O
otf
Is there anything out there like apache's TCPmon(itor) but written in C or
CPP (not Java)?
..
or how customizable would the utility tcpdump be so that it works
similarly?
..
Basically, you would set a tcpdump-like utility to:
..
1._ only listen to certain ports
2._ only to certain protocols within these (1.) ports otherwise would not
forward the request and only log it as a protocol anomaly/probable security
issue, including the payload in those cases
3._ for messages that have passed 1. and 2. only sniff the request headers
in and the response headers out
..
it would be just a proxy sniffing the headers not the data payload (which
will be then saved only if some rules are not matched).
..
I think that the AJP protocol used to link Apache and Tomcat does something
similar because it has to look into the headers to tell apart requests
coming with set up sessions and those that don't as part of its load
balancing algorithm (I think)
..
Can you compile tcpdump with options to just do that so that the resulting
executable should be very small? Or do you know of any other utility to do
the same?
..
Thnaks
otf
CPP (not Java)?
..
or how customizable would the utility tcpdump be so that it works
similarly?
..
Basically, you would set a tcpdump-like utility to:
..
1._ only listen to certain ports
2._ only to certain protocols within these (1.) ports otherwise would not
forward the request and only log it as a protocol anomaly/probable security
issue, including the payload in those cases
3._ for messages that have passed 1. and 2. only sniff the request headers
in and the response headers out
..
it would be just a proxy sniffing the headers not the data payload (which
will be then saved only if some rules are not matched).
..
I think that the AJP protocol used to link Apache and Tomcat does something
similar because it has to look into the headers to tell apart requests
coming with set up sessions and those that don't as part of its load
balancing algorithm (I think)
..
Can you compile tcpdump with options to just do that so that the resulting
executable should be very small? Or do you know of any other utility to do
the same?
..
Thnaks
otf