Detect high numbers of outgoing connections per user. Maybe use Snort?

I'd like to detect abusive network traffic outgoing from my server (caused by different users on the server, maybe they're infected by a virus).

I'd like a solution that I can install as root on the server and that'll alert me if the number of outgoing connections per user (each has a unique private IP) per 1-minute time interval exceeds some threshold. Alert me simply by calling an HTTP POST webservice.

This needs to work on Ubuntu 10.04 LTS

In your bid, please specify what path you would take to solve this. Use Snort, or some other existing package? Or build something custom with iptables?

I'll also need a script to install/deploy the solution on the server.

Engenharia Linux Gestão de projetos Instalação de Script Shell Script Arquitetura de software Teste de Software Administrador do Sistema

ID do Projeto: #2711343

Sobre o projeto