Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I am going to be setting aside some IP space so that someone can use it as co-lo space and dedicated hosting. The network will have its own cisco router and several L2 managed switches that I'll admin so port mirroring and sniffing isn't a problem.

I'm looking for some way, outside of snort, to monitor it for outbound spammers and bad guy activity like malicious or hacked php scripts along with illegal things I don't want to go near. I have solutions to some of these problems on different networks but I need to be very proactive on this network. Its not possible on my part to audit the software on each and every server, though we will be probing the network often. Also, its feasible that these hosts will be sending some email out.

Does anyone have any open source solutions for problems like this they would recommend?

I'll probably end up giving this network its own smtp server with spam detection and anti-virus and then disallow outbound smtp on this network to anything but our server.

share|improve this question
    
Central MN, eh? North Metro here - nice to see a (relative) neighbor around. While I'm here, I ought to mention that you should really go back and mark some answers to your past questions as "accepted". That's a way to give back to the community...thanks! –  EEAA Apr 16 '11 at 2:02

1 Answer 1

My best suggestion to you is to set up some kind of IDS (like Snort), possibly in combination with a Netflow exporter and cruncher tools like flow-tools and/or JKFlow. This will enable you to analyze activity on your network and detect "unusual" or "suspicious" events.

The key here is determining what is "normal" versus "abnormal" for your environment in the long run, that way any alerts you receive will be meaningful. If your monitoring system constantly throws false alarms you will eventually get desensitized to them and miss a real problem.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.