Re: [Picviz] Squid php proxy detection

2009-05-19 Thread Sebastien Tricaud
On Tue, May 19, 2009 at 10:28 AM, Ionel GARDAIS
 wrote:
> Hi,

Hello Ionel,

>
> I found a way to know which of my users are bypassing webfiltering rules by 
> using PHPProxy.
> Basically, I wrote a python script that parses squid logs and list how many 
> different mime-types are associated with a unique URL.
> A threshold of 4 or 5 different mimes per URL is suspicious (however, GMail 
> and the like always shows up).
>
> I created a pgdl file using a modified squid2picviz.pl with only time, 
> source, URL and mime axis.

Awesome! if you have a picture to share, feel free to do so. I am glad
to have such feedback on Picviz ;)

>
> How could I specify a filter that says "highlight URL that points to more 
> than 4 MIME" (no matter how many times it has been accessed, so
> heatline does not seem to be an option) ?

It is not possible yet, and I understand your problem. So I will see
how I can add this new filter in the next release.

Best regards,
Sebastien.
___
Picviz mailing list
Picviz@wallinfire.net
http://www.wallinfire.net/cgi-bin/mailman/listinfo/picviz


[Picviz] Squid php proxy detection

2009-05-19 Thread Ionel GARDAIS
Hi,

I found a way to know which of my users are bypassing webfiltering rules by 
using PHPProxy.
Basically, I wrote a python script that parses squid logs and list how many 
different mime-types are associated with a unique URL.
A threshold of 4 or 5 different mimes per URL is suspicious (however, GMail and 
the like always shows up).

I created a pgdl file using a modified squid2picviz.pl with only time, source, 
URL and mime axis.

How could I specify a filter that says "highlight URL that points to more than 
4 MIME" (no matter how many times it has been accessed, so 
heatline does not seem to be an option) ?

Thanks,
Ionel
___
Picviz mailing list
Picviz@wallinfire.net
http://www.wallinfire.net/cgi-bin/mailman/listinfo/picviz