Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I am trying to automatically monitor my apache logs and recognize if someone is doing a vulnerability scan on my web server.

The point of this will be to then route the source IP to a honeypot server instead where I will log all packets coming in.

I have looked around, but haven't been able to find a good answer.

Thanks in advance.

share|improve this question

migrated from stackoverflow.com Feb 14 '11 at 21:27

This question came from our site for professional and enthusiast programmers.

1 Answer 1

up vote 0 down vote accepted

I think the best solution is a Web Application Firewall like Mod_Security. This can be setup to log vulnerability scans, but its better to block them.

share|improve this answer
    
Mod_Security looks like it will work for what we are wanting. –  Scone Feb 14 '11 at 21:23

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.