Proxy woes

[inetjunkmail <inetjunkmail () gmail com>]

We have an proxy server between our users and the Internet.  The proxy
server is explicitly configured in their browsers (not transparent).  We'd
like to use Snort with both VRT and Emerging rules to help identify bots.
So I see two options:

Put Snort outside proxy servers:
Pro:  Destination addresses are valid so they can be matched on by Emerging
Bot rules
Con: Internal user's IP is lost unless correlated against proxy logs since
all source addresses are the proxy's external address

Put Snort inside proxy servers:
Pro: See the Internal client's IP address
Con: All destination addresses are the proxy server since the destination
web site is in the payload (not to mention the destination in the payload is
likely a URL rather than IP)

Is there any preprocessor or way to look at the traffic inside the proxy
request and have the preprocessor pull the destination out and do a DNS
lookup to identify the true destination IP before processing the rules?  I
understand the DNS overhead likely introduces too much delay; just looking
for any possibilities.

------------------------------------------------------------------------------
Let Crystal Reports handle the reporting - Free Crystal Reports 2008 30-Day 
trial. Simplify your report design, integration and deployment - and focus on 
what you do best, core application coding. Discover what's new with
Crystal Reports now.  http://p.sf.net/sfu/bobj-july

_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users