linux network security

aparna · 03-01-2002, 06:13 AM

hi
Is there any tools available for audit collection for network based intrusion detection system.I need
1) The details of the network services names like SMTP,FTP,HTTP ..coming from outside the lan to the sever.
2) I need details of port number of the network service,number of packets for that service...
Help me if possible
I'll be thankful to you...Aparna.

raven · 03-01-2002, 06:59 AM

hello

its simple

install iptables, and define rules for it, which do nothing to the packets except logging them...

this works absolutely perfect.

greetz

raven

aparna · 03-03-2002, 05:35 AM

hello sir...
thanks for your reply...
But i am doing a project so i need a program which gives the result which i mentioned in my question.
If posiible please write to me.
thanking you
aparne

unSpawn · 03-03-2002, 05:11 PM

I don't know what you're aiming at exactly, but you could always use tools like mrtg to generate traffic statistics, Snort for classification of traffic tru signatures and dumping all or filtered packet headers/contents (or tcpdump).