Simple IDS with example rules

ids_with_example_rules.rb

require "packetgen"

class IDS 
  def initialize(interface: PacketGen.default_iface, &block)
    @rules = {}
    instance_eval &block
    PacketGen.capture(iface: interface) do |packet|
      @rules.each do |header, blocks|
        next unless packet.is? header
        blocks.each do |block|
          block.call(packet)
        end
      end
    end
  end

  def rule(header, &block)
    if @rules[header]
      @rules[header] << block
    else
      @rules[header] = [block]
    end
  end
end

IDS.new do
  rule 'TCP' do |packet|
    next unless packet.tcp.flag_psh? and packet.tcp.flag_ack?
    next unless packet.body.contains? "cgi-bin/phf"
    puts "CGI-PHF probe"
  end

  rule 'DNS' do |packet|
    next unless packet.ip.dst == "8.8.8.8"
    puts "Talking to Google's DNS server using DNS"
  end

  rule 'TCP' do |packet|
     next unless packet.tcp.dport == 21
     next unless packet.body.include?("USER root")
     puts "FTP root login attempt"
  end
end

# Run at the command-line:
# $ ruby ids_with_example_rules.rb