Traiffic Monitoring

[jdcooke]

I recently had a customer who failing to keep his e107 site upto date got hacked.

There was a script which on demand used fopen to send lots of traffic to remote servers.

It took me a long time to track this down as the traffic was not recorded against the specific user despite the fact that it originated from their web page. It was sent out from port 80 as UDP packets to the remote server.

Is there any way for monitoring this outbound traffic as it got recorded as other out but as the server ip rather than as a particular user?