Intrusion Detection on Proxy Server

The "Alerting" service is configurable on the MS Proxy 2.0, under the "Security" tab in the web proxy's properties. It does require to have the packet filtering enabled on the Proxy server. I'm not aware of any intrution detection software, which would work on the same machine where the Proxy server is installed. Most of the intrution detection software needs a separate machine with dual NICs. One is configured on the local network and the other (external) is setup in promiscuous mode with no IP, connected to a hub front of the firewall. In that respect, any of them would work with MS Proxy, since it doesn't matter what kind of firewall is being used. The intrution detection software captures and analyzes all of the packets, looking for known patterns of intrutions.

Otto

This question was closed by the author