Skip to content

Implement IDS-in-the-middle traffic routing over both Ethernet and WiFi connections; Support monitoring 2 interfaces. #1665

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Merged
AlyaGomaa merged 65 commits into from
Oct 25, 2025
Merged

Implement IDS-in-the-middle traffic routing over both Ethernet and WiFi connections; Support monitoring 2 interfaces. #1665

AlyaGomaa merged 65 commits into from
Oct 25, 2025
+1,792 −1,006

Conversation

@AlyaGomaa
Copy link
Collaborator

@AlyaGomaa AlyaGomaa commented Oct 24, 2025 •
edited
Loading

closes #1276

@AlyaGomaa
Support using -ap to make slips monitor the 2 access point interfaces
ba8f256
@AlyaGomaa
add db functions to set and get AP interfaces
c56afea
@AlyaGomaa
store the interfaces given with -ap to slips in the db
fd573a2
@AlyaGomaa
support having 2 zeek threads, observers and log parsers, one for eac…
8bd4108 
…h interface
@AlyaGomaa
blocking: refactor
2b6cc43
@AlyaGomaa
store the host IP per interface in the db
8a2e9bc
@AlyaGomaa
host_ip_manager: return the host ip of each of the given interfaces
4fadc55
@AlyaGomaa
threat_intelligence.py: check all host ips when detecting inbound tra…
d8011f2 
…ffic
@AlyaGomaa
display a warning and exit when -ap is given but not running access p…
7ed9d76 
…oint
@AlyaGomaa
idmef: temporary disable get_host_ip()
a3e7cd6
@AlyaGomaa
docs: use linux-wifi-hotspot instead of create_ap for AP setup
c240802
@AlyaGomaa
input: fix detecting interfaces_to_monitor
72ee0c3
@AlyaGomaa
input: fix problem starting 2 zeek instances for 2 diff interfaces
fbb2ec1
@AlyaGomaa
Tie each flow, evidence and alert to an interface
cb73e2a
@AlyaGomaa
Add an interface to each evidence before giving it to evidence handler
64b0a14
@AlyaGomaa
don't tie an alert to an interface, an alert is a combination of evid…
ed61c4a 
…ence from any interface
@AlyaGomaa
ip_info: Support getting the gateway interface of the access point in…
d46a446 
…terfaces
@AlyaGomaa
poisoner: use the given interface for getting the GW ip
a911923
@AlyaGomaa
Move get_gateway_for_iface from ip_info to slips utils to be used acc…
1138a5b 
…ross modules
@AlyaGomaa
db: use the interface for storing the GW ip and mac
5b47007
@AlyaGomaa
ip_info: use the interface for getting the GW ip and MAC
4e37222
@AlyaGomaa
use the interface every time a module needs access to the GW mac or ip
ba62d77
@AlyaGomaa
utils: add func to get_all_interfaces
029bf8d
@AlyaGomaa
Add a class for building the zeek command
2d83418
@AlyaGomaa
ZeekCmdBuilder: support custom packet filters (defined in slips code,…
b25a577 
… not defined by the user)
@AlyaGomaa
slips_utils: add a func to get_cidr_of_interface
786fdb9
@AlyaGomaa
input: Add a tcpdump filter to log only incoming traffic when startin…
a250e5b 
…g zeek on the ethernet interface
@AlyaGomaa
Add the interface to evidence description
2da188d
@AlyaGomaa
idmef: Fix Validation failure: '0.0.0.0' is not of type 'object'
5b8f57a
@AlyaGomaa
Make the getting and setting of the local network dependent on the in…
efb5a21 
…terface
@github-project-automation github-project-automation bot moved this to Todo in Slips Oct 24, 2025
@AlyaGomaa
zeek_cmd_builder.py: fix SyntaxError: unterminated string literal
9fdefde
@AlyaGomaa
host_ip_manager: infer the used interface when slips is running on a …
cdda466 
…growing zeek dir
@AlyaGomaa
fix test_conn unit tests
39e380f
@AlyaGomaa
Make slips able to infer the interface being monitored when given a g…
0ea1b4b 
…rowing zeek dir
@AlyaGomaa
host_ip_manager.py: detect the used interface and host IP when runnin…
aae7ee4 
…g on a growing zeek dir
@AlyaGomaa
poisoner: remove debugging prints
eda6b3b
@AlyaGomaa
fix host ip manager unit tests
13715af
@AlyaGomaa
fix process manager unit tests
4576950
@AlyaGomaa
Add a dummy interface to each argus flow to be able to use it in slips
8a5a2dc
@AlyaGomaa
Add a dummy interface to each Nfdump flow to be able to use it in slips
8c8c82d
@AlyaGomaa
Add a dummy interface to each suricata flow to be able to use it in s…
4cf832e 
…lips
@AlyaGomaa
iasync_module.py: better exception handling (print traceback)
1b769fc
@AlyaGomaa
flowalerts.ssl: Check first if we're looking for a field in the SSL f…
b6431ff 
…low that only exists in zeek flows
@AlyaGomaa
use "default" as the interface when slips is analyzing a file
e6c0887
@AlyaGomaa AlyaGomaa merged commit e6e4b5b into develop Oct 25, 2025
81 of 82 checks passed
@AlyaGomaa AlyaGomaa deleted the alya/immune/monitor_2_interfaces branch October 25, 2025 13:10
@github-project-automation github-project-automation bot moved this from Todo to Done in Slips Oct 25, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

Slips
Status: Done

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@AlyaGomaa