Signature to detect proxy usage?

[cniblo1975]

Hello. I just deployed some IDS sensors and would like to know which signature would be most approporate for detecting proxy usage. I tried HTTP CONNECT (5237/0) but I am not getting many hits. Is there another sig I can use that will alert me when someone is using a proxy to avoid Websense?

Thanks,

Chrissie

[bbaley]

Try this link

http://www.cisco.com/en/US/tech/tk722/tk809/technologies_tech_note09186a008063e5d0.shtml