I like FileAnalyzer and its use of libmagic. But I'd like to explore ways it can be used for protocols other than FTP, SMTP, etc. Would it be possible to expose some BIFs so that the magic number analyzer could be used elsewhere, such as http_entity_data? Or is this already there and I'm just missing it? Thanks!
Eric
edthoma@sandia.gov
Here is a patch for Bro's trunk to add two libmagic BiFs. (identify_magic_descr, identify_magic_mime). I have a corresponding Bro script for identifying files transferred over HTTP if you're interested in it too.
.Seth
libmagic_bifs.patch (1.83 KB)
(I'm sending this to the list again since I sent it to the wrong list last time)
http-identified-files.bro (2.93 KB)