Ports Search

This is a lightweight but well-featured tool for collecting NetFlow version 5 packets from Cisco routers. The implementation includes a simple UDP-to-TCP converting server, which may be used to replicate NetFlow data to multiple clients.

EtherApe is a graphical network monitor for Unix modeled after Etherman. Featuring link layer, IP and TCP modes, it displays network activity graphically. Hosts and links change in size with traffic. Color coded protocols display. It supports Ethernet, FDDI, Token Ring, ISDN, PPP, SLIP, and WLAN devices, plus several encapsulation formats. It can filter traffic to be shown, and can read packets from a file as well as live from the network. Node statistics can be exported.

IPCAD is an IP accounting daemon. It uses bpf or pcap to access interfaces and gather IP statistics. Collected numbers are arranged to form an address-to-address flow pairs and than can be accessed via rsh in Cisco fashion, or exported via NetFlow UDP protocol. See README file and man pages for details.

Would you like to summarize and/or log network activity down to the ip address and port level of detail, but not record every packet? Ipaudit provides that ability. Ipaudit listens to a network device in promiscuous mode, and records of every 'connection', each conversation between two ip addresses. A unique connection is determined by the ip addresses of the two machines, the protocol used between them and the port numbers (if they are communicating via UDP or TCP). It uses a hash table to keep track of the number of bytes and packets in both directions. When ipaudit receives a signal SIGTERM (kill) or SIGINT (kill -2, usually the same as a Control-C), it stops collecting data and writes the tabulated results. Ipaudit is built using the pcap packet capture library to read the network port from LBNL Network Research Group.

Kismet is an 802.11 layer2 wireless network detector, sniffer, and intrusion detection system. Kismet will work with any wireless card which supports raw monitoring (rfmon) mode, and can sniff 802.11a, 802.11b, and 802.11g traffic. Kismet identifies networks by passively collecting packets. In addition to standard networks, it can detect (and given time, decloak) hidden networks, and infer the presence of nonbeaconing networks via data traffic. Capture sources that are known to be supported: Atheros, Prism2, WSP100, Drone, wtapfile, pcapfile. Kismet also supports radiotap headers and should work with current FreeBSD systems.

NDPMon is an equivalent of ArpWatch for IPv6. NDPMon, Neighbor Discovery Protocol Monitor, is a tool working with ICMPv6 packets. NDPMon observes the local network to see if nodes using neighbor discovery messages behave properly. When it detects a suspicious Neighbor Discovery message, it notifies the administrator by writing in the syslog and in some cases by sending an email report.

nagiosgraph is an application to collect performance data from nagios plugins, insert the data into rrdtool database, and generate webpages with rrdtool graphs of the performance data. nagiosgraph is easy to configure, and ready to use for many nagios plugins.

Network Leak Finder is a collection of small perlscripts that detects connectivity between network segments. It is mostly useful to detect "leaks" in large organizations that have private network segments physically separated from the Internet.

NFDUMP tools support netflow v5, v7 and v9 capturing and processing. nfcapd - netflow capture daemon. Reads the netflow data from the network and stores the data into files. nfdump - netflow dump. Reads the netflow data from the files stored by nfcapd. It's syntax is similar to tcpdump. If you like tcpdump you will like nfdump. nfprofile - netflow profiler. Reads the netflow data from the files stored by nfcapd. Filters the netflow data according to the specified filter sets (profiles) and stores the filtered data into files for later use. nfreplay - netflow replay. Reads the netflow data from the files stored by nfcapd and sends it over the network to another host. ft2nfdump - flow-tools to nfdump - optional component.

NfSen is a graphical web based front end for the nfdump netflow tools. NfSen allows you to: * Display your netflow data: Flows, Packets and Bytes using RRD (Round Robin Database). * Easily navigate through the netflow data. * Process the netflow data within the specified time span. * Create history as well as continuous profiles. * Write your own plugins to process netflow data on a regular interval