Re: Monitor traffic from a specific domain?

["Larry E. Smith Jr." <lsmithjr () monster-solutions net>]

Is there a WIN32 version of Snort 1.8? If so, where can I get it?


----- Original Message -----
From: "Sheahan, Paul (PCLN-NW)" <Paul.Sheahan () priceline com>
To: "Snort List (E-mail)" <snort-users () lists sourceforge net>
Sent: Tuesday, July 24, 2001 7:42 PM
Subject: [Snort-users] Monitor traffic from a specific domain?


> Hello,
>
> We suspect some hacker is trying to hack some of our servers and expect
that
> he will return soon. I would like to be able to setup snort to log/dump
> everything from this hackers domain once he returns. Does anyone know how
I
> can do this? For example, I know this hacker is from, let's say,
> "somemachine.domain.com". I'm not sure if he has a static IP or not so I'd
> just like to log anything from "domain.com".
>
> Can this be done through Snort rules, or is there a way to use the -d
switch
> and dump the Application layer to a file whenever someone from
"domain.com"
> hits our network?
>
> Any help would be appreciated!
>
>
> Thanks,
> Paul
>
> _______________________________________________
> Snort-users mailing list
> Snort-users () lists sourceforge net
> Go to this URL to change user options or unsubscribe:
> http://lists.sourceforge.net/lists/listinfo/snort-users
> Snort-users list archive:
> http://www.geocrawler.com/redir-sf.php3?list=snort-users


_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
http://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users