Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Open Source Linux network analyzer

Which are there? What features do they offer?

share

locked by HopelessN00b Dec 5 at 11:38

This question exists because it has historical significance, but it is not considered a good, on-topic question for this site, so please do not use it as evidence that you can ask similar questions here. This question and its answers are frozen and cannot be changed. More info: help center.

11 Answers 11

up vote 22 down vote accepted

What exactly do you need?

  • wireshark - network sniffer/analyzer
  • iftop - bandwidth usage
  • darkstat - traffic analyzer
  • nmap - network port scanner
  • nessus - vulnerability scanner
  • metasploit - penetration testing
share
    
Worked for me, thx –  Martin K. Jul 23 '09 at 13:45
    
+1 for the variety –  squillman Jul 23 '09 at 13:45

Can't believe nobody mentioned tcpdump. Click on the link to see the list of features

share
    
Surprised by that too –  Swish Aug 10 '09 at 17:19

ntop is a solution that has been around for a while, can be extended with plugins. Here is a short how-to.

share

Wireshark (formerly ethereal) is my favorite.

share

A few more:

  • lanmap2 - sits quietly on a network and builds a picture of what it sees.
  • kismet - wireless sniffer
  • nikto - web server scanner
  • nast - another network sniffer/analyzer
share

A missing tool from the list is ettercap. A text-based tool to analyse a subnet and perform active or passive scans of the subnet. It can also monitor packets and display streams.

share

If you need a network traffic analyzer you can use tshark (it's the console version of wireshark).

share

MRTG for nice pretty pictures and graphs (management p0rn) via SNMP monitoring. does everything i need, but if u dont list your requirements its quite hard to guess what you want.

share

p0f - passive OS fingerprinting (http://lcamtuf.coredump.cx/p0f.shtml)

share

for reconaissance / mostly real time analysis:

  • tshark - text-only version of wireshark when tcpdump is too cryptic.
  • httpry - simple nice passive http protocol sniffer.
  • ngrep - displays payload of selected traffic
share

If you need a network intrusion IDS/IPS tool, Snort is one such open source tool.

share

Not the answer you're looking for? Browse other questions tagged or ask your own question.