From mboxrd@z Thu Jan 1 00:00:00 1970 From: ads nat Subject: Re: Can IPTABLES be used to send alerts! Date: Wed, 27 Aug 2003 19:28:36 -0700 (PDT) Sender: netfilter-admin@lists.netfilter.org Message-ID: <20030828022836.63124.qmail@web20705.mail.yahoo.com> References: Mime-Version: 1.0 Content-Type: multipart/alternative; boundary="0-1516299412-1062037716=:62123" Return-path: In-Reply-To: Errors-To: netfilter-admin@lists.netfilter.org List-Help: List-Post: List-Subscribe: , List-Id: List-Unsubscribe: , List-Archive: To: dir@att.net, Deshwal Chand Cc: "Netfilter (E-mail)" --0-1516299412-1062037716=:62123 Content-Type: text/plain; charset=us-ascii I am not C developer. But fairly good in php. Is it possible to extract details of file (100 %) by using php. Thanks dir@att.net wrote: Yes, this would be pretty straightforward to do if you are a C developer. You can use the QUEUE target to queue all HTTP traffic to userland. You would then build a userland program to monitor packets for a set of suspect keywords. This approach wouldn't be bullet-proof because the HTTP traffic will be fragmented to the MTU size, but it would probably catch 99% of the keywords you care about. With a little more code, you could demux the TCP traffic to rebuild the entire TCP stream, thereby making it 100%, but that's a lot more effort for little return IMO. Regards, dir > HI, > > I don't know whether this is the right place to raise this post. > > I am using IPTABLES and Squid. I want to monitor all the traffic going out > of this box. Suppose someone sends his/her CV from our network using his/her > Yahoo or Hotmail account, then I may get an alert. > > Can IPTABLES do this by using some addones!! > > Pls. pardon me if i am being wrong in posting this question on this list. --------------------------------- Do you Yahoo!? Yahoo! SiteBuilder - Free, easy-to-use web site design software --0-1516299412-1062037716=:62123 Content-Type: text/html; charset=us-ascii
I am not C developer. But fairly good in php.
Is it possible to extract details of file (100 %) by using php.
Thanks


dir@att.net wrote:
Yes, this would be pretty straightforward to do if you are a C developer.

You can use the QUEUE target to queue all HTTP traffic to userland. You
would then build a userland program to monitor packets for a set of suspect
keywords.

This approach wouldn't be bullet-proof because the HTTP traffic will be
fragmented to the MTU size, but it would probably catch 99% of the keywords
you care about. With a little more code, you could demux the TCP traffic to
rebuild the entire TCP stream, thereby making it 100%, but that's a lot more
effort for little return IMO.

Regards, dir

> HI,
>
> I don't know whether this is the right place to raise this post.
>
> I am using IPTABLES and Squid. I want to monitor all the traffic going out
> of this box. Suppose someone sends his/her CV from our network using his/her
> Yahoo or Hotmail account, then I may get an alert.
>
> Can IPTABLES do this by using some addones!!
>
> Pls. pardon me if i am being wrong in posting this question on this list.

Do you Yahoo!?
Yahoo! SiteBuilder - Free, easy-to-use web site design software --0-1516299412-1062037716=:62123--