next up previous contents index
Next: Values, Types, and Constants Up: Getting Started Previous: Running Bro   Contents   Index

Subsections

Helper utilities

Scripts

Documentation missing.


The hf utility

The hf utility reads text on stdin and attempts to convert any ``dotted quads'' it sees to hostnames. It is very convenient for running on Bro log files to generate human-readable forms. See the manual page included with the distribution for details.


The cf utility

The cf utility reads Unix timestamps at the beginning of lines on stdin and converts them to human-readable form. For example, for the input line:

972499885.784104 #26 131.243.70.68/1899 > 64.55.26.206/ftp start
it will generate:
Oct 25 11:51:25 #26 131.243.70.68/1899 > 64.55.26.206/ftp start

It takes two flags:

-l
specifies the long human-readable form, which includes the year. For example, on the above input, the output would instead be:
Oct 25 11:51:25 2000 #26 131.243.70.68/1899 > 64.55.26.206/ftp start

-s
specifies strict checking to ensure that the number at the beginning of a line is a plausible timestamp: it must have at least 9 digits, at most one decimal, and must have a decimal if there are 10 or more digits.

Without -s, an input like:

131.243.70.68 > 64.55.26.206
generates the output:
Dec 31 16:02:11 > 64.55.26.206
which, needless to say, is not very helpful. Deficiency: It seems clear that -s should be the default behavior.


next up previous contents index
Next: Values, Types, and Constants Up: Getting Started Previous: Running Bro   Contents   Index
Vern Paxson 2004-03-21