From: $B$"$5$R(B<okou@...>
Date: 2003-10-26T05:32:38+09:00
Subject: [ruby-list:38662] $B6u9T$GJL$l$?%G!<%?$+$iFCDj$NJ8;z$r4^$`%G!<%?$r:o=|$7$?$$(B

竹島と申します。
初めてのMLです。
rubyの皆様には簡単なことと存じますが、以下で困ってます。

/var/log/snort/alertには
[**] [1:483:2] ICMP PING CyberKit 2.2 Windows [**]
[Classification: Misc activity] [Priority: 3]
10/09-23:09:51.737032 220.48.56.4 -> 220.49.236.90
ICMP TTL:120 TOS:0x0 ID:39502 IpLen:20 DgmLen:92
Type:8  Code:0  ID:512   Seq:61898  ECHO
[Xref => http://www.whitehats.com/info/IDS154]

[**] [1:1852:3] WEB-MISC robots.txt access [**] 
[Classification: access to a potentially vulnerable web application] [Priority: 2]
10/09-23:09:57.360008 66.196.65.34:37667 -> 220.49.236.90:80
TCP TTL:50 TOS:0x0 ID:2844 IpLen:20 DgmLen:234 DF
***AP*** Seq: 0x502F53B5  Ack: 0x118537AD  Win: 0x16D0  TcpLen: 32
TCP Options (3) => NOP NOP TS: 1112910037 850038182
[Xref => http://cgi.nessus.org/plugins/dump.php3?id=10302]

[**] [1:483:2] ICMP PING CyberKit 2.2 Windows [**]
[Classification: Misc activity] [Priority: 3]
10/09-23:11:22.945219 24.112.254.62 -> 220.49.236.90
ICMP TTL:107 TOS:0x0 ID:23958 IpLen:20 DgmLen:92  
Type:8  Code:0  ID:27126   Seq:9694  ECHO
[Xref => http://www.whitehats.com/info/IDS154]
以下略というふうに [Xref => http://www.whitehats.com/info/IDS154] 関係が猛烈にたくさん来ます。

そこで 例えば上の場合
[**] [1:1852:3] WEB-MISC robots.txt access [**] 
[Classification: access to a potentially vulnerable web application] [Priority: 2]
10/09-23:09:57.360008 66.196.65.34:37667 -> 220.49.236.90:80
TCP TTL:50 TOS:0x0 ID:2844 IpLen:20 DgmLen:234 DF
***AP*** Seq: 0x502F53B5  Ack: 0x118537AD  Win: 0x16D0  TcpLen: 32
TCP Options (3) => NOP NOP TS: 1112910037 850038182
[Xref => http://cgi.nessus.org/plugins/dump.php3?id=10302]
のみを残したいと思い、klugに相談したら K先生から

#!/usr/local/bin/python
import re
e = [   'BAD-TRAFFIC loopback traffic',
        'ICMP PING CyberKit 2.2 Windows',
        'MS-SQL',
        'WEB-CGI count.cgi access',
        'WEB-FRONTPAGE /_vti_bin/ access',
        'WEB-IIS',    
        'WEB-MISC robots.txt access',
        'SCAN Proxy (8080) attempt',
        'SCAN SOCKS Proxy attempt',
        'SCAN Squid Proxy attempt',
        'SCAN UPnP service discover attempt',
  ]
p = re.compile('|'.join(e))
s = open('/var/log/snort/alert').read()
r = s.split('\n\n')
for x in r:
    if  p.search(x):
        pass
    else:
        print x + '\n'

という pythonのスクリプトを戴きました(他にもBAD-TRAFFIC loopback traffic等を含む行を削除)。
ruby勉強ぶそくで 私には同等の機能をもつrubyスクリプトが書けません。
図々しいお願いとは存じますが、 何卒宜しくお願い申し上げます。