Does anyone have any
or know of any tools (possible perl scripts, etc.) for anaylzing and trending
tcpdump output? I have been developing something myself, but I wanted to
see if anyone had something that they were currently using.
We get an enormous
amount of traffic throughout our enterprise and we are using Shadow for more of
a reactive role rather than a proactive role. I would like to either
develop or find some scripts or otherwise to organize and trend this data, as
well as compare it against the output of other IDS tools that we use so we can
be a little more proactive about the tool.
Any
ideas?
=====================================
Michael
Keplinger
Information
Assurance
Security Systems
Engineer
"Some dumb
quote"
