I'm working on a simple IDS for class. We have to have a rules file that will be used to log certain packets that I capture. The script is capturing packets fine but I'm stuck on how to go about reading the lines in my rule file and then comparing them to information that I get from reading the packets.
My professor said that the rules file should should look something like this:
Ignoring the brackets, just typing the IP and domain.Source, IP, [ip of desired packet that I want to log] Source, Domain, [the domain name of the desired packet]
And etc where I'll have the source IPs and domains and also the destination IPs and domains of the packets I want to log. The program must be able to take the word "Source" and "IP" (comma separated) and know that I mean compare the IP in the line (from the file) to the IP that I get from
print "Source IP: ", $ip_obj->{src_ip}, "\n";
in my program
How would I go about reading line by line and the telling the program to use this line so I can compare them to the packets I've already captured? Sorry for being vague but this is the best I think I can explain it.Thanks for reading.
| For: | Use: | ||
| & | & | ||
| < | < | ||
| > | > | ||
| [ | [ | ||
| ] | ] |