class Capra::Engine
Attributes
interface[RW]
rules[RW]
Public Class Methods
new(file: nil, &block)
click to toggle source
# File lib/capra/engine.rb, line 6 def initialize(file: nil, &block) default_interface @rules = {} if file instance_eval File.read(file) else instance_eval &block end start! end
Public Instance Methods
alert(mesg)
click to toggle source
# File lib/capra/engine.rb, line 45 def alert(mesg) puts mesg end
debug!()
click to toggle source
# File lib/capra/engine.rb, line 33 def debug! binding.pry end
default_interface()
click to toggle source
# File lib/capra/engine.rb, line 21 def default_interface @interface = Interfacez.default end
email(recpt)
click to toggle source
# File lib/capra/engine.rb, line 49 def email(recpt) puts "Sending email!" end
pcap(file)
click to toggle source
# File lib/capra/engine.rb, line 25 def pcap(file) @pcap = file end
rule(type, description: nil, reference: nil, &block)
click to toggle source
# File lib/capra/engine.rb, line 37 def rule(type, description: nil, reference: nil, &block) if @rules[type] @rules[type] << block else @rules[type] = [block] end end
save(packet)
click to toggle source
# File lib/capra/engine.rb, line 53 def save(packet) @save_to = "capra-save-"+Time.now.utc.to_s.split(" ").join("-")+".pcapng" if @save_to.nil? pf = PacketGen::PcapNG::File.new pf.array_to_file [packet] pf.to_f(@save_to, append: true) end
save_to(file)
click to toggle source
# File lib/capra/engine.rb, line 29 def save_to(file) @save_to = file end
start!()
click to toggle source
# File lib/capra/engine.rb, line 61 def start! if @pcap read_pcap_file(@pcap) do |packet| @rules.each do |header, blocks| if header == 'ANY' || packet.is?(header) blocks.each do |block| block.call(packet) end end end end else PacketGen.capture(iface: @interface) do |packet| @rules.each do |header, blocks| if header == 'ANY' || packet.is?(header) blocks.each do |block| block.call(packet) end end end end end end
Private Instance Methods
read_pcap_file(filename) { |packet| ... }
click to toggle source
# File lib/capra/engine.rb, line 87 def read_pcap_file(filename) PcapNG::File.new.read_packets(filename) do |packet| yield packet end rescue StandardError => e PCAPRUB::Pcap.open_offline(filename).each_packet do |packet| next unless (packet = PacketGen.parse(packet.to_s)) yield packet end end