Deep Packet Scanning???

[terminaljunkie]

Hi,

Sorry but I cannot find an appropriate group for this, and anyway the Cisco types always seem the best qualified to answer.

We have a search engine, which gets up to 20 requests per second from public domain searches, we used to block via IP Address, any persistent 'data miners' who would script requests to build up a pool of their own data.

Recently however the 'data miners' simply spoof their IP Address with every request, alco changing their search qualifiers (business and area) making traces and trapping a nightmare.

Is there any way of deep scanning network packets to find some fundamental identifier from any single point of origin (like a MAC address I guess) or am I wasting mine and your time?

Chheers for any help / advice or comforting words........


Best Regards,

<*>terminaljunkie<*>

 

[wybnormal]

A good sniffer and an IDS system would in order. Use the sniffer to build a baseline of traffic and when you see a packet that is questionable, dig into it and try to find a fingerprint. Even if the packet it spoofed, there are certain things that will stand out. The IDS can have a rule built to look for these packets and then send a TCP RST (reset) to whack the connection or to shun them at the firewall... or..or.. Get a copy of Snort, I would suggest PureSecure as the test since the install script is so clean and also configures the Apache and MySQL along with Snort. Check the snort rules database at the Snort site, they might have a rule already close to what you want. You can pull the pattern, port etc from the Snort rule and use it to build custom sniffer filters.

MikeS


Find me at

http://www.packetattack.com

&quot;Take advantage of the enemy's unreadiness, make your way by unexpected routes, and attack unguarded spots.&quot;
Sun Tzu

 

[routerman]

I would suggest having a look at an intrusion detection system, or possibly this could be done with the Cisco router based Network Based Application and Recognition (NBAR, may be worth reading up these?

 

[terminaljunkie]

Thanks - I'm on it.


Best Regards,

<*>terminaljunkie<*>