#121556 - 2004-06-21 04:53 PM
Re: OT: IPS Software
|
Bryce
KiX Supporter
Registered: 2000-02-29
Posts: 3167
Loc: Houston TX
|
No comment on what software to use...
but i have been playing around with watching my syslog files from my router in realtime. Got some really cool scripts running. One gives me a realtime outgoing mail usage, another is giveing me realtime web http traffic.
Code:
004-06-21 09:40:38 x.x.x.x 207.25.71.119 premium.cnn.com arg=/video/realone/two.paned/lg/topstories.jsp
004-06-21 09:40:39 x.x.x.x 64.236.16.138 i.cnn.net arg=/cnn/video/politics/2004/06/21/kw.clinton.60.min.vs.cnn.jpg
004-06-21 09:40:39 x.x.x.x 64.236.16.138 i.cnn.net arg=/cnn/video/world/2004/06/20/hostage.vs.jpg
004-06-21 09:40:39 x.x.x.x 64.236.16.138 i.cnn.net arg=/cnn/video/popup/images/video.icon.gif
004-06-21 09:40:39 x.x.x.x 64.236.16.138 i.cnn.net arg=/cnn/video/popup/images/video.play.gif
Some interesting stuff...  I guess you could code a script to react to some type of events, for example, watch for a port scan in progress, and block that ipaddress...
|
|
Top
|
|
|
|
|
#121558 - 2004-06-21 10:37 PM
Re: OT: IPS Software
|
ShaneEP
MM club member
Registered: 2002-11-29
Posts: 2127
Loc: Tulsa, OK
|
I dont do much of this type of function here....But I know that the guys that do, use a program called Snort for intrusion detection.
http://www.snort.org/
|
|
Top
|
|
|
|
|
#121560 - 2004-06-22 02:31 PM
Re: OT: IPS Software
|
Bryce
KiX Supporter
Registered: 2000-02-29
Posts: 3167
Loc: Houston TX
|
Quote:
Bryce,
Thanks for your reply. Kix is not an option  It has to be something like Mcafee Entercept, Symantec Host IDS, ISS Proventia, etc.
Yeah i know, just wanted to toss it out there as a "cool! hey look at this" statement.
Question is, where do you want to watch for intrusion at? the internet gateway? the servers? users desktop....
for server level check out snort.
The gateway lvl, will depend on what you have for a gateway. If, you can do syslogging on your gateway, then you could maby do something with that, and a software product that watches the syslog. Kiwi (http://www.kiwisyslog.com/) is a great syslog server for win32 systems.
at the pc level.....this level might be more trouble than it is worth..
|
|
Top
|
|
|
|
Moderator: Arend_, Allen, Jochen, Radimus, Glenn Barnas, ShaneEP, Ruud van Velsen, Mart
|
0 registered
and 1257 anonymous users online.
|
|
|
