[Bro] Enforce hex encoding in log output
Seth Hall
seth at icir.org
Mon Feb 11 21:06:31 PST 2013
On Feb 11, 2013, at 11:38 PM, Jesse Bowling <jessebowling at gmail.com> wrote:
> So now my question is: in the output of the data, can we ensure that ALL data is hex encoded, even if it's part of the ASCII character set? I need to put this data into a feed, and not being able to count on a delimiter is problematic...
Just do this…
if ( ! c$http?$post_body )
c$http$post_body = bytestring_to_hexstr(sub_bytes(data, 0, post_body_limit));
else if ( |c$http$post_body| < post_body_limit )
c$http$post_body = string_cat(c$http$post_body, bytestring_to_hexstr(sub_bytes(data, 0, post_body_limit-|c$http$post_body|)));
.Seth
--
Seth Hall
International Computer Science Institute
(Bro) because everyone has a network
http://www.bro-ids.org/
More information about the Bro
mailing list