Open Source Python Networking Software

Fail2Ban monitors log files like /var/log/pwdfail or /var/log/apache/error_log and bans failure-prone addresses. It updates firewall rules to reject the IP address or executes user defined commands. Please see code and download from https://github.com/fail2ban/fail2ban . SF Fail2ban portal might not be up-to-date

justniffer is a TCP sniffer. It reassembles and reorders packets and displays the tcp flow in a customizable way. It can log network traffic in web server log format. It can also log network services performances (e.g. web server response times) and extract http content (images, html, scripts, etc)

BlueLogger is built using the Python programming language in order to monitor for Bluetooth devices nearby. The application can log the "Time", "Device Name" and "Device Address" of each discovered device.

VScan is a small, text-based, platform independent port scanner written in python, which supports multithreading and banner grabbing.

This project offers a client/server tool to analyze the /var/log/auth.log in order to gather information about the login attempts. The information is sent to a server side where the datas are stored in a sqlite database.

DPytHOS is a means for administrators of large networks to both monitor and manage the servers under their control. DPytHOS is implemented in python and uses a generic database back-end (with MySQL supported and MS-SQL 2000 supported via XML)

TL;DR Version: I wrote a tool called GIPC (short for Geographical IP Correlation and pronounced Gypsy) which takes a list of IP address and returns the Geographical information you select based on the MaxMind.com GeoCity Database. The exe requires 2 inputs: The IP file (one IP per line) MaxMind GeoCity database – This can be downloaded HERE:http://geolite.maxmind.com/download/geoip/database/GeoLiteCity.dat.gz Please read more on my blog: http://jcsocal.blogspot.com/2013/03/geographical-ip-correlation-tool.html

Insidias is a next-generation intrusion detection engine, with a focus on speed, efficiency, advanced pattern matching, parallel-processing, modularity, and expandability.

Kismon is a PyGTK based Kismet Newcore (since 2009-05-RC1) Client with a live map of the networks.

Kojoney is an easy of use, secure, robust and powerfull Honeypot for the SSH Service written in Python. With the kojoney daemon are distributeds other tools such as kip2country (IP to Country) and kojreport, a tool to generate reports from the log fi

A command line tool that allows you to (live) analyze netfilter (iptables) log files. It provides a nice output and has features like displaying hostnames, duplicate detection... More info (+ screenshots) can be found in the pdf inside the tarball.

Loganalyzer for Windows XP Firewall and Linux Iptables firewall. Generates a nice html document with statistics from all the pakets captured by the firewall. The program is written in Python and has an (optional) graphical interface.

Nuhe is a log monitoring system, which is capable of alarm generation and action when rules are matched against log(s) activity.

Nuhe Client is a project related to the Nuhe Action Capable Log Monitor. This GUI client simplifies the administration of sensors and node managers, making it easier to control and monitor the network. Comes with a rule editor as well as a log monitor.

OpenPavilion is a free surveillance suite made for observing, monitoring and benchmarking your applications and networks. OpenPavilion displays comprehensive relationships using simple to understand dashboard views.

An ARP watch daemon for windows (portable to linux but it is already there...) which is able to be run as a service and logs to eventlog so one can collect the logs and react to events.

Retrieve statistics from SNMP-aware devices, store them in a database and graphically display them for monitoring and notification purposes.

PotHead What is it? Pothead: A simple lightweight packet for creating a minimal interaction honeypot How does it work? Magic, Well kinda you don’t need super dupper knowledge to use this! Oops the magic failed ;) a really nice INSTALL.md will be written unfortunately it’s not yet available. 1) Download all the files 2) Check if you got everything 3) Upload and configure the Website and backend (includes/Config.php & the .SQL files) 4) Do not forget to change your APIKEY! 5) Run the python file! Pothead.py -pp 22 23 -site http://YOURSITE.COM/api/write.php -apikey YOURAPIKEY 6) Profit! Is this for anyone? Hmmmm, yes and no I would suggest you know a thing or two about PHP & Python. It’s a pre-release and still in the early alpha stage. Is it safe? It’s pretty safe ;) Does it work? Yeah check it live! http://7ol.eu/view.php

PyIDS is an intrusion detection system whose aim is to provide concise information to administrators about some parts of the system i.e filesystem checksums, unknown connections to the machine, access control lists of special files, log revision...

Open Source system and network monitoring application for desktop Linux user. It gives end-user broader view of what happening on their system. The basic idea is give linux user application that can monitor system like many commercial antivirus HIDS.

RRFiller provides an easy-to-use solution for logging statistics into an RRDTool database. Designed to complement RRGrapher, the project also provides configurations for creation and updating RRD databases using standard tools like vmstat and netstat.

The Secure Remote Log Monitor (SRLM) project provides client and server utilities that collect application or system log files from multiple systems over an untrusted network onto a central server for analysis and action.

Shadow Watcher is a Peer to Peer log sharing tool for the security analyst. Consider it a "community watch" program which allows you to keep your system secure from the threats on the internet and help others do the same.

Snort IDS library for Python

Syslog Collector listen for syslog messages and parse them following some regular expressions. It then increment some counters which are exposed through SNMP Agent-X interface