intrusion detection system

aparna · 02-27-2002, 04:49 AM

hi
Is there any tools available for audit collection for network based intrusion detection system.I need the details of the network services like SMTP,FTP,HTTP ...coming from outside the lan to the sever.I need rew details of the services like name of the service ,from which ip its coming....help me if possible
I'll be thankful to you...Aparna.

neo77777 · 02-27-2002, 08:56 AM

Surf http://linuxsecurity.org, I am pretty sure they have such tools, then you can see what's up at http://www.sourceforge.net,LogWatch is a good one, search google for it. There is a tripwire, which checks the files on the system and network for modifications and such, there is also http://www.linuxjournal.com this month article about writing perl script for watching the networking system for modifications and such, there is a lot of info out here on the net, just search.

aq_mishu · 12-31-2005, 01:03 AM

1) Watch the log (before that, config it for the proper way of logging that u want..
2) make a script that will examine the log for a specific data/value
3) make that script be able to write the results in another file.
4) read that file

## In order to make it automatically, make a cronjob...

Mishu~~