You might want to try Ethereal for the actual payload and format
validation.
Something like Spade could be used to determine odd activity as well but
is based more on statistics for finding "non normal activity" than
actually packet analysis.
On Sun, 23 Jan 2005, Drew Simonis wrote:
Greetings,
Hello
I would like to know if there is someone that would recommend a piece of
software that does a good job at anomaly detection?
In particular, I have a tcpdump file of SMTP traffic, which I would like
to pass analyse.
This is a pretty broad request. I may assume that you are looking for
anomalous SMTP data packets, but then again, I might just as likely assume
you are looking for anomalous connection patterns. Either way, I don't know
of any "off the shelf" dedicated anomaly detector. Assuming you are looking
for the protocol type, Snort may be your best bet, and it should have no
problems with taking that TCPDump file as input.
There are also commercial IDS that do protocol anomaly detection, which you
might already know. Symantec Network Security (aka Manhunt) is one that I
have used for a few years, and there are others.
If you are looking for something to detect anomalies in the connection
patterns, you may want to look at NFDump and the NFSEN project. I am not
sure how far along that effort is, but it may be promising. Again, there
are commercial products like Mazu Profiler and Arbor Peakflow, but I don't
think their cost would be justified by simply wanting to do a one time
analysis.
HTH,
-Ds
--------------------------------------------------------------------------
Test Your IDS
Is your IDS deployed correctly?
Find out quickly and easily by testing it with real-world attacks from
CORE IMPACT.
Go to http://www.securityfocus.com/sponsor/CoreSecurity_focus-ids_040708
to learn more.
--------------------------------------------------------------------------
--------------------------------------------------------------------------
Test Your IDS
Is your IDS deployed correctly?
Find out quickly and easily by testing it with real-world attacks from
CORE IMPACT.
Go to http://www.securityfocus.com/sponsor/CoreSecurity_focus-ids_040708
to learn more.
--------------------------------------------------------------------------
