Re: Traffic Monitoring

["Bill Royds" <Bill () royds net>]

I would use the regular expression parsing ability of the latest Sendmail
and/or Activestate Perl email modules.
Normally this is used as spam filters, but it can just as easily look for
keywords on outgoing messages that fit your "banned" list.


----- Original Message ----- 
From: "Zahid Ahmad Khan" <zahid () expertsystems net>
To: <firewall-wizards () nfr com>
Sent: Tuesday, May 06, 2003 12:54 AM
Subject: [fw-wiz] Traffic Monitoring


Hi,

A research organization has asked me to look at an interesting
situation. They are paranoid about pilferage of research work and want
to monitor and log all email traffic (Vectors and contents of POP, SMTP
& IMAP). They require the following:

1) Log all in and out bound emails (All employees have been duly
informed of the fact).
2) Generate email vector logs.
3) Flag and stop any email with unauthorized contents.
4) Only interested in traffic on the WAN and Internet interface (E-1,
E-3, OC-3, POS)
5) Do not want to log or see any internal traffic which might be contain
sensitive R&D info.

I was thinking of putting together a system using pcap for capturing
traffic and using/developing an analysis reporting engine. Due to the
urgency of client requirements, I will appreciate if anyone could let me
know of any good analysis and reporting tools/systems or even a complete
monitoring system. At this moment I am open any inputs regarding
commercial as well as open source tools/products.

Thanks,

Zahid



---
Outgoing mail is certified Virus Free.
Checked by AVG anti-virus system (http://www.grisoft.com).
Version: 6.0.476 / Virus Database: 273 - Release Date: 4/24/2003


_______________________________________________
firewall-wizards mailing list
firewall-wizards () honor icsalabs com
http://honor.icsalabs.com/mailman/listinfo/firewall-wizards

_______________________________________________
firewall-wizards mailing list
firewall-wizards () honor icsalabs com
http://honor.icsalabs.com/mailman/listinfo/firewall-wizards