New answers tagged intrusion-detection
You can use tcpdump or shark for capturing the filtered packets and count them as you want.
I believe netstat -s will be your friend. If you are looking for a switch level service, you can use sflow/netflow to collect data and send them to the collector.
Most file integrity monitoring systems should be able to do this, creating a 'known-good' baseline snapshot which files are later checked against. You've already mentioned the open source systems OSSEC and Tripwire, but there are a few commercial options too - which will typically have a better user interface, be much easier to configure, and come with a ...
Top 50 recent answers are included