On Apr 20, 2012, at 11:45 AM, Brian Excarnate wrote:
> So my first question is: Is there some other tool that is a better choice, and if so which?
You could use something that generates netflow records and a netflow collector or Argus. You could also give Bro-IDS a try (I'm one of the developers). The output you're looking for can be found in our conn logs. You can download a binary package from our website too:
http://www.bro-ids.org/download/#binarypackages
If you're just interested in getting the conn logs, you should be to run (with the appropriate interface):
sudo bro -i eth0
It will start creating logs in your current working directory.
.Seth
--
Seth Hall
International Computer Science Institute
(Bro) because everyone has a network
http://www.bro-ids.org/