Skip to content

Commit

Permalink
Update for a directory name change
Browse files Browse the repository at this point in the history
Also a few other unrelated bro to zeek renaming changes.
  • Loading branch information
dnthayer committed May 24, 2019
1 parent 0ac94c2 commit 01756ef
Show file tree
Hide file tree
Showing 5 changed files with 12 additions and 12 deletions.
12 changes: 6 additions & 6 deletions README
Original file line number Diff line number Diff line change
Expand Up @@ -32,12 +32,12 @@ Overview

The ``trace-summary`` script reads both packet traces in `libpcap
<http://www.tcpdump.org>`_ format and connection logs produced by the
`Bro <http://www.bro.org>`_ network security monitor
`Zeek <http://www.zeek.org>`_ network security monitor
(for the latter, it supports both 1.x and 2.x log formats).

Here are two example outputs in the most basic form (note that IP
addresses are 'anonymized'). The first is from a packet trace and the
second from a Bro connection log::
second from a Zeek connection log::


>== Total === 2005-01-06-14-23-33 - 2005-01-06-15-23-43
Expand Down Expand Up @@ -76,11 +76,11 @@ Prerequisites
* This script requires Python 2.6 or newer.

* The `pysubnettree
<http://www.bro.org/documentation/pysubnettree.html>`_ Python
<http://www.zeek.org/documentation/pysubnettree.html>`_ Python
module.

* Eddie Kohler's `ipsumdump <http://www.cs.ucla.edu/~kohler/ipsumdump>`_
if using ``trace-summary`` with packet traces (versus Bro connection logs)
if using ``trace-summary`` with packet traces (versus Zeek connection logs)

Installation
------------
Expand All @@ -95,7 +95,7 @@ The general usage is::
trace-summary [options] [input-file]

Per default, it assumes the ``input-file`` to be a ``libpcap`` trace
file. If it is a Bro connection log, use ``-c``. If ``input-file`` is
file. If it is a Zeek connection log, use ``-c``. If ``input-file`` is
not given, the script reads from stdin. It writes its output to
stdout.

Expand All @@ -107,7 +107,7 @@ below. Run ``trace-summary --help`` to see the full list including
some more esoteric ones.

:-c:
Input is a Bro connection log instead of a ``libpcap`` trace
Input is a Zeek connection log instead of a ``libpcap`` trace
file.

:-b:
Expand Down
2 changes: 1 addition & 1 deletion testing/Scripts/diff-remove-hostname
Original file line number Diff line number Diff line change
@@ -1,7 +1,7 @@
#! /usr/bin/env bash
#
# Replace hostnames that occur after text such as "#2=" (e.g. the text
# "#3=bro.org" would become "#3=XXXX.XXXX.XXXX").
# "#3=zeek.org" would become "#3=XXXX.XXXX.XXXX").

sed 's/\(#[0-9]\{1,\}=\)[A-Za-z0-9][A-Za-z0-9.-]\{1,\}/\1XXXX.XXXX.XXXX/g'

2 changes: 1 addition & 1 deletion testing/btest.cfg
Original file line number Diff line number Diff line change
Expand Up @@ -6,7 +6,7 @@ IgnoreDirs = .svn CVS .tmp
IgnoreFiles = *.tmp *.swp #* *.trace .DS_Store

[environment]
PYTHONPATH=%(testbase)s/../../../../../build/aux/broctl/aux/pysubnettree
PYTHONPATH=%(testbase)s/../../../../../build/aux/zeekctl/aux/pysubnettree
PATH=%(testbase)s/..:%(testbase)s/Scripts:%(testbase)s/../../../../btest:%(default_path)s
FILES=%(testbase)s/Files
SCRIPTS=%(testbase)s/Scripts
Expand Down
2 changes: 1 addition & 1 deletion trace-summary
Original file line number Diff line number Diff line change
Expand Up @@ -983,7 +983,7 @@ optparser = optparse.OptionParser(usage="%prog [options] <pcap-file>|<conn-summa
optparser.add_option("-b", "--bytes", action="store_true", dest="bytes", default=False,
help="count fractions in terms of bytes rather than packets/connections")
optparser.add_option("-c", "--conn-summaries", action="store_true", dest="conns", default=False,
help="input file contains Bro connection summaries")
help="input file contains Zeek connection summaries")
optparser.add_option("--conn-version", action="store", type="int", dest="conn_version", default=0,
help="when used with -c, specify '1' for use with Bro version 1.x connection logs, or '2' for use with Bro 2.x format. '0' tries to guess the format")
optparser.add_option("-C", "--chema", action="store_true", dest="chema", default=False,
Expand Down
6 changes: 3 additions & 3 deletions trace-summary.1
Original file line number Diff line number Diff line change
Expand Up @@ -16,7 +16,7 @@ vs. outgoing traffic, per subnet, and per time-interval.

Per default, it assumes the
.IR input-file
to be a libpcap trace file. However, if it is a Bro connection log,
to be a libpcap trace file. However, if it is a Zeek connection log,
use \fB\-c\fR. If
.IR input-file
is not given, the script reads from stdin. It writes its output to stdout.
Expand All @@ -33,7 +33,7 @@ count fractions in terms of bytes rather than
packets/connections
.TP
\fB\-c\fR, \fB\-\-conn\-summaries\fR
input file contains Bro connection summaries
input file contains Zeek connection summaries
.TP
\fB\-\-conn\-version\fR=\fI\,CONN_VERSION\/\fR
when used with \fB\-c\fR, specify '1' for use with Bro
Expand Down Expand Up @@ -96,4 +96,4 @@ show top\-n for every interval
maximum time in ISO format
.SH AUTHOR
.B trace-summary
was written by The Bro Project <info@bro.org>.
was written by The Zeek Project <info@zeek.org>.

0 comments on commit 01756ef

Please sign in to comment.