Tell me more ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.
up vote 3 down vote favorite

I'm looking for a GNU/Linux distro that I can install in transparent setup to look for infected hosts on a LAN. I don't need to stop viruses and malwares but only identify them and the host where they come from.

I don't necessarily need fancy graphics but I would like something pre-configured and possibly free. Any suggestions?

share|improve this question
Is booting with a LiveCD and option for you? – Tim Jun 7 '12 at 13:42
Yes Tim i also like livecd – PsyStyle Jun 7 '12 at 14:23
1  
Backtrack perhaps? It's a live CD distro designed for pen-testing but it probably has detection tools as well. Also, you may be interested in the Snort software suite. – jw013 Jul 7 '12 at 15:44
+1 for Backtrack. It has penetration testing tools with it by default that will be of great help. This is good ref and will be of help. sectools.org – Fayad Fami Sep 5 '12 at 18:09

2 Answers

up vote 1 down vote

securityonion is a ubuntu based distribution for intrusion detection. In its default configuration, it uses snort or suricata and bro-ids to analyse network traffic (that you feed it for instance by configuring your firewall to send it to it, or by using port mirroring on a switch) for signs of malicious activity using rules from VRT or Emerging Threats.

It also comes with an armada of security tools, and tools to inspect traffic. It can also be configured to watch files being downloaded and query databases of malware.

share|improve this answer
Thank you I will try it! – PsyStyle Nov 5 '12 at 7:48
up vote 0 down vote

The "SystemRescueCD" distro is gentoo based and comes with at least ClamAV antivirus scanner on it. It might have had a few other AV tools as well.

http://www.sysresccd.org/SystemRescueCd_Homepage

share|improve this answer
I know SystemRescuCD but it's not suited to my needs. What I'm looking for is a distro wich analyzes traffic passing throw a transparent server and reports for bad virus/malware traffic whith the host source IP address originating the threat. – PsyStyle Jun 7 '12 at 16:38

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.