class By2::Client
Public Class Methods
new(argv=[])
click to toggle source
# File lib/by2/client.rb, line 5 def initialize(argv=[]) @opts = Options.parse(argv) By2.debug = @opts.delete(:debug) By2.db_connect By2.debug(@opts.inspect) end
Public Instance Methods
find_records(options = {})
click to toggle source
payload: sid: 1, cid: 5 2149599422 => “128.32.72.190” 2954912804 => “176.32.100.36”
# File lib/by2/client.rb, line 17 def find_records(options = {}) @opts = @opts.merge(options) tables = %w(iphdr tcphdr udphdr icmphdr payload) query = Event. includes(*tables). references(*tables). order("event.timestamp") query. merge(ip_src_or_dst). merge(port_src_or_dst). merge(port_src). merge(port_dst). merge(ip_src). merge(ip_dst). merge(date). merge(date_range) end
run()
click to toggle source
# File lib/by2/client.rb, line 37 def run records = find_records unless @opts[:count] records.each { |r| $stdout.puts(terminal(r)) } end $stdout.puts(record_separator) $stdout.puts(record_count(records.count)) end
Private Instance Methods
all()
click to toggle source
# File lib/by2/client.rb, line 65 def all Event.all end
date()
click to toggle source
# File lib/by2/client.rb, line 99 def date return all if @opts[:date].nil? Event.on_date(@opts[:date]) end
date_range()
click to toggle source
# File lib/by2/client.rb, line 104 def date_range return all if @opts[:start_date].nil? Event.in_date_range(@opts[:start_date], @opts[:end_date]) end
ip_dst()
click to toggle source
# File lib/by2/client.rb, line 94 def ip_dst return all if @opts[:dst_ip].nil? Iphdr.ip_dst(@opts[:dst_ip]) end
ip_src()
click to toggle source
# File lib/by2/client.rb, line 89 def ip_src return all if @opts[:src_ip].nil? Iphdr.ip_src(@opts[:src_ip]) end
ip_src_or_dst()
click to toggle source
# File lib/by2/client.rb, line 69 def ip_src_or_dst return all if @opts[:ip].nil? Iphdr.ip_src_or_dst(@opts[:ip]) end
port_dst()
click to toggle source
# File lib/by2/client.rb, line 84 def port_dst return all if @opts[:dst_port].nil? Tcphdr.dst_port(@opts[:dst_port]).or(Udphdr.dst_port(@opts[:dst_port])) end
port_src()
click to toggle source
# File lib/by2/client.rb, line 79 def port_src return all if @opts[:src_port].nil? Tcphdr.src_port(@opts[:src_port]).or(Udphdr.src_port(@opts[:src_port])) end
port_src_or_dst()
click to toggle source
# File lib/by2/client.rb, line 74 def port_src_or_dst return all if @opts[:port].nil? Tcphdr.src_or_dst_port(@opts[:port]).or(Udphdr.src_or_dst_port(@opts[:port])) end
record_count(n)
click to toggle source
# File lib/by2/client.rb, line 54 def record_count(n) "Total records: #{n}\n\n" end
record_separator()
click to toggle source
# File lib/by2/client.rb, line 50 def record_separator ("-" * 80) end
terminal(event)
click to toggle source
# File lib/by2/client.rb, line 58 def terminal(event) e = event ("-" * 80) + "\n" \ "[#{e.timestamp}] #{e.iphdr.ipaddr_src}:#{e.sport} -> #{e.iphdr.ipaddr_dst}:#{e.dport} (#{e.transport})\n\n" \ "#{(e.payload && e.payload.to_s.strip) || "[no payload]"}\n\n" end