Seismic Intrusion Detection

Deep Network Analyzer is an flexible, open and extensible deep network analyzer (software server) and architecture for gathering and analyzing network packets, network sessions and applications protocols, passively off enterprise class networks. DNA is designed to be used for Internet Security,...

Trinux is a ramdisk-based Linux distribution that boots from a single floppy or CD-ROM, loads it packages from an HTTP/FTP server, a FAT/NTFS/ISO filesystem, or additional floppies. Trinux contains the latest versions of popular Open Source network security tools for port scanning, packet...

WallFire is a very general and modular firewalling application based on Netfilter or any kind of low-level framework. It will enable to manage every aspect of a firewall administration, from configuration to monitoring, intrusion detection, etc... WallFire will provide command line and...


Platforms: *nix

BASE is the Basic Analysis and Security Engine. It is based on the code from the Analysis Console for Intrusion Databases (ACID) project. This application provides a web front-end to query and analyze the alerts coming from a SNORT IDS system. BASE is a web interface to perform analysis of...


Platforms: *nix

ipaudit-web logs network activity, maintains traffic summaries, and presents Web-accessible graphs and reports. ipaudit-web logs network activity, maintains traffic summaries, and presents Web-accessible graphs and reports. It is useful for identifying heavy bandwidth users, DoS attacks, and...


Platforms: *nix

Streamline is a high-speed networking subsystem for commodity operating systems. It increases performance by moving processing tasks to the fastest location. Streamline supports in-kernel execution, but also dedicated hardware (NICs) and even remote machines. An implementation of Streamline for...


Platforms: *nix

fwsnort parses the rules files included in the snort intrusion detection system and builds an equivalent iptables ruleset for as many rules as possible. fwsnort accepts command line arguments to restrict processing to any particular class of snort rules such as "ddos", "backdoor", or...


Platforms: *nix

The Firewall Tester (FTester) is a tool designed for testing firewalls filtering policies and Intrusion Detection System (IDS) capabilities.The tool consists of two perl scripts, a packet injector (ftest) and the listening sniffer (ftestd). The first script injects custom packets, defined in...


Platforms: *nix

EasyIDS software is an easy to install intrusion detection system configured for Snort. Based upon Patrick Harpers Snort installation guide and modeled after the trixbox installation cd, EasyIDS is designed for the network security beginner with minimal Linux experience. Whats New in This...


Platforms: *nix

barnyard is a fast output system for Snort. The "generic" notes for putting this thing together are below. You can see here the short version. 1.) ./configure 2.) make 3.) make install 4.) Edit the included barnyard.conf with specific details for your system 5.) barnyard -? 7.) Have fun!...


Platforms: *nix

Hogwash Light BR is an Intrusion Prevention System that can filter packets directly in the layer 2 of the OSI model (so the machine doesnt need even an IP address). Detection of malicious/anomalous traffic is done by rules based in signatures, and the user can add more rules. It is an efficient...


Platforms: *nix

pynids is a python wrapper for libnids, a Network Intrusion Detection System library offering sniffing, IP defragmentation, TCP stream reassembly and TCP port scan detection. Let your own python routines examine (or kill) network links. pynids is free software, licensed under the GPL. To...


Platforms: *nix

LEAF Bering-uClibc is the successor of the Bering distribution. Replacing glibc with uClibc a significantly smaller distribution is possible. All packages are ipv6-ready and based on the latest sources. It also provides a new and enhanced package management. LEAF Bering-uClibc is available for...


Platforms: *nix

Libnids is an implementation of an E-component of Network Intrusion Detection System. It emulates the IP stack of Linux 2.0.x. Libnids offers IP defragmentation, TCP stream assembly and TCP port scan detection. The most valuable feature of libnids is reliability. A number of tests were...


Platforms: *nix

ImSafe (Immune Security For your Enterprise) is a host-based intrusion detection tool. After a learning phase, it is able to detect changes in processes behavior, to detect buffer overflows, etc. It is implemented through a device driver (as a kernel patch) for the Linux kernel, but can also be...


Platforms: *nix

Udp Client Sever is a useful network utility for testing network programs, network services, firewalls and intrusion detection systems. Udp Client Sever can also be used for debugging network programs and configuring other network tools. The tool can work as a Udp client and Udp server, send and...


Platforms: Windows

Samhain is a multiplatform, open source solution for centralized file integrity checking / host-based intrusion detection on POSIX systems (Unix, Linux, Cygwin/Windows). samhain project has been designed to monitor multiple hosts with potentially different operating systems from a central...


Platforms: *nix

SID-IDS is a host intrusion detection system. Shell/PTY Intrusion Detection: Aims at detecting unwanted PTY action on UNIX systems. SID-IDS is a Host Intrusion Detection System. Consists of a kernel part and a user part. The kernel part plugs into terminal processing subsystem and logs hashed...


Platforms: *nix

Devialog is a behavior/anomaly-based syslog intrusion detection system which detectsattacks via anomalies in syslog. Present log-based IDS: Nearly all present log-based intrusion detection systems operate using a pre-defined known signature base, usually painstakingly created by hand. They...


Platforms: *nix

SIDEN is a distributed network discovery tool used for intrusion detection research. The current SIDEN architecture allows you to simulate coordinated/distributed network probes by a group of attackers. SIDEN has been tested successfully on the OpenBSD and FreeBSD operating systems. If you try...


Platforms: *nix