r --recursive (if you have multiple pcaps in layered directories)
-f --file /path/to/pcap/file (single pcap ingest)
-v --verbose (use if you want status updates every 10 seconds on screen)
-s --source UUID or Source Name. This replaces the ROCK::sensor_id variable so that you can search for the data easily inside of ROCK and identify the source it came from.

pcap-2-bro's People

Contributors

Stargazers

Watchers

pcap-2-bro's Issues

Need source labeling

You should provide a command line argument to allow specifying a source identifier using the ROCK::sensor_id variable. This way it will be labelled correctly when it gets put into Kafka, allowing the analyst to query that specific data. If the user doesn't provide one, a random value should be used (perhaps a random UUID).

Also...you should use new Python format strings ;-)

You'll need to add the logic for the source parameter, but you could change the command string like so:

# Line 103
 command = '{} -C -r {} local "ROCK::sensor_id={}"'.format(bro_path, pcap, source)

Would like to create a virtual-env using rock-deploy

Would ultimately like to use rock-deploy to create a virtual environment and add link script to /usr/bin or other executable path so that this can be launched with out the prefix python

Recommend Projects