Complex Bandwidth Monitor Software...

[CyberTron]

I am looking for some kind of bandwidth monitor software that will allow me to actually view what program is doing what bw, so that if my server all of a sudden is doing some crazy stuff, I can see exactly what is using the BW. Also i'm looking for something that will keep a log as to how much BW has been used in a given month. so it would need to run as a service.

Any idea's?

I know CyberGauge is out there but its far from free, I'm looking for something that's rather cheap.

 

[MulLa]

Snort will do your monitoring + loggin + run as a service task and it's free. It won't do BW monitoring tho.

 

[CyberTron]

Funny you mention that, i've been spending the last hour or so reading up on snort, I've known about it but never really used it. but while reading i had some questions. Doe snort actually stop an attack? it looks like it just logs them, in which case, how would you go about stopping them?

 

[n0cmonkey]

Originally posted by: CyberTron
Funny you mention that, i've been spending the last hour or so reading up on snort, I've known about it but never really used it. but while reading i had some questions. Doe snort actually stop an attack? it looks like it just logs them, in which case, how would you go about stopping them?

There are plugins to make it more of an IPS.

http://www.snortsam.net/index.html is one of those plugins.

Personally, I don't like the idea. Especially after doing some research. But it's interesting at least.

MRTG might be able to do some of the bandwidth things you are talking about. Check it out.

 

[MulLa]

Snort will generally not stop your attacks. You use a firewall to do that.

Of course unless you use the plug-in that n0cmonkey has suggested. Thanks n0cmonkey for the find.

 

[n0cmonkey]

Originally posted by: MulLa
Snort will generally not stop your attacks. You use a firewall to do that.

Of course unless you use the plug-in that n0cmonkey has suggested. Thanks n0cmonkey for the find.

I think the plugin still uses the firewall.

Another plugin, snort2pf, reads the alerts from snort and creates rules based on them. It's neat, but dangerous 😉

 

[CyberTron]

Well thats another question then, what is a good server software firewall to run? free would be nice as well, but i know thats hard to find sometimes on windows.

So what would one do with the info from snort? just manually block IP's using your firewall? that seems like alot of work.

 

[CyberTron]

Originally posted by: n0cmonkey

Originally posted by: CyberTron
Funny you mention that, i've been spending the last hour or so reading up on snort, I've known about it but never really used it. but while reading i had some questions. Doe snort actually stop an attack? it looks like it just logs them, in which case, how would you go about stopping them?

There are plugins to make it more of an IPS.

http://www.snortsam.net/index.html is one of those plugins.

Personally, I don't like the idea. Especially after doing some research. But it's interesting at least.

MRTG might be able to do some of the bandwidth things you are talking about. Check it out.

I havent read very much about MRTG yet, but so far it looks to be a very interesting program, thank you very much.

 

[n0cmonkey]

Originally posted by: CyberTron
Well thats another question then, what is a good server software firewall to run? free would be nice as well, but i know thats hard to find sometimes on windows.

So what would one do with the info from snort? just manually block IP's using your firewall? that seems like alot of work.

It depends on the security policy of the site you are at. Usually I look at it to see what my systems are doing. If my systems are causing the alarms, I know something happened.