> You need to Span/Mirror the traffic from your distribution > switch(es) to an ethernet card appropriate for the size of traffic you > see, 0-100mbps 100mbps ethernet, 100-1000 gigabit. And then run Snort > with all of the plugins to look for malicious traffic. There aren't > really network "virus" scanners so much as there are IDS detection > programs which will detect the traffic signatures of the 'worm/malware' > spreading software and alert you. As viruses are generally local host > problems but the 'spreading' of them you CAN detect. > > HTH. > > -Drew > > > -----Original Message----- > From: centos-bounces at centos.org [mailto:centos-bounces at centos.org] On > Behalf Of eric at austinconventioncenter.com > Sent: Tuesday, October 10, 2006 11:39 AM > To: centos at centos.org > Subject: [CentOS] antivirus sniffer/scanner for networks > > Is anyone aware of a package that can detect viri on the network & > possibly alert when there are? > > Here is the scenario: Our network is utilized by guest users all the > time, sometimes into the thousands. We see guests from all over with a > variety of OSs & hardware, all of which, we have no control or say in > that matter. > > I am looking for something that I can run in promiscuous mode and/or on > a span port that will sniff for viri and then alert/log when it sees a > virus. We can then track down the culprits' ip/mac and shut off the > switch port he/she is connected to and then visit with the guest to help > them clean their machine. > > Given the nature of our network and our guests' needs, an inline > solution is not an option. Although, I recall that squid supports WCCP, > I'm not sure that it would do what I am requesting. I also looked at > snort+libclamav, but the info was inconclusive. > > We are a CentOs shop and I have a spare dual xeon box that I can use for > the task. > > Thanks, > > Eric > _______________________________________________ > CentOS mailing list > CentOS at centos.org > http://lists.centos.org/mailman/listinfo/centos > _______________________________________________ > CentOS mailing list > CentOS at centos.org > http://lists.centos.org/mailman/listinfo/centos > Thanks, I will pursue the snort path then....