Anti-Virus and servers...

I'm looking to set up one of my linux systems as a firewall for the
network of computers (which is a mix of mostly Windows machines and a
couple Linux ones) in my house. Due to the actions of some people who
live there once the network is fully up viruses will be a problem. Is
there any software out there that can scan all traffic going through
the computer for any viruses?

TomCatalyst wrote:
> I'm looking to set up one of my linux systems as a firewall for the
> network of computers (which is a mix of mostly Windows machines and a
> couple Linux ones) in my house. Due to the actions of some people who
> live there once the network is fully up viruses will be a problem. Is
> there any software out there that can scan all traffic going through
> the computer for any viruses?
>

Check out clamav, it might help you.

I don't think that scanning ALL traffic would really be much of an
option, but you can scan email and such. You can also watch for
malicious activity such as broadcast and port scans...they can be
indicative of a virus.

Any network that has windows machines on it has problems with viruses.
It is a gimmie. Windows is just a whore, and protection only works 90%
of the time.

BTW, what is everyone's record for cleaning out adware, spyware, and
viruses on a single windows computer in a single day? I think mine is
currently somewhere around 3k.

Honestly, I think at this point in the computer age, adware is more
destructive than most viruses out there.i

TomCatalyst <(E-Mail Removed)> wrote:
> I'm looking to set up one of my linux systems as a firewall for the
> network of computers (which is a mix of mostly Windows machines and a
> couple Linux ones) in my house. Due to the actions of some people who
> live there once the network is fully up viruses will be a problem. Is
> there any software out there that can scan all traffic going through
> the computer for any viruses?

You can't just simply scan arbitrary traffic for "viruses" per se, but you can
set up a network analyzer system that will generate alerts whenever a system
exhibits behavior that indicates it may be infected with a virus.

http://www.snort.org/

This won't do anything to stop infections, but it will greatly help in finding
the offending machines as quickly as possible.

--
Frank Sweetser fs at wpi.edu
WPI Network Engineer
GPG fingerprint = 6174 1257 129E 0D21 D8D4 E8A3 8E39 29E3 E2E8 8CEC

TomCatalyst wrote:
> I'm looking to set up one of my linux systems as a firewall for the
> network of computers (which is a mix of mostly Windows machines and a
> couple Linux ones) in my house. Due to the actions of some people who
> live there once the network is fully up viruses will be a problem. Is
> there any software out there that can scan all traffic going through
> the computer for any viruses?
>


You may want to look into a type of program called "viruswall". They
are suppose to be extactly what you are looking for, but I have not been
able to find a free version.

TomCatalyst wrote:
> I'm looking to set up one of my linux systems as a firewall for the
> network of computers (which is a mix of mostly Windows machines and a
> couple Linux ones) in my house. Due to the actions of some people who
> live there once the network is fully up viruses will be a problem. Is
> there any software out there that can scan all traffic going through
> the computer for any viruses?

u can use squid web proxy and ipcop firewall

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

TomCatalyst wrote:

> Is
> there any software out there that can scan all traffic going through
> the computer for any viruses?
If using Squid with DansGuardian and DansGuardian Anti-Virus Plugin you can
scan files downloaded through a web browser (including webmail?).

Using p3scan with clamav, SpamAssassin, renattach, and p3pmail you can
protect against pop3 email traffic (see sig).

IIRC, there is a way to scan ftp traffic also (see google).

So, this will scan most traffic less p2p. There, you may have to use
something like Application Layer Packet Classifier for Linux
(http://l7-filter.sourceforge.net/) to throttle (or block?) p2p downloads
so bad, the the clients give up.
- --
Slackware Tips & Tricks - http://members.cox.net/laitcg/slack.htm
P3Scan - Transparent POP3 virus/spam/mime/html scanning proxy:
http://p3scan.sourceforge.net
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.7 (GNU/Linux)

iD8DBQFCCOH69/VKdZrnv3YRAin6AJ914mtZx7YPY/6Cr4aWhNZ7k7BZFACeMJB0
YErJvcaS3/RVIVbUEUjC+ME=
=TQRj
-----END PGP SIGNATURE-----