Open Source OpenBSD Networking Software

Pandora OPEN is a high-performance, 100% open-source monitoring ecosystem, born as the independent evolution of the Pandora FMS community branch after version 777. Licensed under GPLv2, it provides a modular and sovereign platform for supervising networks, servers, and applications without commercial dependencies. It features multi-platform agents, remote monitoring (SNMP, WMI, HTTP), GIS maps, and advanced visual dashboards. Entirely maintained by the community on GitHub, it ensures total transparency, technical flexibility, and absolute freedom for system administrators.

Conky is a free, light-weight system monitor for X, that displays any kind of information on your desktop. Conky is free software and runs in X on Linux and BSD. Originally a fork of Torsmo, Conky's torsmo-based code is BSD licensed. New code in Conky has been licensed under GPL 3.0. Since its inception, Conky has changed significantly from its predecessor, while maintaining simplicity and configurability. Conky can display just about anything, either on your root desktop, in its own window. Not only does Conky have many built-in objects, it can also display just about any piece of information by using scripts and other external programs. A plethora of OS stats (uname, uptime, CPU usage, mem usage, disk usage, "top" like process stats, and network monitoring, just to name a few). Conky can display information either as text, or using simple progress bars and graph widgets, with different fonts and colours.

Ganglia is a scalable distributed monitoring system for high-performance computing systems such as clusters and Grids. It is based on a hierarchical design targeted at federations of clusters. Supports clusters up to 2000 nodes in size.

*** This project moved to Github *** https://github.com/phaag/nfdump However, you may want to download older versions from here. nfdump is a set of tools to collect and process netflow data. It's fast and has a powerful filter pcap like syntax. It supports netflow versions v1, v5, v7, v9 and IPFIX as well as a limited set of sflow. It includes support for CISCO ASA (NSEL) and CISCO NAT (NEL) devices, which export event logging records as v9 flows. nfdump is fully IPv6 compatible.

Siproxd is a proxy/masquerading daemon for the SIP protocol. It allows SIP clients (softphones & hardphones) to work behind an IP masquerading firewall or router.

libivykis is a thin wrapper over various OS'es implementation of I/O readiness notification facilities (such as poll(2), kqueue(2)) and is mainly intended for writing portable high-performance network servers.

This shell script prints short and uniform information about OS such as: CPU, RAM, OS name and version, kernel version, hostname, system load, current processes, network interfaces, total logged in users, hard disks, runlevel, etc. No root or any special superuser's rights are required. Runs under Linux, Android (Termux), Windows (Msys2 and Cygwin), FreeBSD, NetBSD, DragonFly BSD, OpenBSD and other Unix-like systems.

Hyenae is a highly flexible platform independent network packet generator. It allows you to reproduce several MITM, DoS and DDoS attack scenarios, comes with a clusterable remote daemon and an interactive attack assistant. *** Hyenae is back *** Hyenae will be continued here: https://sourceforge.net/p/hyenae-ng

Dibbler is a portable DHCPv6 implementation. Is supports stateful (i.e. IPv6 address granting) as well as stateless (i.e. option granting) autoconfiguration for IPv6. Linux 2.4/2.6/3.0, Windows XP/2003/Vista/7/8 (experimental for NT4/2000), Mac OS X, FreeBSD, NetBSD and OpenBSD.

Bandwidth Monitor NG is a small and console-based live network and disk-io bandwidth monitor for Linux, BSD, Solaris, Mac OS X and others. features: output of KB/s, Kb/s, packets, errors, average, max and total sum; in curses, plain console, CSV or HTML MOVED TO: https://github.com/vgropp/bwm-ng

Gobbler: A tool to audit DHCP networks Includes DHCP rogue server detection, DHCP DoS, distributed spoofed port scanner using DHCP to obtain many source IP addresses, mulitple arp scans, filtered port detection, spoofed OS detection (nmap + port 0)

The WendzelNNTPd is a IPv6-ready NNTP usenet-server with the main goal to be as easy to use as possible. It is portable (Linux/*BSD/*nix), supports AUTHINFO authentication, contains ACL as well as role based ACL and supports invisible newsgroups. It currently supports MySQL and SQLite backends.

A portable, modular and efficient ftp server, supporting SSL, IPv6, UTF-8 compliant, multithreaded, modules ,externals scripts. unix-like permissions+acls, virtual users/groups, security, speed, bandwith limitation (user,group,global), group admins, per

The program thrulay is used to measure the capacity, delay, and other performance metrics of a network by sending a bulk TCP or UDP stream over it.

The Neighbor Discovery Protocol Monitor (NDPMon) is used by Internet Protocol version 6 network administrators for monitoring ICMPv6 packets. NDPMon observes the local network for anomalies in the function of nodes using Neighbor Discovery Protocol (NDP) messages, especially during the Stateless Address Autoconfiguration. When an NDP message is flagged, it notifies the administrator by writing to the syslog or by sending an email report. It may also execute a user-defined script. For IPv6, NDPMon is an equivalent of Arpwatch for IPv4, and has similar basic features with added attacks detection. NDPMon also maintains up-to-date a list of neighbors on the link and watches all advertisements and changes. It permits to track the usage of cryptographically generated interface identifiers or temporary global addresses when Privacy extensions are enable (default behavior in Ubuntu and Windows for example).

Jnettop allows administrators of routers to watch online traffic coming across the network in a fashion similar to the way top displays statistics about processes. It is useful for quickly evaluating the state of the network.

Intrusion detection / "sticky" honey pot technology using virtual servers to detect and trap worms, hackers, and other malware. ***Historical use only - Active Development stopped***

"TKMsense" an easy to use secure OpenBSD based firewall distribution. TKMsense's main goal is to blend ease of use and security. While still being friendly to the beginner. Full source code https://sourceforge.net/projects/tkmsense/files/TKMsense_Source_Code/ TKMsense versions 1. ISO-this file is meant to be burned to a CD/DVD or to install into a hypervisor's vm x86_64 bit https://sourceforge.net/projects/tkmsense/files/TKMsense_V0.0.4/amd64/TKMsense_0.0.4_amd64.iso/download x86_32 bit https://sourceforge.net/projects/tkmsense/files/TKMsense_V0.0.4/i386/TKMsense_0.0.4_i386.iso/download Important note "TKMsense only helps with networking settings. not initial installation."

CompactBSD is a powerful set of tools that allow you to build your own customized, lightweight distribution of OpenBSD and then burn it onto compact flash so that it can be run on an embedded PC platform such as FatPort's FatPoint (www.fatport.com)

Simple and secure TCP Proxy daemon. Refuses to run as root and confines itself to a chroot jail. Careful with signal handlers and buffers.

Snort2Pf is a small Perl daemon which greps Snort's alertfile and blocks the "naughty" hosts for a given amount of time using pfctl.

Open source firewall project for Unix systems

Flexible web-based firewall log analyzer, supporting netfilter and ipfilter, ipfw, ipchains, cisco routers and Windows XP system logs, and mysql or postgresql database logs using the iptables ULOG or NFLOG target of netfilter others mapped to the ulogd format with a view. Fully supports IPv6 for database logs, and netfilter and ipfilter system file logs. Also supports Maxmind's GeoIP version 2 location databases. For Linux, FreeBSD, OpenBSD, Solaris, OSX,etc.

Hogwash is an inline packet scrubber that uses Snort's (www.snort.org) detection engine to drop malicious packets before they reach the target machine.

Plushs allows a user to resolve the names of a single IP address or entire network of addresses to maintain a "map" of the names that comprise a certain network.