class Suricata::Connection

This class splits a connection string into it's parts

Attributes

dport[RW]

@!attribute proto

protocol

@!attribute src

source-ip

@!attribute dst

destination-ip

@!attribute sport

source port

@!attribute dport

destination port
dst[RW]

@!attribute proto

protocol

@!attribute src

source-ip

@!attribute dst

destination-ip

@!attribute sport

source port

@!attribute dport

destination port
proto[RW]

@!attribute proto

protocol

@!attribute src

source-ip

@!attribute dst

destination-ip

@!attribute sport

source port

@!attribute dport

destination port
sport[RW]

@!attribute proto

protocol

@!attribute src

source-ip

@!attribute dst

destination-ip

@!attribute sport

source port

@!attribute dport

destination port
src[RW]

@!attribute proto

protocol

@!attribute src

source-ip

@!attribute dst

destination-ip

@!attribute sport

source port

@!attribute dport

destination port

Public Class Methods

new(string=nil) click to toggle source

This constructor calls parse(string) if string is not nil

@param [String] string string to parse

# File lib/suricata/connection.rb, line 40
def initialize(string=nil)
        if not string.nil?
                parse(string)
        end
end

Public Instance Methods

parse(string) click to toggle source

This function parses a connection-string into it's parts

@param [String] string string to parse @raise [Exception] Parsing error

# File lib/suricata/connection.rb, line 50
def parse(string)
        if string.nil?
                raise "Invalid argument"
        end

        string = string.chomp

        if string =~ /^\{(.+)\}\s+(.+)\:(\d{1,5})\s+\-\>\s+(.+)\:(\d{1,5})$/
                @proto = $1
                @src = $2
                @sport = $3.to_i
                @dst = $4
                @dport = $5.to_i
        else
                raise "Parsing error: >>#{string}<<"
        end
end
to_s() click to toggle source

converts parsed values back to string @return [String] connection-string

# File lib/suricata/connection.rb, line 70
def to_s
        "{#{proto}} #{src}:#{sport} -> #{dst}:#{dport}"
end