Re: Taking a traffic snapshot with network IDS
[email protected] Mon, 21 Jun 2010 20:02:02 -0700
| Newsgroups | gmane.comp.security.firewalls.wizards |
|---|---|
| Message-ID | <[email protected]> |
> That said, an IDS can be turned into one heck of a nice data-gathering > device if it's programmed to collect and report on events rather than > to look specifically for intrusions. I.e.: a DNS logging signature > set, URL logging signatures, DHCP logging, connectivity tracking, > usage statistics, etc. You might want to check out Bro in this regard, which IMHO excels at this sort of information gathering/logging. www.bro-ids.org Vern