Hi Guys,

One of the company I consult for experienced a DNS DOS attack on their two main DNS servers, the attack slowed down the network. Interestingly, the attack originated from several of their WAN clients. I had to sniff traffic traffic on the servers and dump those traffic to a protocol analyzer before we could figure out where the attack was coming from.

Can anyone of you give me pointers about open source "Network Security Systems" that sit at the border of your network and monitor every and any kind of traffic i.e viruses, malware, spyware, broadcast storms etc and report on these threats in real time.

I have a couple of tools I use and they are pretty good but I wanted you guys input.

Thanks

oops, seems no one is interested in open source network security.

Ok Alexis! who isnt scared for his or her network these days. I don't know but perhaps snort is what you want. You can actually "regexp" it to catch nmap scans. I'll get more stuff for you www.snort.org. U can also check this page http://netsecurity.about.com/od/intrusiondetectionid1/a/aafreeids.htm

You might also want to check out Dan Kaminsky's talk of Black Hat 2004 on Black-ops of DNS. Then U cld see how hackers compromise DNS servers.
IpTables with Linux/Unix also help to mitigate some kinds of attacks.

look into SMOOTHWALL i think smoothwall.org too lazy to check

get a Barracuda Application Firewall Appliance...trust me open source has hole.. hence yor network loop holes are very open to possible hacking again and again and again...call me lets dicuss further 08061537053

wireshark, airodump, cain and abel bla bla bla