Open Source Python Network Monitoring Software for Linux

justniffer is a TCP sniffer. It reassembles and reorders packets and displays the tcp flow in a customizable way. It can log network traffic in web server log format. It can also log network services performances (e.g. web server response times) and extract http content (images, html, scripts, etc)

Snort IDS library for Python

VScan is a small, text-based, platform independent port scanner written in python, which supports multithreading and banner grabbing.

This project offers a client/server tool to analyze the /var/log/auth.log in order to gather information about the login attempts. The information is sent to a server side where the datas are stored in a sqlite database.

BlueLogger is built using the Python programming language in order to monitor for Bluetooth devices nearby. The application can log the "Time", "Device Name" and "Device Address" of each discovered device.

DPytHOS is a means for administrators of large networks to both monitor and manage the servers under their control. DPytHOS is implemented in python and uses a generic database back-end (with MySQL supported and MS-SQL 2000 supported via XML)

Insidias is a next-generation intrusion detection engine, with a focus on speed, efficiency, advanced pattern matching, parallel-processing, modularity, and expandability.

Kismon is a PyGTK based Kismet Newcore (since 2009-05-RC1) Client with a live map of the networks.

Kojoney is an easy of use, secure, robust and powerfull Honeypot for the SSH Service written in Python. With the kojoney daemon are distributeds other tools such as kip2country (IP to Country) and kojreport, a tool to generate reports from the log fi

A command line tool that allows you to (live) analyze netfilter (iptables) log files. It provides a nice output and has features like displaying hostnames, duplicate detection... More info (+ screenshots) can be found in the pdf inside the tarball.

Nuhe is a log monitoring system, which is capable of alarm generation and action when rules are matched against log(s) activity.

Nuhe Client is a project related to the Nuhe Action Capable Log Monitor. This GUI client simplifies the administration of sensors and node managers, making it easier to control and monitor the network. Comes with a rule editor as well as a log monitor.

An ARP watch daemon for windows (portable to linux but it is already there...) which is able to be run as a service and logs to eventlog so one can collect the logs and react to events.

PotHead What is it? Pothead: A simple lightweight packet for creating a minimal interaction honeypot How does it work? Magic, Well kinda you don’t need super dupper knowledge to use this! Oops the magic failed ;) a really nice INSTALL.md will be written unfortunately it’s not yet available. 1) Download all the files 2) Check if you got everything 3) Upload and configure the Website and backend (includes/Config.php & the .SQL files) 4) Do not forget to change your APIKEY! 5) Run the python file! Pothead.py -pp 22 23 -site http://YOURSITE.COM/api/write.php -apikey YOURAPIKEY 6) Profit! Is this for anyone? Hmmmm, yes and no I would suggest you know a thing or two about PHP & Python. It’s a pre-release and still in the early alpha stage. Is it safe? It’s pretty safe ;) Does it work? Yeah check it live! http://7ol.eu/view.php

PyIDS is an intrusion detection system whose aim is to provide concise information to administrators about some parts of the system i.e filesystem checksums, unknown connections to the machine, access control lists of special files, log revision...

Open Source system and network monitoring application for desktop Linux user. It gives end-user broader view of what happening on their system. The basic idea is give linux user application that can monitor system like many commercial antivirus HIDS.

RRFiller provides an easy-to-use solution for logging statistics into an RRDTool database. Designed to complement RRGrapher, the project also provides configurations for creation and updating RRD databases using standard tools like vmstat and netstat.

Shadow Watcher is a Peer to Peer log sharing tool for the security analyst. Consider it a "community watch" program which allows you to keep your system secure from the threats on the internet and help others do the same.

Syslog Collector listen for syslog messages and parse them following some regular expressions. It then increment some counters which are exposed through SNMP Agent-X interface

Originally written by Paul Vixie in 1986 and distributed through mod.sources, "display" is a program which will repeatedly execute a command and display the output through curses. The purpose of this project is to maintain and extend display.

fwgraph is an attempt to characterize and present network traffic including network devices, QoS, and iptables under Linux.

Logpecker is a tool for syslog files like /var/log/messages. More flexible than a simple regexp matcher, you can use syslog facility and priority. Messages that appear too often are sieved out. Generates root-tail tickers, reports, active event lists

Moodss is a modular monitoring application, composed of a GUI and a daemon, which supports any device or process for which a module can be developed. Complete dashboards with graphical viewers, thresholds, SQL database archiving, ... can be managed.

Pymoodss is a multithreading python extension library for the moodss server monitoring system. Modules for mod_backhand, df, psgrep, ping, mdstat are avaible.

Netconsole2Mail is simple python based daemon that receives netconsole messages from kernel on configured hosts and sends them to administrator in configured pooling interval. Only new messages are sent.