Re: Can IPTABLES be used to send alerts!

Re: Can IPTABLES be used to send alerts!

[dir]

Yes, this would be pretty straightforward to do if you are a C developer.

You can use the QUEUE target to queue all HTTP traffic to userland.  You 
would then build a userland program to monitor packets for a set of suspect 
keywords.

This approach wouldn't be bullet-proof because the HTTP traffic will be 
fragmented to the MTU size, but it would probably catch 99% of the keywords 
you care about.  With a little more code, you could demux the TCP traffic to 
rebuild the entire TCP stream, thereby making it 100%, but that's a lot more 
effort for little return IMO.

Regards, dir

> HI,
> 
> I don't know whether this is the right place to raise this post.
> 
> I am using IPTABLES and Squid. I want to monitor all the traffic going out
> of this box. Suppose someone sends his/her CV from our network using his/her
> Yahoo or Hotmail account, then I may get an alert.
> 
> Can IPTABLES do this by using some addones!!
> 
> Pls. pardon me if i am being wrong in posting this question on this list.

Re: Can IPTABLES be used to send alerts!

[Ramin Dousti]

On Wed, Aug 27, 2003 at 02:10:30PM +0000, dir@att.net wrote:

[...]
> With a little more code, you could demux the TCP traffic to rebuild the
> entire TCP stream, thereby making it 100%, but that's a lot more 
> effort for little return IMO.

Isn't it then easier to have a HTTP proxy to do exactly that?

Ramin

> 
> Regards, dir

Re: Can IPTABLES be used to send alerts!

[ads nat]

[-- Attachment #1: Type: text/plain, Size: 1256 bytes --]

I am not C developer. But fairly good in php.
Is it possible to extract details of file (100 %) by using php.
Thanks


dir@att.net wrote:
Yes, this would be pretty straightforward to do if you are a C developer.

You can use the QUEUE target to queue all HTTP traffic to userland. You 
would then build a userland program to monitor packets for a set of suspect 
keywords.

This approach wouldn't be bullet-proof because the HTTP traffic will be 
fragmented to the MTU size, but it would probably catch 99% of the keywords 
you care about. With a little more code, you could demux the TCP traffic to 
rebuild the entire TCP stream, thereby making it 100%, but that's a lot more 
effort for little return IMO.

Regards, dir

> HI,
> 
> I don't know whether this is the right place to raise this post.
> 
> I am using IPTABLES and Squid. I want to monitor all the traffic going out
> of this box. Suppose someone sends his/her CV from our network using his/her
> Yahoo or Hotmail account, then I may get an alert.
> 
> Can IPTABLES do this by using some addones!!
> 
> Pls. pardon me if i am being wrong in posting this question on this list.



---------------------------------
Do you Yahoo!?
Yahoo! SiteBuilder - Free, easy-to-use web site design software

[-- Attachment #2: Type: text/html, Size: 1611 bytes --]

RE: Can IPTABLES be used to send alerts!

[Deshwal Chand]

[-- Attachment #1: Type: text/plain, Size: 2465 bytes --]

Jim,

you r fair enough in raising the legal and ethical point. I gave a wrong
example. We do not intent to monitor the CVs or people looking for better
jobs. We are a company who work on high security geographical data for
clients. We have got people to sign the confidentiality agreements as well. 

The e-mail server and LAN have been secured enough. The only thing that we
intend to stop is the information about data. Even few text lines for us can
be costly.


Best Regards,

Chand

-----Original Message-----
From: Jim Carter [mailto:jimc@math.ucla.edu]
Sent: Wednesday, August 27, 2003 11:13 PM
To: Deshwal Chand
Cc: Netfilter (E-mail)
Subject: Re: Can IPTABLES be used to send alerts!


On Wed, 27 Aug 2003, Deshwal Chand wrote:
> I am using IPTABLES and Squid. I want to monitor all the traffic going out
> of this box. Suppose someone sends his/her CV from our network using
his/her
> Yahoo or Hotmail account, then I may get an alert.

Another person pointed out that you could make a copy of your datastream,
using iptables facilities, and feed it to a program that you write, which
would do the analysis.  But actually analysing the data would be very hard,
since you would have to understand meaning and intent, not just trigger on
text strings.

In American custom and law, monitoring users' content is not proper
behavior.  At UCLA there is a specific regulation that would forbid it at
my site.  Commercial web hosts such as msn.com have rules forbidding
pornographic, defamatory, illegal, etc. postings, but in the USA the custom
is that the host has to wait until someone claims to have been harmed by
the posting, before taking action.  A few years ago, aol.com got proactive
about editing postings that criticized AOL, and they were severely flamed
for it.

I don't know the situation in Indian and British law, but you should
definitely consult a lawyer, as well as a spiritual advisor who can give
you guidance in proper behavior according to Indian custom, before
snooping on users to detect people trying to get a better job elsewhere.
If I were interviewing a new programmer and he/she said he left his
previous job because the employer was snooping on him, I would consider
that a sufficient reason to leave the job.

James F. Carter          Voice 310 825 2897    FAX 310 206 6673
UCLA-Mathnet;  6115 MSA; 405 Hilgard Ave.; Los Angeles, CA, USA  90095-1555
Email: jimc@math.ucla.edu    http://www.math.ucla.edu/~jimc (q.v. for PGP
key)

[-- Attachment #2: Type: text/html, Size: 4010 bytes --]

Can IPTABLES be used to send alerts!

[Deshwal Chand]

[-- Attachment #1: Type: text/plain, Size: 395 bytes --]

HI,

I don't know whether this is the right place to raise this post.

I am using IPTABLES and Squid. I want to monitor all the traffic going out
of this box. Suppose someone sends his/her CV from our network using his/her
Yahoo or Hotmail account, then I may get an alert.

Can IPTABLES do this by using some addones!!

Pls. pardon me if i am being wrong in posting this question on this list.

[-- Attachment #2: Type: text/html, Size: 917 bytes --]

Re: Can IPTABLES be used to send alerts!

[Rob Verduijn]

Hi there,

You are right it is wrong if you ask me.
You might be more lucky on the squid or squidguard list.

Also if you need to check for that kinda stuff, something else is
seriously wrong in your company.

Regards
Rob

On Wed, 2003-08-27 at 10:56, Deshwal Chand wrote:
> HI,
> 
> I don't know whether this is the right place to raise this post.
> 
> I am using IPTABLES and Squid. I want to monitor all the traffic going
> out of this box. Suppose someone sends his/her CV from our network
> using his/her Yahoo or Hotmail account, then I may get an alert.
> 
> Can IPTABLES do this by using some addones!!
> 
> Pls. pardon me if i am being wrong in posting this question on this
> list.
> 

Re: Can IPTABLES be used to send alerts!

[Jim Carter]

On Wed, 27 Aug 2003, Deshwal Chand wrote:
> I am using IPTABLES and Squid. I want to monitor all the traffic going out
> of this box. Suppose someone sends his/her CV from our network using his/her
> Yahoo or Hotmail account, then I may get an alert.

Another person pointed out that you could make a copy of your datastream,
using iptables facilities, and feed it to a program that you write, which
would do the analysis.  But actually analysing the data would be very hard,
since you would have to understand meaning and intent, not just trigger on
text strings.

In American custom and law, monitoring users' content is not proper
behavior.  At UCLA there is a specific regulation that would forbid it at
my site.  Commercial web hosts such as msn.com have rules forbidding
pornographic, defamatory, illegal, etc. postings, but in the USA the custom
is that the host has to wait until someone claims to have been harmed by
the posting, before taking action.  A few years ago, aol.com got proactive
about editing postings that criticized AOL, and they were severely flamed
for it.

I don't know the situation in Indian and British law, but you should
definitely consult a lawyer, as well as a spiritual advisor who can give
you guidance in proper behavior according to Indian custom, before
snooping on users to detect people trying to get a better job elsewhere.
If I were interviewing a new programmer and he/she said he left his
previous job because the employer was snooping on him, I would consider
that a sufficient reason to leave the job.

James F. Carter          Voice 310 825 2897    FAX 310 206 6673
UCLA-Mathnet;  6115 MSA; 405 Hilgard Ave.; Los Angeles, CA, USA  90095-1555
Email: jimc@math.ucla.edu    http://www.math.ucla.edu/~jimc (q.v. for PGP key)

Re: Can IPTABLES be used to send alerts!

[Arnt Karlsen]

On Wed, 27 Aug 2003 09:43:24 -0700 (PDT), 
Jim Carter <jimc@math.ucla.edu> wrote in message 
<Pine.LNX.4.53.0308270926070.7868@simba.math.ucla.edu>:

> On Wed, 27 Aug 2003, Deshwal Chand wrote:
> > I am using IPTABLES and Squid. I want to monitor all the traffic
> > going out of this box. Suppose someone sends his/her CV from our
> > network using his/her Yahoo or Hotmail account, then I may get an
> > alert.
> 
> Another person pointed out that you could make a copy of your
> datastream, using iptables facilities, and feed it to a program that
> you write, which would do the analysis.  But actually analysing the
> data would be very hard, since you would have to understand meaning
> and intent, not just trigger on text strings.
 
> In American custom and law, monitoring users' content is not proper
> behavior.  At UCLA there is a specific regulation that would forbid it
> at my site.  Commercial web hosts such as msn.com have rules
> forbidding pornographic, defamatory, illegal, etc. postings, but in
> the USA the custom is that the host has to wait until someone claims
> to have been harmed by the posting, before taking action.  A few years
> ago, aol.com got proactive about editing postings that criticized AOL,
> and they were severely flamed for it.
> 
> I don't know the situation in Indian and British law, but you should
> definitely consult a lawyer, as well as a spiritual advisor who can
> give you guidance in proper behavior according to Indian custom,
> before snooping on users to detect people trying to get a better job
> elsewhere. If I were interviewing a new programmer and he/she said he
> left his previous job because the employer was snooping on him, I
> would consider that a sufficient reason to leave the job.

..Deswhal, you may use this out to qualify the why not etc, to 
your company.  And, my advice is, get a new job, we'll help.
The chew out:

..Mahatma Gandhi was once asked how he felt about Western Civilization.
He responded: "That would be a very good idea."  

..the same can be said about American Intelligence.  

..I see _no_ honorable reason your company can legally snoop on someone
sending their own CV to get a job in a better company, and this snooping
is a criminal offence, in _all_ civilized countries and jurisdictions.

..furthermore, this snooping is commonly known as espionage and is a 
criminal offence in _all_ countries and jurisdictions I am aware of, 
both civilized and not, and unless you do it for the government in
your own or an allied country, on your own governments order or as a
volonteer spy, and you get caught, you're in for anywhere between 20 
years and death.

..on volonteering your services in helping develop technology to another
and possibly allied, _but_unknown_ intelligence service, this may also 
violate export laws, and you will wanna make _sure_ those 20 years 
upwards, qualify as "worth it", "fair use" and "in good faith", and 
"monitoring" people sending their own CV's, does _not_.

-- 
..med vennlig hilsen = with Kind Regards from Arnt... 
...with a number of polar bear hunters in his ancestry...
  Scenarios always come in sets of three: 
  best case, worst case, and just in case.