Search Results for "data analysis"

Performance Co-Pilot (PCP) provides a framework and services to support system-level performance monitoring and management. It presents a unifying abstraction for all of the performance data in a system, and many tools for interrogating, retrieving and processing that data. PCP is a feature-rich, mature, extensible, cross-platform toolkit supporting both live and retrospective analysis. The distributed PCP architecture makes it especially useful for those seeking centralized monitoring of distributed processing.

this tool tries to repair your broken pcap and pcapng files by fixing the global header respectively packet blocks and recovering the packets by searching und guessing the packet headers or blocks

IPAC-NG is the iptables/ipchains based IP accounting package for Linux. It collects, summarizes, and nicely displays IP accounting data. Ipchains and (preferably) iptables are supported. Logs are stored in files, a gdbm or a PostgreSQL database.

Xplico is a Network Forensic Analysis Tool (NFAT). The goal of Xplico is extract from an internet traffic capture the applications data contained. For example, from a pcap file Xplico extracts each email (POP, IMAP, and SMTP protocols), all HTTP contents, each VoIP call (SIP, MGCP, MEGACO, RTP), IRC, WhatsApp... Xplico is able to classify more than 140 (application) protocols.

CapAnalysis is a web visual tool for information security specialists, system administrators and everyone who needs to analyze large amounts of captured network traffic. Analyze TCP and UDP streams Support multible datasets Perform deep packet inspection Support filtering capability Source Code: https://github.com/xplico/CapAnalysis

We implement an open source conflict resolution framework that consists of a user-space C application that automatically resolves firewall rules anomalies, and b) a generic tree (called policy tree), implemented as a Linux kernel module which maintains the resolved firewall rules and enables the necessary hooks to netfilter for matching incoming (or outgoing) network packets. Tree-based data structures offer improved efficiency compared to traditional access control lists (e.g. iptables or nftable maps), especially for large systems with a huge number of rules. Preliminary analysis from our implementation on ARM-based embedded systems examines efficiency and scalability of our framework. To reference this work: A. Papagrigoriou, P. ...

OSSIM, AlienVault’s Open Source Security Information and Event Management (SIEM) product, provides event collection, normalization and correlation. For more advanced functionality, AlienVault Unified Security Management (USM) builds on OSSIM with these additional capabilities: * Log management * Advanced threat detection with a continuously updated library of pre-built correlation rules * Actionable threat intelligence updates from AlienVault Labs Security Research Team * Rich...

bmon (Bandwidth Monitor) is a command-line network monitoring tool that provides detailed bandwidth statistics for network interfaces.

tcpflow captures data transmitted as part of TCP connections (flows), and stores data in a way that is convenient for protocol analysis or debugging. tcpflow understands TCP sequence numbers and will reconstruct data streams regardless of retransmissions.

SNMP Network Analysis and Presentation Package (SNAPP). Allows high speed SNMP data collection and visualization through a web based interface using a RRD data storage format.

The System for Modular Analysis and Continuous Queries (SMACQ) is a modular platform for analyzing and querying large datasets, including streaming network data, using features from databases, UNIX pipelines, and modular intrusion detection systems.

Ourmon is a network monitoring and anomaly detection system and displays the data for multiple BPF expressions via RRDTOOL-based graphs. It also helps the user identify various kinds of network anomalies using various flow analysis tools and logging.

Netdude, the NETwork DUmp data Displayer and Editor, is a visual and programmatical framework for inspection, analysis, and manipulation of tcpdump trace files.

Logpp is a tool for preprocessing event logs and feeding relevant data to other programs for storing or in-depth analysis. Logpp reads lines appended to input files, matches the lines with patterns, and writes the results to given destinations.

Cnc's IP Data Volume Report: Logs IP to IP contact, number of packets, bytes, time of contact, Ethernet too! View via local web interface. Very simple for those who want to view who your computer is contacting the most!

vSentinel is a customizable 3D mapping of your network monitoring or security data for real-time or trend-based attack and anomaly detection and analysis.

Universal IP-traffic collector. Can gather data from Cisco IP Accounting / ipcad, Mikrotik, NSG, Revolution routers.

Collector of the traffic on the basis of pcap-library. Data are aggregated and saved under the scheme "DetailHostMatrix Aggregation Schemes" Cisco NetFlow FlowCollector. Data are kept in the form of gzip-files or deduced in stdout.

High performance, real-time data analysis engine capable of processing from various sources simultaneously (syslog, files, sockets, etc). Triggers internal and user-defined events based on built-in and user-defined rules.

Netmon is a simple program for monitoring bandwidth and data usage on linux machines. It is useful for those with a broadband connections that pay for their data or have download limits.

APE is a testbed for evaluation of mobile ad hoc network routing protocols. It consists of a stripped down Red Hat Linux distribution, pre-configured for easy setup, and a set of analysis tools used to evaluate data from tests.

Track Attack is a system for analysing data contained in log files. Track Attack can process different types of log files in parallel so as to get a time-ordered view of how events unfolded.

Traffic accounting suite for Linux that comes with a webinterface written in PHP. Requires iptables, its ULOG target and MySQL for data storage. This system uses categories which are fed by iptable rules that can be defined using the webinterface.

RTG is a high-performance SNMP statistics monitoring system. Designed for service providers to collect large amounts of time-series SNMP data quickly. Data is inserted into a database to which RTG analysis, reporting and graphing applications interface

FAST library for storing and displaying various types of statistics. Rock stable and robust and well-designed image output.