Web Traffic Analysis with Snort

[Mark Maxey <mmaxey () mastersoftech com>]

I'm currently using snort for network traffic analysis to create reports for security assessments in 
conjunction with websense on spanned network ports to show customers what their employees are 
looking at.  Fyi, websense is a package used for web content filtering and reporting to monitor what 
employees are looking at (ie porn).

I would like to utilize snort in conjunction with the urlblacklist.com blacklists to combine this 
all into a single box. I can easily convert the urlblacklist.com lists into a snort rules based on 
category with a single rule per category (all the porn urls in one list, all the finance ones in 
another) and then tag those rules. All other http traffic visits would get logged as "unflagged http 
traffic". I could then report to a mysql database and grind a report out with some sort of tool, I'm 
still searching for the right tool for this job.

Does anyone know of a solution for doing this or a simple way of doing it other than "rolling my 
own" solution. Are there any howtos out there or general guides on doing web traffic analysis with 
snort?


-------------------------------------------------------
This SF.Net email is sponsored by Yahoo.
Introducing Yahoo! Search Developer Network - Create apps using Yahoo!
Search APIs Find out how you can build Yahoo! directly into your own
Applications - visit http://developer.yahoo.net/?fr=offad-ysdn-ostg-q22005
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users