monitoring a network for spammers/webscripts gone bad

Question

I am going to be setting aside some IP space so that someone can use it as co-lo space and dedicated hosting. The network will have its own cisco router and several L2 managed switches that I'll admin so port mirroring and sniffing isn't a problem.

I'm looking for some way, outside of snort, to monitor it for outbound spammers and bad guy activity like malicious or hacked php scripts along with illegal things I don't want to go near. I have solutions to some of these problems on different networks but I need to be very proactive on this network. Its not possible on my part to audit the software on each and every server, though we will be probing the network often. Also, its feasible that these hosts will be sending some email out.

Does anyone have any open source solutions for problems like this they would recommend?

I'll probably end up giving this network its own smtp server with spam detection and anti-virus and then disallow outbound smtp on this network to anything but our server.

Answer 1

My best suggestion to you is to set up some kind of IDS (like Snort), possibly in combination with a Netflow exporter and cruncher tools like flow-tools and/or JKFlow. This will enable you to analyze activity on your network and detect "unusual" or "suspicious" events.

The key here is determining what is "normal" versus "abnormal" for your environment in the long run, that way any alerts you receive will be meaningful. If your monitoring system constantly throws false alarms you will eventually get desensitized to them and miss a real problem.