I am creating a simple script to plot specific fields for different protocols counted and sorted.
Your suggestions and feedback will be highly appreciated. Its just a prototype for basic HTTP fields, but I am planning to include DNS,SMB,SMTP and SSL.
You can find the script here: https://github.com/eaam/Bro/blob/master/dissect.bro
On a side note, I am stuck upon a situation where I wanted to handle all incoming data as strings regardless of the original field type. (For example, I would like to treat HTTP STATUS CODE as a string and not count, the same for IP, Ports…etc). however, I could not find something like “to_string” function here
Am I missing something ?
Thanks in advance