Log entire payloads

Zeek
1

Hi everybody !!!

I'd like to log http payloads for each connection seen on my network.

In fact, I'd like to get something like :
Src_IP;Dst_IP;Request_Payload;Reply_Payload

but with entire payloads (not only URIs, but also banners...)

At the moment, the only way I found to manage that is to load the signature module and write a signature file using payload /.*/, in order to get the payloads on signature_match events with the data string.

It works, but unfortunately, this solution is a bit heavy in term of CPU usage. There's probably a way to get these payloads using a built-in function (and avoiding signatures module) ??? In fact, having a look at the http-related modules, I can't find how I can handle this problem...

Anybody to help me ??? (or just to tell me it's not possible with built-in functionnalities... ;-( )

Yohann.

2

I'd like to log http payloads for each connection seen on my network.

In fact, I'd like to get something like :
Src_IP;Dst_IP;Request_Payload;Reply_Payload

but with entire payloads (not only URIs, but also banners...)

Hi, Yohann,

One possibility is to load the contents.bro script. It will write the
contents of every connection to two files (contents-*), one for each
direction. Note that it does writing for every connection, not just HTTP
ones. If you want the latter, you might want to adapt the script
accordingly.

Ruoming