Detect high numbers of outgoing connections per user. Maybe use Snort?

I'd like to detect abusive network traffic outgoing from my server (caused by different users on the server, maybe they're infected by a virus).

I'd like a solution that I can install as root on the server and that'll alert me if the number of outgoing connections per user (each has a unique private IP) per 1-minute time interval exceeds some threshold. Alert me simply by calling an HTTP POST webservice.

This needs to work on Ubuntu 10.04 LTS

In your bid, please specify what path you would take to solve this. Use Snort, or some other existing package? Or build something custom with iptables?

I'll also need a script to install/deploy the solution on the server.

tekniikka Linux Projektinhallinta Komentosarjan asennus Shell Script Tietojärjestelmäarkkitehtuuri Ohjelmistojen testaus Järjestelmänvalvoja

Projektin tunnus: #2711343

Tietoa projektista