Skip to content
Detecting Bitcoin mining traffic with Bro.
Zeek Standard ML
Branch: master
Clone or download
jsiwek Separate MinerGate method into their own set/protocol.
Also change 'extract_json_rpc_request_method' into
'extract_json_rpc_request_methods' which may return a set of method
names of a single one.
Latest commit dbbb8b6 Feb 1, 2018
Permalink
Type Name Latest commit message Commit time
Failed to load latest commit information.
LICENSE
README.rst
__load__.bro
bro-pkg.meta
json-rpc.sig
mining.bro

README.rst

Bro Module for Detecting Cryptocurrency (Bitcoin) Mining Hosts

This script module for Bro can detect Bitcoin, Litecoin, PPCoin, or other cryptocurrency mining traffic that uses getwork, getblocktemplate, or Stratum mining protocols over TCP or HTTP. Note that the module cannot currently detect the Bitcoin P2P protocol, which is different from the mining protocols.

See mining.bro for more details on how it works.

Installation

Via bro-pkg:

bro-pkg install jsiwek/bro_bitcoin

Manually:

cd <prefix>/share/bro/site
git clone https://github.com/jsiwek/bro_bitcoin.git bitcoin
echo "@load bitcoin" >> local.bro
You can’t perform that action at this time.