Re: reviewing httpd access log

[Chris Kuethe <ckuethe@ualberta.ca>]

On Sun, 1 Aug 2004, L. V. Lammert wrote:

> Unfortunately, snort does not communicate with pf. If anyone HAS done this
> sort of setup, please let everyone know.

I have a honeynet somewhere that parses pflogs and ... does stuff.
This stuff can include thudding an address into a table of things
to be blocked and writing a log event. Actually, this particular
honeynet does cisco ACLs, but there's nothing cisco specific about
the architecture.

I have modules that parse snort, httpd, pf and sys logs. they report
to a central collector which decides what to do about the infraction.
One of these days I'll pretty it all up for public consumption.

CK

-- 
Chris Kuethe, GCIA CISSP: Secure Systems Specialist - U of A CNS
       office: 157 General Services Bldg.    +1.780.492.8135
               chris.kuethe@[pyxis.cns.]ualberta.ca

      GDB has a 'break' feature; why doesn't it have 'fix' too?