Changes between Version 7 and Version 8 of GENIExperimenter/Tutorials/NFV/Ryu/HandlingIntrusionwithRyu-ping

Timestamp:

11/01/17 12:51:45 (6 years ago)

Author:

Nabeel Akhtar

Comment:

--

GENIExperimenter/Tutorials/NFV/Ryu/HandlingIntrusionwithRyu-ping

@@ -246 +246 @@
 When Snort detects intrusion traffic, it will save the alert messages into the file '' /var/log/snort/alert''. The RINA distributed application keeps reading this alert file, and passes any intrusion information to the Ryu controller which will block the intrusion traffic. 
 
-
-==  (5) Generate Regular and Intrusion Traffic == 
+== (5) Run Attack Analyzer ==
+
+The Attack Analyzer reads the Snort alerts saved on the Controller node and makes decisions about which IP addresses to block. The Attack analyzer is the “brain” on the attack control system. It reads the file ''/tmp/snortalert'', which is generated by RINA on controller node and outputs ''/tmp/attacker.txt'' file which has the IP addresses of all the nodes that the Attack Analyzer decides to block based on Snort alerts.
+
+Open a separate window for the Controller, and run the attack analyzer. [[BR]]
+
+''' cd ~/Control/AttackAnalyzer/ '''
+
+''' python !AttackAnalyzer.py -f /tmp/snortalert ''' [[BR]]
+
+''' Note: If you want to re-run this experiment, make sure to remove ''/tmp/attacker.txt'' and ''/tmp/snortalert'' files on the controller node. '''
+
+
+==  (6) Generate Regular and Intrusion Traffic == 
 
 1. In a separate window for destination, start the netcat server by running: