Search Results for "intrusion and detection and system" - Page 3

Intrusion Block (IBlock) is a small Linux daemon which greps the alertfile of an IDS such as Snort or Suricata and blocks the offender hosts for a given amount of time using iptables.

DogoIDS is an open-source active-probing-based network intrusion detection system (AP-NIDS) for wireless multihop networks (MANETs, Wireless Mesh Networks, Sensor Networks, etc). At this stage, DogoIDS only support the IEEE 802.11s standard for Wireless Mesh Networks. DogoIDS is now under construction in a very early stage and mainly for research purposes. However, we aim to release a stable version ready for production soon. *** IMPORTANT *** We uploaded the very first experimental...

It is an easy and handy way for home or small offices where nowadays we have many hosts (pcs, routers, smartphones, NAS, media centers, wi-fi intruders, etc) and we want to know what is up and interact with them. This was born as many others from my need to turn on/off a computer in another room or see what is up before going to bed or be alerted by some intrusion in my local net via wi-fi. It needs a lot of improvements and I hope the community can help. New hosts are discovered via /etc/hosts...

NetDash is a network dashboard and intrusion detection system. NetDash passively collects network traffic and then stores key information to be analyzed for unwanted network activity. NetDash captures all traffic passed over the network and stores that traffic in a PCAP file that can be downloaded and analyzed with other tools such as Wireshark. NetDash processes each PCAP file and stores relevant information about each packet captured in a MySQL database. Loaded NetDash plugins display...

..., NDPMon is an equivalent of Arpwatch for IPv4, and has similar basic features with added attacks detection. NDPMon also maintains up-to-date a list of neighbors on the link and watches all advertisements and changes. It permits to track the usage of cryptographically generated interface identifiers or temporary global addresses when Privacy extensions are enable (default behavior in Ubuntu and Windows for example).

Insidias is a next-generation intrusion detection engine, with a focus on speed, efficiency, advanced pattern matching, parallel-processing, modularity, and expandability.

The Kernel Intrusion Detection System-KIDS, is a Network IDS, where the main part, packets grab/string match, is running at kernelspace, with a hook of Netfilter Framework. The project is not ready for use, then incomplete pieces of code may be found.

arphaxad is a tool providing fast subnet arp-request based scanning. It is also able to isolate a specific host (just by passing the option -p <ip addr>) from the Ethernet-based network.

sktrap (script kiddies trap) is a tiny intrusion detection system. Installed on the monitor server, it runs tests via ssh on its clients. Cracks very visible (files,open ports). Built in reply to and very succesful in finding real-world break-ins.

A command line tool that allows you to (live) analyze netfilter (iptables) log files. It provides a nice output and has features like displaying hostnames, duplicate detection... More info (+ screenshots) can be found in the pdf inside the tarball.

HLBR is an IPS (Intrusion Prevention System) that can filter packets in the OSI layer 2. Detection of malicious traffic is done by rules. It can even be used as bridge to honeypots. The HLBR is a firewall element and can use regular expressions. Warning: this project was discontinued and should not be used in production networks. There are several bugs.

Hosting exploit/backdoor detection daemon.It's written in python , and uses inotify (pyinotify) to monitor file system activity.It checks files smaller then some size,compares their md5sum and hex signatures against DBs with known exploits/backdoor.

Hyenae is a highly flexible platform independent network packet generator. It allows you to reproduce several MITM, DoS and DDoS attack scenarios, comes with a clusterable remote daemon and an interactive attack assistant. *** Hyenae is back *** Hyenae will be continued here: https://sourceforge.net/p/hyenae-ng

The System for Modular Analysis and Continuous Queries (SMACQ) is a modular platform for analyzing and querying large datasets, including streaming network data, using features from databases, UNIX pipelines, and modular intrusion detection systems.

SNMP-based system for Outliers Detection .Network topology discovery, Real time monitoring of router load statistics, providing alerts for outlier samples and graphs.

This is an NIDS/HIDS, Network plus Host based Intrusion Detection System. Este é um NIDS / HIDS, Sistema de Detecção de Invasões Baseado em Redes e em Máquinas.

inundator is a tool used to anonymously inundate intrusion detection logs with false positives to obfuscate a real attack, leaving the IDS analyst feeling completely inundated.

Tiet reads pcap(3) or argus(8) routing protocol traces (ISIS for now) and analyzes the protocol state/behavior. The obtained metrics & graphics can by used for many auditing tasks, e.g. detection of misconfiguration, bugs or performance problems.

Libnids - NIDS E-component, based on Linux kernel. This library provides IP defragmentation, TCP reassembly and port scan detection.

Ourmon is a network monitoring and anomaly detection system and displays the data for multiple BPF expressions via RRDTOOL-based graphs. It also helps the user identify various kinds of network anomalies using various flow analysis tools and logging.

BASE is the Basic Analysis and Security Engine. It is based on the code from the Analysis Console for Intrusion Databases (ACID) project. This application provides a web front-end to query and analyze the alerts coming from a SNORT IDS system.

Core Balance is a simple TCP Load Balancing proxy designed to balance connections based on node speed and number of cores. The design was intended to balance a distcc cluster. It features a status report in HTTP and an interactive mode.

PACtory is a highly customizable way for handling proxy configuration settings with a dynamically created .pac-File, also known as "Windows Proxy Auto Detection" or "wpad.dat"-File, which is generated on the fly while the client is requesting it.

Packetloss is a set of programs to detect packet losses in UDP and TCP between two hosts. It does this by sending a continuous stream of packets, and detects any delay or loss in the streams. It is useful to measure the impact of failover tests.

AutoScan-Network is an application designed to explore and to manage your network. Entire subnets can be scanned simultaneously without human intervention. It features OS detection, automatic network discovery, VNC Client, Ssh client