class Aoandon::Nids

Constants

CONF_PATH

Public Class Methods

new() click to toggle source
# File lib/aoandon.rb, line 25
def initialize
  options = self.class.parse
  options[:file] = CONF_PATH unless options[:file]
  options[:interface] = Pcap.lookupdev unless options[:interface]
  puts "Starting Aoandon NIDS on interface #{options[:interface]}..."
  log = Log.new(options[:verbose])
  @syntax = Syntax.new(log, { file: options[:file] })
  @semantic = Semantic.new(log)
  @network_interface = Pcap::Capture.open_live(options[:interface])
end
parse() click to toggle source
# File lib/aoandon.rb, line 49
def self.parse
  options = {}

  OptionParser.new do |opts|
    opts.banner = "Usage: #{$PROGRAM_NAME} [options]"
    opts.on("-f", "--file <path>", "Load the rules contained in file <path>.") { |f| options[:file] = f }
    opts.on("-h", "--help", "Help.") { puts opts; exit }
    opts.on("-i", "--interface <if>", "Sniff on network interface <if>.") { |i| options[:interface] = i }
    opts.on("-v", "--verbose", "Produce more verbose output.") { options[:verbose] = true }
    opts.on("-V", "--version", "Show the version number and exit.") { version; exit }
  end.parse!

  options
end
version() click to toggle source
# File lib/aoandon.rb, line 64
def self.version
  puts "Aoandon #{VERSION}"
end

Public Instance Methods

run() click to toggle source
# File lib/aoandon.rb, line 36
def run
  puts "You can stop Aoandon NIDS by pressing Ctrl-C."

  @network_interface.each_packet do |packet|
    if packet.ip?
      @semantic.test(packet)
      @syntax.test(packet)
    end
  end

  @network_interface.close
end