Traffic anomaly detection

[Joerg Weber <j.weber () infos de>]

Ladies and Gentlemen,

we are currently using snort with quite some success (and fun, I might
add). Now, I'm looking at SPADE and have no trouble finding traffic
using unused IP address or dead ports, etc.
What I'm trying to implement is the detection of 'unusual' traffic,
generated by an unknown worm, a warez server, etc.
I assume this is possible with SPADE, could someone confirm this?
If so, could someone share a config file and maybe some alert entry so I
can parse my logs/db for similar entries?

Thanks alot,

J. Weber

-- 
----------------------------------
Joerg Weber
Network Security
InfoServe GmbH
Nell-Breuning-Allee 6
66115 Saarbrücken
T: 0681 - 88008 - 0
F: 0681 - 88008 - 33



-------------------------------------------------------
This SF.NET email is sponsored by:
SourceForge Enterprise Edition + IBM + LinuxWorld = Something 2 See!
http://www.vasoftware.com
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users