MRTG for Intrusion Detection with IIS 6

This is a pretty interesting (older) article about using MRTG to detect intrusions: MRTG for Intrusion Detection with IIS 6. The article specifically focuses on Windows servers, running IIS 6, but the technique could be expanded to other servers and services types.

The Multi Router Traffic Grapher (MRTG) is a simple cross-platform tool that administrators have used for years to monitor network traffic loads. The concept is simple: it queries SNMP counters and creates HTML pages with live network graphs showing bytes coming in and bytes going out. MRTG can show much more than in and out traffic, it can graph any SNMP counter. Microsoft has a web site that demonstrates some of the many SNMP counters available on a Windows 2003 server.

But MRTG is also a very effective intrusion detection tool. The concept is simple: attacks often produce some kind of anomalous pattern and human brains are well-equipped to spot anomalous patterns, given some way to visualize those patterns. The MRTG does just that -- it gives you the big picture of your network traffic and it also slices it into different views, allowing you to see any counter trends for the last week, month, or year.