Open Source Linux network analyzer

Question

Open Source Linux network analyzer

Which are there? What features do they offer?

Answer 1

What exactly do you need?

• wireshark - network sniffer/analyzer
• iftop - bandwidth usage
• darkstat - traffic analyzer
• nmap - network port scanner
• nessus - vulnerability scanner
• metasploit - penetration testing

Answer 2

ntop is a solution that has been around for a while, can be extended with plugins. Here is a short how-to.

Answer 3

Can't believe nobody mentioned tcpdump. Click on the link to see the list of features

Answer 4

Wireshark (formerly ethereal) is my favorite.

Answer 5

A few more:

• lanmap2 - sits quietly on a network and builds a picture of what it sees.
• kismet - wireless sniffer
• nikto - web server scanner
• nast - another network sniffer/analyzer

Answer 6

A missing tool from the list is ettercap. A text-based tool to analyse a subnet and perform active or passive scans of the subnet. It can also monitor packets and display streams.

Answer 7

If you need a network traffic analyzer you can use tshark (it's the console version of wireshark).

Answer 8

MRTG for nice pretty pictures and graphs (management p0rn) via SNMP monitoring. does everything i need, but if u dont list your requirements its quite hard to guess what you want.

Answer 9

p0f - passive OS fingerprinting (http://lcamtuf.coredump.cx/p0f.shtml)

Answer 10

for reconaissance / mostly real time analysis:

• tshark - text-only version of wireshark when tcpdump is too cryptic.
• httpry - simple nice passive http protocol sniffer.
• ngrep - displays payload of selected traffic

Answer 11

If you need a network intrusion IDS/IPS tool, Snort is one such open source tool.