Monitor traffic from a specific domain?

["Sheahan, Paul (PCLN-NW)" <Paul.Sheahan () priceline com>]

Hello,

We suspect some hacker is trying to hack some of our servers and expect that
he will return soon. I would like to be able to setup snort to log/dump
everything from this hackers domain once he returns. Does anyone know how I
can do this? For example, I know this hacker is from, let's say,
"somemachine.domain.com". I'm not sure if he has a static IP or not so I'd
just like to log anything from "domain.com".

Can this be done through Snort rules, or is there a way to use the -d switch
and dump the Application layer to a file whenever someone from "domain.com"
hits our network?

Any help would be appreciated!


Thanks,
Paul

_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
http://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users