hi everyone! first post here. anyways, i work for a medium size isp, and i need to smiff the network occasionally for traffic that would do harm to our netowork. i understand that i will not catch everything, but i have 2 questions.

question 1 - i need to filter out traffic that would do harm to our ethernet network. broadcast traffic is definitely something to look at. but what else would i look for?

question 2-after i know what kind of traffic i need to sniff, how do i create the filter? can u give an example in tethereal string.

thanks!

I didnt get u ... exactly ... sniffing on your customer's ??????? or) ur isp's network infrastructure???

If it is for the former isn't it illegal???

I migh give u some hints depending on ur answer...

our isp network infrastructure...
what is so illegal about an ids system that gets rid of unwanted and malicious traffic, especially if this traffic produces dos attacks?

It's all about the packets baby! Sniff away to your hearts desire, although ethereal won't actually filter the traffic for you. It's just an anylizer. You need none other but a decent packet filter for that. iptables perhaps reading the man page. For an isp though, you'll have to get a bit more extensive than that. And to be honest if you had permission and actually worked for the isp like you say, I don't think you would be asking that question here.

Btw, I think there is a networking section here down the street or so. Good lucker.

was just curious.. I didn't say IDS is illegal...


http://staff.washington.edu/dittrich/misc/ddos/
http://www.infosyssec.com/infosyssec/secdos1.htm
http://lever.cs.ucla.edu/ddos/prospectus.pdf
http://www.sans.org/dosstep/
http://www.sans.org/dosstep/roadmap.php

thank you usual!