philippreston

cat /audited_events.json | jq  -c '. | select((.type | contains("ARP")) and .metadata.ip_addr == "10.2.2.61") | (.timestamp /= 1000000000) | (.timestamp |= todate)' > arp_10.2.2.61.json

philippreston

// This forces unix-socket-factory to a later version which carries the native dependancies for building on the MAC
// over a UNIX domain socket
configurations.all {
    //noinspection GroovyAssignabilityCheck
    resolutionStrategy {
        force 'de.gesellix:unix-socket-factory:2016-04-06T22-21-19'
    }
}

philippreston

@staticmethod
def decode_ip(raw):
    ip = ["%d" % ((raw >> (24 - (i * 8))) & 0xFF) for i in range(0, 4)]
    return '.'.join(ip)

philippreston

# For Panda Debugging
pd.set_option('display.float_format', lambda x: '%.0f' % x)
pd.set_option('display.max_rows', 500)
pd.set_option('display.max_columns', 500)
pd.set_option('display.width', 1000)

philippreston

import org.springframework.beans.factory.annotation.Value
import org.springframework.context.annotation.Configuration
import org.springframework.context.annotation.PropertySource

@Configuration
@PropertySource('classpath:application.properties')
class AppConfig {

    @Value('${app.version.major}')
    def major

philippreston

def version_major = 0
def version_minor = 1
def version_patch = 0
def version_release = "BETA"

group 'org.company'
version "${version_major}.${version_minor}.${version_patch}.${version_release}"

task setVersion() {
    def appProperties = new File("src/main/resources/application.properties")

philippreston

@Grapes([
        @Grab(group = 'com.gmongo', module = 'gmongo', version = '1.5'),
        @GrabExclude("org.codehaus.groovy:groovy-xml")
])
import com.gmongo.GMongo
import com.mongodb.DBCollection
import com.mongodb.DBObject

philippreston

def get_time(epoch_us, fmt="%Y-%m-%d %H:%M:%S.%f"):
    dt = float(epoch_us / 1000000.0)
    v = datetime.datetime.fromtimestamp(dt)
    return v.strftime(fmt)


def get_micros_for_time(stime, fmt="%Y-%m-%d %H:%M:%S.%f"):
    assert stime
    tt = time.strptime(stime, fmt)
    assert tt

philippreston

ip = "192.168.0.1"

// Encode
e = (ip.split(/\./) as List).withIndex().collect { v,i->Long.parseLong(v) << (24 - (8 * i))}.inject(0) {a,b -> a+b }

// Decode
d = (0..3).collect{ (e >> (24 - (it * 8))) & 0xFF }.join(".")
              
assert d == ip

philippreston

import sys
import datetime

objectid = int(sys.argv[1], 16)
fmt = "%Y-%m-%d %H:%M:%S"

counter = objectid & 0xFFFFFF
shift = 24
process_id = (objectid >> shift) & 0xFFFF
shift += 16