I am going to be setting aside some IP space so that someone can use it as co-lo space and dedicated hosting. The network will have its own cisco router and several L2 managed switches that I'll admin so port mirroring and sniffing isn't a problem.
I'm looking for some way, outside of snort, to monitor it for outbound spammers and bad guy activity like malicious or hacked php scripts along with illegal things I don't want to go near. I have solutions to some of these problems on different networks but I need to be very proactive on this network. Its not possible on my part to audit the software on each and every server, though we will be probing the network often. Also, its feasible that these hosts will be sending some email out.
Does anyone have any open source solutions for problems like this they would recommend?
I'll probably end up giving this network its own smtp server with spam detection and anti-virus and then disallow outbound smtp on this network to anything but our server.