class By2::Client

Public Class Methods

new(argv=[]) click to toggle source
# File lib/by2/client.rb, line 5
def initialize(argv=[])
  @opts = Options.parse(argv)

  By2.debug = @opts.delete(:debug)
  By2.db_connect
  By2.debug(@opts.inspect)
end

Public Instance Methods

find_records(options = {}) click to toggle source

payload: sid: 1, cid: 5 2149599422 => “128.32.72.190” 2954912804 => “176.32.100.36”

# File lib/by2/client.rb, line 17
def find_records(options = {})
  @opts = @opts.merge(options)
  tables = %w(iphdr tcphdr udphdr icmphdr payload)

  query = Event.
      includes(*tables).
      references(*tables).
      order("event.timestamp")

  query.
      merge(ip_src_or_dst).
      merge(port_src_or_dst).
      merge(port_src).
      merge(port_dst).
      merge(ip_src).
      merge(ip_dst).
      merge(date).
      merge(date_range)
end
run() click to toggle source
# File lib/by2/client.rb, line 37
def run
  records = find_records

  unless @opts[:count]
    records.each { |r| $stdout.puts(terminal(r)) }
  end

  $stdout.puts(record_separator)
  $stdout.puts(record_count(records.count))
end

Private Instance Methods

all() click to toggle source
# File lib/by2/client.rb, line 65
def all
  Event.all
end
date() click to toggle source
# File lib/by2/client.rb, line 99
def date
  return all if @opts[:date].nil?
  Event.on_date(@opts[:date])
end
date_range() click to toggle source
# File lib/by2/client.rb, line 104
def date_range
  return all if @opts[:start_date].nil?
  Event.in_date_range(@opts[:start_date], @opts[:end_date])
end
ip_dst() click to toggle source
# File lib/by2/client.rb, line 94
def ip_dst
  return all if @opts[:dst_ip].nil?
  Iphdr.ip_dst(@opts[:dst_ip])
end
ip_src() click to toggle source
# File lib/by2/client.rb, line 89
def ip_src
  return all if @opts[:src_ip].nil?
  Iphdr.ip_src(@opts[:src_ip])
end
ip_src_or_dst() click to toggle source
# File lib/by2/client.rb, line 69
def ip_src_or_dst
  return all if @opts[:ip].nil?
  Iphdr.ip_src_or_dst(@opts[:ip])
end
port_dst() click to toggle source
# File lib/by2/client.rb, line 84
def port_dst
  return all if @opts[:dst_port].nil?
  Tcphdr.dst_port(@opts[:dst_port]).or(Udphdr.dst_port(@opts[:dst_port]))
end
port_src() click to toggle source
# File lib/by2/client.rb, line 79
def port_src
  return all if @opts[:src_port].nil?
  Tcphdr.src_port(@opts[:src_port]).or(Udphdr.src_port(@opts[:src_port]))
end
port_src_or_dst() click to toggle source
# File lib/by2/client.rb, line 74
def port_src_or_dst
  return all if @opts[:port].nil?
  Tcphdr.src_or_dst_port(@opts[:port]).or(Udphdr.src_or_dst_port(@opts[:port]))
end
record_count(n) click to toggle source
# File lib/by2/client.rb, line 54
def record_count(n)
  "Total records: #{n}\n\n"
end
record_separator() click to toggle source
# File lib/by2/client.rb, line 50
def record_separator
  ("-" * 80)
end
terminal(event) click to toggle source
# File lib/by2/client.rb, line 58
def terminal(event)
  e = event
  ("-" * 80) + "\n" \
  "[#{e.timestamp}] #{e.iphdr.ipaddr_src}:#{e.sport} -> #{e.iphdr.ipaddr_dst}:#{e.dport} (#{e.transport})\n\n" \
    "#{(e.payload && e.payload.to_s.strip) || "[no payload]"}\n\n"
end