I'm currently using snort for network traffic analysis to create reports for security assessments in
conjunction with websense on spanned network ports to show customers what their employees are
looking at. Fyi, websense is a package used for web content filtering and reporting to monitor what
employees are looking at (ie porn).
I would like to utilize snort in conjunction with the urlblacklist.com blacklists to combine this
all into a single box. I can easily convert the urlblacklist.com lists into a snort rules based on
category with a single rule per category (all the porn urls in one list, all the finance ones in
another) and then tag those rules. All other http traffic visits would get logged as "unflagged http
traffic". I could then report to a mysql database and grind a report out with some sort of tool, I'm
still searching for the right tool for this job.
Does anyone know of a solution for doing this or a simple way of doing it other than "rolling my
own" solution. Are there any howtos out there or general guides on doing web traffic analysis with
snort?
-------------------------------------------------------
This SF.Net email is sponsored by Yahoo.
Introducing Yahoo! Search Developer Network - Create apps using Yahoo!
Search APIs Find out how you can build Yahoo! directly into your own
Applications - visit http://developer.yahoo.net/?fr=offad-ysdn-ostg-q22005
_______________________________________________
Snort-users mailing list
Snort-users@lists.sourceforge.net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users
