[Snort-users] snort and proxy

Michael Boman michael.boman at ...4162...
Fri Nov 7 00:31:05 EST 2003


On Fri, 2003-11-07 at 16:59, nosnos wrote:
> Hi,
> 
> I want to know if snort can store the ip of a destination if snort is 
> bewind a proxy. For the moment, my snort can't see the destination 
> because all request has the proxy's IP .... :( Is there a way to solve 
> this problem ?
> 
> Moreover, i want snort to list all the URL that my network attemp to reach.
> 
> For example I have 3 pc connected and I want that snort make the 
> followig list (in a database if possible)
> (an example) :
> 
> - IP src                                     URL
> 10.150.1.20 (pc IP 1)              www.linux.org
> 10.150.1.20 (pc IP 1)              www.snort.org
> 10.150.1.20 (pc IP 1)              www.amazon.com
> ....
> PS : i don't the IP dest because, an IP can be assigned for many site ....
> 
> 
> thx a lot

I suggest that you should use your proxy server's logs to correlate the
event(s). Snort is not the right tool for this job.

Best regards
 Michael Boman

-- 
Michael Boman
Security Architect, SecureCiRT Pte Ltd
http://www.securecirt.com
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 189 bytes
Desc: This is a digitally signed message part
URL: <https://lists.snort.org/pipermail/snort-users/attachments/20031107/ed1c96bc/attachment.sig>


More information about the Snort-users mailing list