Simple intrusion detection system engine

ids.rb

require "packetgen"

class IDS 
  def initialize(interface: PacketGen.default_iface, &block)
    @rules = {}
    instance_eval &block
    PacketGen.capture(iface: interface) do |packet|
      @rules.each do |header, blocks|
        next unless packet.is? header
        blocks.each do |block|
          block.call(packet)
        end
      end
    end
  end

  def rule(header, &block)
    if @rules[header]
      @rules[header] << block
    else
      @rules[header] = [block]
    end
  end
end