Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Open Source Linux network analyzer

Which are there? What features do they offer?


locked by HopelessN00b Dec 5 '14 at 11:38

This question exists because it has historical significance, but it is not considered a good, on-topic question for this site, so please do not use it as evidence that you can ask similar questions here. This question and its answers are frozen and cannot be changed. More info: help center.

11 Answers 11

up vote 22 down vote accepted

What exactly do you need?

  • wireshark - network sniffer/analyzer
  • iftop - bandwidth usage
  • darkstat - traffic analyzer
  • nmap - network port scanner
  • nessus - vulnerability scanner
  • metasploit - penetration testing
Worked for me, thx – Martin K. Jul 23 '09 at 13:45
+1 for the variety – squillman Jul 23 '09 at 13:45

Can't believe nobody mentioned tcpdump. Click on the link to see the list of features

Surprised by that too – Swish Aug 10 '09 at 17:19

ntop is a solution that has been around for a while, can be extended with plugins. Here is a short how-to.


Wireshark (formerly ethereal) is my favorite.


A few more:

  • lanmap2 - sits quietly on a network and builds a picture of what it sees.
  • kismet - wireless sniffer
  • nikto - web server scanner
  • nast - another network sniffer/analyzer

A missing tool from the list is ettercap. A text-based tool to analyse a subnet and perform active or passive scans of the subnet. It can also monitor packets and display streams.


If you need a network traffic analyzer you can use tshark (it's the console version of wireshark).


MRTG for nice pretty pictures and graphs (management p0rn) via SNMP monitoring. does everything i need, but if u dont list your requirements its quite hard to guess what you want.


p0f - passive OS fingerprinting (


for reconaissance / mostly real time analysis:

  • tshark - text-only version of wireshark when tcpdump is too cryptic.
  • httpry - simple nice passive http protocol sniffer.
  • ngrep - displays payload of selected traffic

If you need a network intrusion IDS/IPS tool, Snort is one such open source tool.


Not the answer you're looking for? Browse other questions tagged or ask your own question.