to collect, visualize and analyze IP accounting data from the
Cisco routers.
Cisco routers themselves are capable of collecting IP accounting
information . i.e. an unordered set of IP source-destination
pairs along with a byte and packet counters corresponding to all
network traffic flows that passed through the router's interfaces.
These data can be a useful source for various analysis procedures
and billing systems but by itself, in their raw form they are
rather difficult to read and understand. In addition, a router
cannot keep a lot of data . its memory is needed for purposes
other than remembering what traffic, from what sources and where
it forwarded two month ago.
WWW: http://ipacco.sourceforge.net/
- Babak Farrokhi
babak@farrokhi.net
PR: ports/99451
Submitted by: Babak Farrokhi <babak@farrokhi.net>
plugins, insert the data into rrdtool database, and generate webpages
with rrdtool graphs of the performance data. nagiosgraph is easy to
configure, and ready to use for many nagios plugins.
WWW: http://nagiosgraph.sourceforge.net/
PR: ports/96769
Submitted by: Denis Shaposhnikov <dsh@vlink.ru>
Nettop is a program which looks like top, but is for network packets.
It requires libpcap and slang to be installed on your computer.
WWW: http://srparish.net/scripts/
for a subset of ASN.1 data types, sockets based networking etc.)
written entirely in Python. This package provides command-line utilities
(pysnmpget, etc).
WWW: http://pysnmp.sourceforge.net/
PR: ports/95675
Submitted by: Martin Jackson <mhjacks@swbell.net>
for a subset of ASN.1 data types, sockets based networking etc.)
written entirely in Python. This package provides additional python-format
MIB files for use with PySNMP.
WWW: http://pysnmp.sourceforge.net/
PR: ports/95674
Submitted by: Martin Jackson <mhjacks@swbell.net>
for a subset of ASN.1 data types, sockets based networking etc.)
written entirely in Python.
WWW: http://pysnmp.sourceforge.net/
PR: ports/95673
Submitted by: Martin Jackson <mhjacks@swbell.net>
you an overview of all services with troubled services.
WWW: http://www.vanheusden.com/nagcon
PR: ports/95096
Submitted by: Douglas K. Rand <rand@meridian-enviro.com>
Bandwidth Monitor NG is a small and simple console-based live
bandwidth monitor for Linux, BSD, Solaris, Mac OS X and others.
Short list of features:
* supports /proc/net/dev, netstat, getifaddr, sysctl, kstat and libstatgrab
* unlimited number of interfaces supported
* interfaces are added or removed dynamically from list
* white-/blacklist of interfaces
* output of KB/s, Kb/s, packets, errors, average, max and total sum
* output in curses, plain console, CSV or HTML
* configfile
WWW: http://www.gropp.org/
This library implements SNMP (the Simple Network Management
Protocol). It is implemented in pure Ruby, so there are no dependencies
on external libraries like net-snmp. You can run this library anywhere
that Ruby can run.
against a radius server. This allows for more rapid
testing/troubleshooting of radius authentication problems depending
upon the method by which the person is authenticating (dial-up
customers come to mind).
Author: Matt Miller <mmiller_at_hick.org>
WWW: http://freshmeat.net/projects/radauth/
PR: ports/91975
Submitted by: Andrew Kilpatrick <tiger_at_whitetigersd.com>
Chillispot is used for authenticating users of a wireless
LAN. It support WPA (Wireless Protected Access) encryption.
Authentication, authorization and accounting (AAA) is handled
by your favorite radius server.
PR: ports/90397
Submitted by: Sevan Janiyan <venture37@geeklan.co.uk>
check_snmp_pkgvuln is a Nagios plugin that detects hosts that are running
vulnerable ports based on the database of security vulnerabilities
provided by portaudit. The plugin communicates with the host via SNMP
using the HOST-RESOURCES-MIB::hrSWInstalledName MIB.
WWW: http://www.cultdeadsheep.org/~clement/
Approved by: clement (mentor)
* airodump: 802.11 packet capture program
* aireplay: 802.11 packet injection program
* aircrack: static WEP and WPA-PSK key cracker
* airdecap: decrypts WEP/WPA capture files
* arpforge: forges ARP packets
At the moment airodump and aireplay cannot be built on FreeBSD
PR: ports/88870
Submitted by: Lars Engels <lars.engels@0x20.net>
Ourmon is a network management and anomaly detection system
for performing various SNMP RMON-like network analysis
tasks. It uses the BSD bpf in combination with RRDTOOL as
well as various "top talker" style tuples including: top-N
flows which include IP, TCP, UDP, and ICMP flows, top SYN
senders, top TCP/UDP ports, top single IP src to many IP
dst senders, top single IP src to L4 (TCP/UDP), top ICMP
errors which includes UDP creators of ICMP errors and other
tools for both network management and anomaly detection.
RRDTOOL graphs include a year of baselined information.
New RRDTOOL graphs may be designed with user-configured BPF
expressions a la tcpdump. Reports and logging for top
talkers are also included.
WWW: http://ourmon.cat.pdx.edu/ourmon/
PR: ports/84530
Submitted by: Charlie Schluting <manos@cs.pdx.edu>
think mrtg with xml configs
Torrus is designed to be the universal data series processing framework.
Although most users deploy Torrus for SNMP monitoring, it might be useful for
data series of any nature. Tobi Oetiker's RRDtool is used for data storage.
* Configuration compiler and validator. It processes the XML configuration
files and saves the configuration into a database.
* View renderer and the web interface. They generate HTML and the graphical
representation of the datasources and provide user authentication and
authorization. All generated output is controlled by the configuration
parameters and templates. The users can easily create their own
presentation of data series.
* SNMP Collector. Modular collector core architecture allows further
extension with new collector and storage types. Any datasource can have
its own polling schedule.
* SNMP Device Discovery Tool. Devdiscover is a new, modular, flexible, and
expandable tool for automatic generation of Torrus configuration files.
New device types and MIBs are easily added as independent Perl modules.
* Threshold monitor. All data, regardless of their type and nature, can be
monitored according to the user-defined rules. The rules can also include
the datasource-specific parameters, e.g. boundary values etc. The
thresholds are specified by RPN expressions.
WWW: http://torrus.org
- Corey Smith
corsmith@gmail.com
PR: ports/86634
Submitted by: Corey Smith <corsmith@gmail.com>
connectivity between network segments. It is mostly useful to detect "leaks" in
large organizations that have private network segments physically separated
from the Internet.
PR: ports/88424
Submitted by: Vaida Bogdan <vaidab@phenix.rootshell.be>
grepip searches the named input FILE (or standard input if no files are named),
for lines containing an IP address matched to the given CIDR.
grepip finds IP in any context of a line, while grepcidr only if all line is IP.
PR: ports/88384
Submitted by: Serge Maslov <serge@maslov.biz>
Approved by: sem (mentor, implict)
This is a mini-SNMP daemon. The basic daemon implements the system group
and a number of private extensions to manage the UDP transport mapping,
communities, trap destinations and loadable modules. In this form it can
be used to provide remote access to arbitrary data that can be described in
the form as required by the SMI. The daemon speaks both SNMPv1 and SNMPv2c.
PR: 86400
Submitted by: Andrey V. Elsukov <bu7cher@yandex.ru>
Approved by: pav (mentor)
grepcidr can be used to filter a list of IP addresses against
one or more Classless Inter-Domain Routing (CIDR) specifications,
or arbitrary networks specified by an address range. As with
grep, there are options to invert matching and load patterns
from a file. grepcidr is capable of comparing thousands or
even millions of IPs to networks with little memory usage and
in reasonable computation time.
grepcidr has endless uses in network software, including: mail
filtering and processing, network security, log analysis, and
many custom applications.
PR: ports/80315
Submitted by: Douglas Fraser <doug+ports@idmf.net>
PNG image format. It somewhat resembles the Linux bwbar (although there is no
connection to it).
Features include measurement both on interface and assigned IP-address basis,
possible to run non-root and non-setuid, quite customizable (colours, geometry,
device max speed, etc). It also includes text output to the image.
PR: ports/76275
Submitted by: Fredrik Lindberg <fli@shapeshifter.se>
data export. Softflowd semi-statefully tracks traffic flows recorded by
listening on a network interface or by reading a packet capture file.
These flows may be reported via NetFlow to a collecting host or summarised
within softflowd itself.
PR: ports/73723
Submitted by: Janos Mohacsi <janos.mohacsi@bsd.hu>
features:
* Understands NetFlow protocol v.1, v.5, v.7 and v.9 (including IPv6 flows)
* Supports both IPv4 and IPv6 transport of flows
* Secure: flowd is privilege separated to limit the impact of any compromise
* Supports filtering and tagging of flows, using a packet filter-like syntax
* Stores recorded flow data in a compact binary format which supports
run-time choice over which flow fields are stored
* Ships with both Perl and Python interfaces for reading and parsing the
on-disk record format
* Is licensed under a liberal BSD-like license
PR: ports/73722
Submitted by: Janos Mohacsi <janos.mohacsi@bsd.hu>
tcptrack is a sniffer which displays information about TCP connections it
sees on a network interface. It passively watches for connections on the
network interface, keeps track of their state and displays a list of
connections in a manner similar to the unix 'top' command. It displays
source and destination addresses and ports, connection state, idle time, and
bandwidth usage.
WWW: http://www.rhythm.cx/~steve/devel/tcptrack
PR: ports/72543
Submitted by: Tor Halvard Furulund <squat@squat.no>
NFDUMP tools support netflow v5 and v7 capturing and processing.
nfcapd - netflow capture daemon.
Reads the netflow data from the network and stores the data into files.
nfdump - netflow dump.
Reads the netflow data from the files stored by nfcapd. It's syntax is similar
to tcpdump. If you like tcpdump you will like nfdump.
nfprofile - netflow profiler.
Reads the netflow data from the files stored by nfcapd. Filters the netflow
data according to the specified filter sets ( profiles ) and stores the
filtered data into files for later use.
nfreplay - netflow replay
Reads the netflow data from the files stored by nfcapd and sends it over
the network to another host.
WWW: http://nfdump.sourceforge.net
PR: ports/72171
Submitted by: Janos Mohacsi <janos.mohacsi@niif.hu>
decrease the likelihood of erronous command execution and
to maintain all network services from a central point,
EnderUNIX SDT anounces the availability of its 9th open-source tool,
netUstad.
It has been coded in C language and includes its own HTTP server.
The newly anounced version provides a web interface for
system administrators to add/delete/update IPFW rulesets.
You can manage your IPFW firewall via a TCP/IP connected remote PC, easily.
Development version icludes modules to manage whole
network services (routing tables, network interfaces)
PR: ports/69176
Submitted by: Ozkan KIRIK <ozkan@enderunix.org>
Approved by: krion (mentor) (implicitly)
This package contains a small Lightweight Flow Accounting (LFAP)
server and LFAP API library. LFAP open solution to delivering
accounting data from Riverstone Networks Switches and Routers.
You can use the sfas program to obtain micro-flow information
from a Riverstone switch running either in Layer 4 bridging
mode, routing or MPLS LSPs. Data that can be collected includes
everything from an IPv4 header and UDP headers and the src/dst
port from a TCP header.
WWW: http://www.riverstonenet.com/support/nmops/
detection system. Kismet will work with any wireless card which supports raw
monitoring (rfmon) mode, and can sniff 802.11b, 802.11a, and 802.11g traffic.
PR: ports/66274
Submitted by: Thomas Spreng <spreng@socket.ch>
plugins and store it in RRD-files. You can the use Apan to view graphs of
the data in Nagios web-interface.
WWW: http://apan.sourceforge.net
PR: ports/64941
Submitted by: Janos Mohacsi <janos.mohacsi@bsd.hu>
to the finest level of information available at the moment. Sometimes this
can mean an exact description of a port in a building anywhere in an enterprise.
PR: ports/64728
Submitted by: Russell Jackson <rjackson@cserv62.csub.edu>
arpscan is a very simple scanner which sends out arp requests
for the given IP addresses and displays a list of the found
hosts.
PR: ports/64605
Submitted by: David Yeske <dyeske@yahoo.com>
