Hi all,
If I need to monitor my network traffic that includes some Headless Unix Servers, knowing that Wireshark does not work on Headless Systems, where can I find an alternative LDAP Capture tool ?
Thanks in advance.
Â
Hello,
When the volume of traffic intercepted is high and makes performing the manual analysis of a network capture very labour intensive, one way of quickly processing this information to identify attacks or set a starting point of where to start the investigation is to use automatic analysis with external tools.
One of the most widely used applications for the detection of system attacks is Snort. Snort is an open-code IDS (Intrusion Detection System) based on signatures, that analyses the traffic in real time and compares it against a known signature repository, warning when packets are suspect whether for its content or structure. This could be useful when analysing a previously performed traffic capture that is too big to be analysed manually. To process the PCAP file via Snort, execute the following command: AttachedÂ
Thanking you
Franke Mary.
Â
