From: Lennon Day-Reynolds <rcoder@...>
Date: 2004-07-16T09:39:50+09:00
Subject: Re: Monitor network connections

In addition, I'd recommend you take a look at the documentation for
the stateful packet filter on your firewall (what? you don't have a
stateful packet filter? shame on you!) and see how its connection
tracking and logging can help.

You might take a look at the documentation for PF, the packet filter
in recent versions of OpenBSD. It supports stateful connection
filtering, load balancing, logging of any and all events, etc., and
probably does it all much more efficiently than you ever could in
Ruby.

If you're looking for a way to bring Ruby in on the whole project, a
Ruby library or application that could generate the PF configuration
files (which use their own, somewhat baroque rule format) would be
very nice.

Lennon

On Fri, 16 Jul 2004 05:28:36 +0900, Randy Lawrence <jm@zzzzzzzzzzzz.com> wrote:
> 
> 
> Dominik Werder wrote:
> > Hi all!
> >
> > I'd like to do a little "somewhat-clever-server-abuse-detection" in
> > addition to the other firewall stuff.
> > To do that I need to monitor what connections exists and how much/how
> > fast they up and download..
> > Is that possible in general? Using ruby?
> >
> > Just an idea :)
> >
> > bye!
> > Dominik
> 
> Here are some highly recommended security tools you might want to
> consider using in addition to your firewall.
> 
> You'll probably want to take a look before handcoding in ruby or any
> other language to avoid reinventing the wheel.
> 
> Look at this simple utility (if snort is too complex/fat):
> 
> portsentry
> 
> For Apache, use these which work great together (and easy setup):
> 
> mod_dosevasive  (detect and handle denial of service attacks)
> mod_security    (detect and handle hacking/abuse)
> ***mod_throttle (for Apache 1.3.x only so I haven't used this)
> 
> For comprehensive detection, see:
> 
> Nessus (discover your vulnerabilities)
> Snort (intrusion detection)
> 
>