Tools for detecting suspicious network activity?

[Kit Peters]

After yet another outbreak of Conficker on my network at work, I've decided that I need to be more proactive about this.  Are there any tools that I can attach to my router that will alert me if something suspicious - like traffic bound outside of the campus network for 445/tcp, or a large number of SYN packets - is going on?  And more importantly, are they free?

KP

--
Kit Peters, W0KEH
GPG public key fingerpint: 1A12 04B6 0C80 306A B292  14FD 2C7A 1037 F666 46A7

[Tim Eberhard]

Using your router and not any other external hardware your best bet is
going to be netflow.

Netflow will allow you to do data sampling and then pipe it to a
server. There are lots of free open source solutions that may or may
not suck, there are also some free closed source but limited to a
couple of devices that may or may not suck. There are lots of pay
products that do this very well.

Alternatively you can install a snort type box on a spanned port (IDS)
to monitor traffic if it's small enough. Snort is open source, free,
works well and will run on linux.

Other options would be some nicer firewalls, but those are not free
unless you steal them from someone with better resources than
yourself.

Hope this helps,
-Tim

> --
> You received this message because you are subscribed to the Google Groups
> "kulua-l" group.
> To unsubscribe from this group and stop receiving emails from it, send an
> email to kulua-l+u...@googlegroups.com.
> To post to this group, send email to kul...@googlegroups.com.
> Visit this group at http://groups.google.com/group/kulua-l?hl=en.
> For more options, visit https://groups.google.com/groups/opt_out.
>
>