Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Open Source Linux network analyzer

Which are there? What features do they offer?

share|improve this question

11 Answers 11

up vote 22 down vote accepted

What exactly do you need?

  • wireshark - network sniffer/analyzer
  • iftop - bandwidth usage
  • darkstat - traffic analyzer
  • nmap - network port scanner
  • nessus - vulnerability scanner
  • metasploit - penetration testing
share|improve this answer
Worked for me, thx –  Martin K. Jul 23 '09 at 13:45
+1 for the variety –  squillman Jul 23 '09 at 13:45

Can't believe nobody mentioned tcpdump. Click on the link to see the list of features

share|improve this answer
Surprised by that too –  Swish Aug 10 '09 at 17:19

ntop is a solution that has been around for a while, can be extended with plugins. Here is a short how-to.

share|improve this answer

Wireshark (formerly ethereal) is my favorite.

share|improve this answer

A few more:

  • lanmap2 - sits quietly on a network and builds a picture of what it sees.
  • kismet - wireless sniffer
  • nikto - web server scanner
  • nast - another network sniffer/analyzer
share|improve this answer

A missing tool from the list is ettercap. A text-based tool to analyse a subnet and perform active or passive scans of the subnet. It can also monitor packets and display streams.

share|improve this answer

If you need a network traffic analyzer you can use tshark (it's the console version of wireshark).

share|improve this answer

MRTG for nice pretty pictures and graphs (management p0rn) via SNMP monitoring. does everything i need, but if u dont list your requirements its quite hard to guess what you want.

share|improve this answer

p0f - passive OS fingerprinting (http://lcamtuf.coredump.cx/p0f.shtml)

share|improve this answer

for reconaissance / mostly real time analysis:

  • tshark - text-only version of wireshark when tcpdump is too cryptic.
  • httpry - simple nice passive http protocol sniffer.
  • ngrep - displays payload of selected traffic
share|improve this answer

If you need a network intrusion IDS/IPS tool, Snort is one such open source tool.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.