Performance Co-Pilot (PCP) is a framework and set of services for supporting system-level performance monitoring and performance management. It provides a unifying abstraction for all of the interesting performance data in a system, and allows client applications to easily retrieve and process any subset of that data using a single API. A client-server architecture allows multiple clients to monitor the same host, and a single client to monitor multiple hosts. Archive logging and replay are integrated so that a client application can use the same API to process real-time data from a host or historical data from an archive.
NetXMS is a network monitoring and management system with a modular architecture. It can be used for monitoring an entire IT infrastructure, starting with SNMP-capable hardware (like switches and routers) and ending with applications on servers. The system has a three-tier architecture; the information is collected by monitoring agents (either its own agents or SNMP agents) and delivered to the monitoring server for processing and storing, where it can be accessed by using the management console. It features centralized configuration and centralized agent upgrades.
PasTmon (Passive Application Response Time Monitor) passively monitors your application servers, measuring and reporting user response times, throughput and congestion. It currently works with HTTP, telnet, rlogin, rsh, FTP (control channel), SMTP, POP3, and IRC. Measurements are recorded in a PostgreSQL database and are presented graphically via a PHP Web front-end using R statistical analysis scripts to create the plots.
Endian Firewall is an all-in-on Linux security distribution that turns any system into a full-featured security appliance. It features a stateful packet inspection firewall, application-level proxies for various protocols (HTTP, POP3, SMTP), anti-virus support, virus and spam filtering for email traffic (POP and SMTP), content filtering of Web traffic, and a "hassle free" VPN system based on OpenVPN.
Observium is an autodiscovering network monitoring system focused primarily on Cisco and Linux networks but includes support for a wide range of network hardware and operating systems. Observium has grown out of a lack of easy to use NMSes. It is intended to provide a more navigable interface to the health and performance of your network. Its design goals include collecting as much historical data about devices as possible, being completely autodiscovered with little or no manual intervention, and having a very intuitive interface.
fwknop implements an authorization scheme called Single Packet Authorization that requires only a single encrypted packet to communicate various pieces of information, including desired access through an iptables, ipfw, or pf firewall policy and/or specific commands to execute on the target system. The main application of this program is to protect services such as SSH with an additional layer of security in order to make the exploitation of vulnerabilities much more difficult. The authorization server works by passively monitoring authorization packets via libpcap. Also supported is a robust port knocking implementation based around iptables log messages.
The Port Scan Attack Detector (psad) is a collection of three system daemons that are designed to work with the Linux iptables firewalling code to detect port scans and other suspect traffic. It features a set of highly configurable danger thresholds (with sensible defaults), verbose alert messages, email alerting, DShield reporting, and automatic blocking of offending IP addresses. Psad incorporates many of the packet signatures included in Snort to detect various kinds of suspicious scans, and implements the same passive OS fingerprinting algorithm used by p0f.