Open Source Networking Software

OSSIM, AlienVault’s Open Source Security Information and Event Management (SIEM) product, provides event collection, normalization and correlation. For more advanced functionality, AlienVault Unified Security Management (USM) builds on OSSIM with these additional capabilities: * Log management * Advanced threat detection with a continuously updated library of pre-built correlation rules * Actionable threat intelligence updates from AlienVault Labs Security Research Team * Rich analytics dashboards and data visualization

Simple Event Correlator (SEC) is a lightweight event correlator for network management, log file monitoring, security management, fraud detection, and other tasks which involve event correlation.

The pimped Apache status makes the Apache server status readable, sortable and searchable. The pimped Apache status can merge the status of several servers that opens the possibility to identify the troubleshooter even in a loadbalanced website. The webbased tool offers a multilanguage, skinable interface with a built-in updater. In several views you see most requested pages, vhosts, used methods, IPs that make the most requests and more. All views are sortable tables you can filter by a keyword and are available as API Request too to get its data as CSV, XML or JSON. Compatible with PHP 7+8 (and should run on PHP 5.x - but is not supported).

this tool tries to repair your broken pcap and pcapng files by fixing the global header respectively packet blocks and recovering the packets by searching und guessing the packet headers or blocks

SIGOF (Security Information Graphics Oriented Forensic) aims at synthetizing security log, stored in a acid/base database schema, in order to provide a graphical / visual oriented security forensic and statistical analysis.

The first stage of development is do write a tool to anonymize packet capture files captured with libpcap. After that we will be integrating this with tcpdump to anonymize in real-time and analyze and look for its effect on different IDS's.

DNA is an open, flexible and extensible deep network analyzer software server and software architecture for gathering and analyzing network packets, network sessions and applications protocols, passively off enterprise class networks.

Ida, is a Apache log security analyzer written in PHP. It will scan Apache logs and report about security incidents like SQL injections, XSS attacks, path traveling and so on.

ATTENTION: Snare Lite is unsupported legacy software. While it will remain a part of the SourceForge community, it is no longer secure and compliant. For up to date Snare software check out Snare Enterprise. https://www.snaresolutions.com/try-snare-for-free/ Snare Enterprise was created to keep up with the fast paced security software market. It started with the desire to create premium logging and SIEM tools that were agnostic by nature so they could be used to boost any SIEM architecture regardless of third party developers. In fact, the agnostic nature allows it to bridge gaps between multiple SIEM implementations across business units. For more on use cases, check out the Intersect Alliance website. https://www.snaresolutions.com/ Snare Enterprise’s premium features include: - Regulatory Compliance - TLS Encryption - Log Simulcasting - TCP – Guaranteed Log Delivery - USB Device Monitoring - And more! For updates follow us on social media!

Application to display, as well as interpret, firewall information from a database to serve a variety of users needs. The application is online and cross-platform, written using PHP.

PERL script and required environment to easily use the Afterglow software (http://afterglow.sourceforge.net/ Copyright (c) 2006 Raffael Marty) by listing the packet captures to visualize or by specifying a directory that contains the packet captures.

Capra is a Open Source tool to quickly get some nice and useful reports out off your Watchguard Fireware log files.

IP traffic accounting on CISCO routers.

Cisco Perl Tools contains CIPAT (Cisco IP Accounting aggregator) and ISDN-Reporter (Cisco ISDN call aggregation and reporting tool). [NetProvisioning has moved to its own project page on SF]

Cislog is a syslog server that specifically targets Cisco devices and their implementation of the syslog protocol. It consists of a Django web interface and a syslog listener with a database between them.

The Distributed Intrusion Detection System.

Experimental Hybrid Intrusion Detection System written in Java

FwPlatinum provides real time data analysis of CheckPoint FireWall-1 connection logs. Data is stored for up to 2 years, and is accessed by CGI generated graphs which can drill down to the specific time that you are interested in.

GALProxy is a multithread proxy server written in java. It can elaborate all upcoming requests from most common browsers. It can be used in a LAN in order to concur the sharing of an Internet connection; it implements local caching, content filtering an

imsniff is a pcap-based instant messaging sniffer. It captures the IM traffic in the network and is able to log conversations, contact lists, profile information, incoming email notifications, other MSN events, etc. Tested in Linux and Windows.

IPHPLog (IP PHP Log) is a simple software written in PHP, JS and SQL that runs over a MySQL database manager system . IPHPLog can log the information of your visitors and organize that on a data base with GeoIP.

JNFA - is a netflow analyzer. It uses MySQL database to store accounting information. Filters, used in the JNFA, allows very flexible classificate any kind of traffic and store it in the differend fields in database.

Java and ColdFusion libraries to lookup country code and language from IP address. It uses a local copy of the WHOIS database to perform fast, accurate lookups of country codes. Useful for log analysis, internationalization, geolocation, etc..

Kojoney is an easy of use, secure, robust and powerfull Honeypot for the SSH Service written in Python. With the kojoney daemon are distributeds other tools such as kip2country (IP to Country) and kojreport, a tool to generate reports from the log fi