No comment on what software to use...


but i have been playing around with watching my syslog files from my router in realtime. Got some really cool scripts running. One gives me a realtime outgoing mail usage, another is giveing me realtime web http traffic.

Code:

004-06-21 09:40:38 x.x.x.x 207.25.71.119   premium.cnn.com arg=/video/realone/two.paned/lg/topstories.jsp

004-06-21 09:40:39 x.x.x.x 64.236.16.138   i.cnn.net arg=/cnn/video/politics/2004/06/21/kw.clinton.60.min.vs.cnn.jpg

004-06-21 09:40:39 x.x.x.x 64.236.16.138   i.cnn.net arg=/cnn/video/world/2004/06/20/hostage.vs.jpg

004-06-21 09:40:39 x.x.x.x 64.236.16.138   i.cnn.net arg=/cnn/video/popup/images/video.icon.gif

004-06-21 09:40:39 x.x.x.x 64.236.16.138   i.cnn.net arg=/cnn/video/popup/images/video.play.gif


Some interesting stuff... I guess you could code a script to react to some type of events, for example, watch for a port scan in progress, and block that ipaddress...