yeah, IPCOP, it's allright...<br>but you'll find pfsense makes more sense.<br><br>try it out.<br><br><br><br><b><i>R J Ladyman <it@file-away.co.uk></i></b> wrote:<blockquote class="replbq" style="border-left: 2px solid rgb(16, 16, 255); margin-left: 5px; padding-left: 5px;"> Further to the tools I was wittering on at the LUG meeting last night (I <br>didn't ask the gentleman's name, sorry):<br><br>Inline analysis: you can make IPCOP your gateway or just insert it between <br>your current egress and your network, for the period of analysis.<br><br>IPCOP and some of its relations:-<br><br>IPCOP: http://www.ipcop.org/<br>Addons for IPCOP are listed here: <br>http://www.ipcop.org/index.php?module=pnWikka&tag=IPCopAddons<br><br>Squid Log analysis: squint and calanal (more are listed on the IPCOP site)<br>You can also grep through the squid.log for particular sites/addresses which <br>will allow you to detect infected machines (or at least, the IP in use at the
<br>time). <br><br>Copfilter addon for IPCOP: http://www.copfilter.org/<br><br>Soho shaper: <br>http://www.smidsrod.no/products/firewall/supershaper/SuperShaper-SOHO<br>Set your uplink speed and increase the divisor for the problem protocols.<br><br>Protocol blocker: http://mh-lantech.css-hamburg.de/ipcop/download.php?view.151<br>...but remember the caveats about blocking - throttling is better than <br>complete strangulation (sometimes).<br><br>Squid IP-address destination detection:<br><br>acl dottedaddress url_regex ^[^:]*://([^/@]*@)?[0-9\.]*(:|/|$|\?) ^[0-9\.]*$<br><br>and then deal with the acl (dottedaddress) accordingly (e.g. deny CONNECT or <br>whatever).<br><br>For a piggyback analysis: tcpdump and wireshark (it used to be called <br>ethereal).<br><br><br>Also, I would recommend:<br><br>Practical TCP/IP<br>Niall Mansfield<br>Addison-Wesley<br>ISBN 0-201-75078-3<br><br>which details a number of physical configurations for monitoring and analysis, <br>using both
*nux and Windows machines.<br><br><br>-- <br><br>Robert Ladyman<br>File-Away Limited, 32 Church Street,Newtyle<br>Perthshire, PH12 8TZ SCOTLAND<br>Registered in Scotland, Company Number: SC222086<br>Tel: +44 (0) 1828 898 158<br>Mobile: +44 (0) 7732 771 649<br>VOIP: 7714336@sipgate.co.uk<br><br>http://www.file-away.co.uk<br><br><br>_______________________________________________<br>dundee GNU/Linux Users Group mailing list<br>dundee@lists.lug.org.uk http://dundee.lug.org.uk<br>https://mailman.lug.org.uk/mailman/listinfo/dundee<br>Chat on IRC, #tlug on dundee.lug.org.uk<br></blockquote><br><p> 
<hr size=1>
Sent from <a
href="http://us.rd.yahoo.com/mailuk/taglines/isp/control/*http://us.rd.yahoo.com/evt=52418/*http://uk.docs.yahoo.com/nowyoucan.html" target=_blank>Yahoo! Mail</a>.
<br>
A Smarter Email.