[Bro] Enforce hex encoding in log output

Seth Hall seth at icir.org
Mon Feb 11 21:06:31 PST 2013


On Feb 11, 2013, at 11:38 PM, Jesse Bowling <jessebowling at gmail.com> wrote:

> So now my question is: in the output of the data, can we ensure that ALL data is hex encoded, even if it's part of the ASCII character set? I need to put this data into a feed, and not being able to count on a delimiter is problematic...


Just do this…


                if ( ! c$http?$post_body )
                        c$http$post_body = bytestring_to_hexstr(sub_bytes(data, 0, post_body_limit));
                else if ( |c$http$post_body| < post_body_limit )
                        c$http$post_body = string_cat(c$http$post_body, bytestring_to_hexstr(sub_bytes(data, 0, post_body_limit-|c$http$post_body|)));

  .Seth

--
Seth Hall
International Computer Science Institute
(Bro) because everyone has a network
http://www.bro-ids.org/





More information about the Bro mailing list