up vote 2 down vote favorite
share [g+] share [fb]

I am trying to automatically monitor my apache logs and recognize if someone is doing a vulnerability scan on my web server.

The point of this will be to then route the source IP to a honeypot server instead where I will log all packets coming in.

I have looked around, but haven't been able to find a good answer.

Thanks in advance.

link|improve this question
You may be better served if you ask this question on Serverfault. – Mike Daniels Feb 14 '11 at 20:58
@Mike Thanks, I'll post over there too. – Scone Feb 14 '11 at 21:12
feedback

migrated from stackoverflow.com Feb 14 '11 at 21:27

This question came from our site for professional and enthusiast programmers.

1 Answer

up vote 0 down vote accepted

I think the best solution is a Web Application Firewall like Mod_Security. This can be setup to log vulnerability scans, but its better to block them.

link|improve this answer
Mod_Security looks like it will work for what we are wanting. – Scone Feb 14 '11 at 21:23
feedback

Your Answer

 
or
required, but never shown
discard

Not the answer you're looking for? Browse other questions tagged or ask your own question.