Integration in IVRE

[p-l-]

Hi there,

Thanks a lot for sharing JA3, it is a great idea!

For your information, I have integrated JA3 support, based on the Bro scripts from this repository, to the passiverecon Bro script integrated to (and used by) IVRE, an open-source passive & active network recon framework.

I have tried to prevent any incompatibility with your scripts (or other existing scripts) by using ivre specific prefix for the records added to existing logs and structures (to prevent issues similar to #13).

I have also simplified & improved the code, so you may want to reuse some of the changes I made.

The integration has been done in ivre/ivre#624. The script, based on your code, is released under the same license as IVRE (GPLv3+), while keeping the Salesforce copyright notice (Copyright 2017 salesforce.com, inc.) as it is my understanding that this is permitted by the license used for the original scripts. Please let me know if you disagree or if it is a problem for you.

Thanks again!

[jalthouse-sfdc]

Nice looking code, I like it! @jatkinson-sfdc let's look into using some of his changes.

[p-l-]

If you are interested, I can create some PR for that.