Junkie is a real-time packet sniffer and analyzer. It is modular enough to accomplish many different tasks. It can be a helpful companion to the modern network administrator and analyst. Compared to previously available tools, junkie lies in between tcpdump and wireshark. Unlike tcpdump, its purpose is to parse protocols of any depth; unlike wireshark, though, it is designed to analyze traffic in real-time and so cannot parse traffic as exhaustively as wireshark does. In addition, its design encompasses extendability and speed. It has a plug-in system and high-level extension language that eases the development and combination of new functionalities; threaded packet capture and analysis for handling of high bandwidth networks; and a modular architecture to ease the addition of any protocol layer. It is based on libpcap for portability, and well-tested on professional settings.
Suricata is an Intrusion Detection and Prevention (IDS/IPS) engine developed by the Open Information Security Foundation and its supporting vendors. The engine is multi-threaded and has native IPv6 support, file extraction capabilities, and many more features. It's capable of loading existing Snort rules and signatures, and supports many frontends through Barnyard2.
Nova is a software application for preventing and detecting hostile network reconnaissance (such as nmap scans). It does this by first creating the Haystack: a large collection of low interaction honeypots using an updated version of Honeyd. Finding real machines on the network becomes like finding a needle in a haystack of fake machines. Second, Nova uses machine learning algorithms to automatically detect and classify attempts at hostile reconnaissance, so there's no need to go searching manually through your honeypot's log files. It provides an easy to use Web-based interface powered by Node.js to configure itself and Honeyd instances.
HOMER is a robust, carrier-grade, scalable SIP capturing system and monitoring application with hEP, IP Proto4 (IPIP) encapsulation, and port mirroring/monitoring support right out of the box, ready to process and store large amounts of signaling with instant searches, end-to-end analysis, and drill-down capabilities for ITSPs, VoIP providers, and trunk suppliers using SIP signaling.
Ostinato is a network packet and traffic generator and analyzer with a friendly GUI. It aims to be "Wireshark in Reverse" and thus become complementary to Wireshark. It features custom packet crafting with editing of any field for several protocols: Ethernet, 802.3, LLC SNAP, VLAN (with Q-in-Q), ARP, IPv4, IPv6, IP-in-IP a.k.a IP Tunneling, TCP, UDP, ICMPv4, ICMPv6, IGMP, MLD, HTTP, SIP, RTSP, NNTP, etc. It is useful for both functional and performance testing.
Multi Threaded TCP Port Scanner allows you to scan 65535 TCP ports on an IP address. You can specify how many threads to run and the timeout. Furthermore, it will tell you the MAC address of the target and the services that are running. You can scan IP addresses on your network and find out which open ports you have.
GraphInsight is visualization software that lets you explore graph data through high quality interactive representations. Data exploration and knowledge extraction from graphs is of great interest nowadays: knowledge is disseminated in social networks, and services are powered by cloud computing platforms. Data miners deal with graphs every day. Humans are extremely good at identifying patterns and outliers. Interacting visually with your data can give you better intuition and higher confidence in what you are looking for.
Xtract attempts to demonstrate how Wireshark's powerful network traffic analysis capabilities can be combined with the file carving capabilities of programs such as Foremost and NetworkMiner in a manner that is portable and extensible (hence the choice of Perl). Specifically, it offers automated extraction of network stream sessions; visualization of networks via GraphViz; and integration of file carving capability. The scripts are intended as a proof-of-concept for how tedious tasks of reassembling TCP/UDP streams from network capture files and file carving based on these streams can be automated.
MCL-edge is an integrated command-line driven workbench for large scale network analysis. It includes programs for the computation of shortest paths, diameter, clustering coefficient, betweenness centrality, and network shuffles. A module for loading and analyzing gene expression data as a network is provided. The MCL algorithm is a fast and highly scalable cluster algorithm for networks based on stochastic flow. The flow process employed by the algorithm is mathematically sound and intrinsically tied to cluster structure, which is revealed as the imprint left by the process. The threaded implementation has handled networks with millions of nodes within hours and is widely used in the fields of bioinformatics, graph clustering, and network analysis.