Sniffer

[drcab]

As the Security Manager for my large organization, I am looking for a "Sniffer" that would track inappropriate Administrator process's (ie recreating accounts, accessing mailboxes, logon locations) as well as possible intrusion attempts from the inside. We utilize SMS as well as the server logs and auditing, however we are looking for an "All in one" Package. As expected we had an "Issue" that we are reacting to.

Thank you for your help.

dr cab

 

[GoldenEternity]

Depending on the kind of connections you allow to the server, a sniffer won't do you any good... If admins ssh in, your only shot is a man in the middle sniffer like comes with ettercap, but that only works on ssh1...

A better bet would be something like logwatch, and setting up logging to a secure remote system.

Check out what the honeynet project is doing... They have the best logging out there, and you can get some of their source (like the bash shell that logs commands to a remote system).