Free linux intrusion detection system software for linux

Dynamic Taste Detection patch makes XMMS adapt its playlist randomization function to your personal taste.

Songs you dont like end up at the end of the playlist, and songs you like to hear together tend to end up next to each other.

ARPSpoofDetector performs active and passive detection of ARP spoofing and IP (IPv4) address collision. The program can send healing packets with regular ARP information.
ARPSpoofDetector is new GPL project initialized by NetMasters.CZ customers (specially 100MEGA Distribution). We didnt find suitable intrusion detection system or another applicable software to solve ARP spoofing detection and IP collision without false alarms and with easy configuration for our customers.
Main features:
- passive ARP spoofing detection from broadcast ARP reply packets
- passive IP collision detection from broadcast ARP packets and netbios packets
- active IP collision detection by sending ARP request packets
Log example:
Mon Jul 23 21:49:26 2007
Warning: IP 192.168.1.10 collision detected!
SERVER MAC address: 00:4f:ED:7C:3A:B9
ATTACKER MAC address: 00:20:38:7C:3A:CE
Attacker NETBIOS name: PERSEUS
Attacker NETBIOS group: WORKGROUP
Last attacker IP was 192.168.1.9
IP changes history:
From: Mon Jul 23 21:48:47 2007 To: Mon Jul 23 21:49:10 2007 was IP 192.168.1.3 (maybe over DHCP)
From: Mon Jul 23 21:49:10 2007 To: Mon Jul 23 21:49:26 2007 was IP 192.168.1.6 (maybe over DHCP)

The Firewall Tester (FTester) is a tool designed for testing firewalls filtering policies and Intrusion Detection System (IDS) capabilities.The tool consists of two perl scripts, a packet injector (ftest) and the listening sniffer (ftestd). The first script injects custom packets, defined in ftest.conf, with a signature in the data part while the sniffer listens for such marked packets. The scripts both write a log file which is in the same form for both scripts. A diff of the two produced files (ftest.log and ftestd.log) shows the packets that were unable to reach the sniffer due to filtering rules if these two scripts are ran on hosts placed on two different sides of a firewall. Stateful inspection firewalls are handled with the connection spoofing option. A script called freport is also available for automatically write to log files.
Of course this is not an automated process, ftest.conf must be crafted for every different situation. Examples and rules are included in the attached configuration file.
The IDS (Intrusion Detection System) testing feature can be used either with ftest only or with the additional support of ftestd for handling stateful inspection IDS, ftest can also use common IDS evasion techniques. Instead of using the configuration syntax currently the script can also process snort rule definition file.
These two scripts were written because I was tired of doing this by hand (with packet-crafting tools and tcpdump), I know that there are at least two dozens of other methods to do this but another reason was to learn some perl ;). I hope that you enjoy them.
Main features:
- firewall testing
- IDS testing
- simulation of real tcp connections for stateful inspection firewalls and IDS
- connection spoofing
- IP fragmentation / TCP segmentation
- IDS evasion techniques

The Community Edition of EnGarde Secure Linux was designed to support features suitable for individuals, students, security enthusiasts, and those wishing to evaluate the level of security and ease of management available in Guardian Digital enterprise products.
EnGarde Community Editions development is very much driven by not only the requests from the community, but also their continued participation.
The Community Edition is a dynamic, rapidly-evolving product that serves to exhibit the best-of-breed applications currently under development.
Guardian Digital enterprise products provide greater levels of support, support for more advanced hardware, more sophisticated upgrade path, and features more suitable for enterprises, including support for our other enterprise applications.
Main features:
- Simple and Secure Remote Administration
- Powerful Host Intrusion Detection
- Secure Network Services
- Built-in Support and Alerts
- Robust Network Intrusion Detection
- Quick and Secure Web, DNS email, FTP
- Network Gateway Firewall
- Monitor System Access
- Protect Against Data Loss
- Security Control Center
- Engineered to be Secure
- Significantly Reduces Support Costs

SIDEN is a distributed network discovery tool used for intrusion detection research. The current SIDEN architecture allows you to simulate coordinated/distributed network probes by a group of attackers.

SIDEN has been tested successfully on the OpenBSD and FreeBSD operating systems. If you try SIDEN and it works on any other platform, please contact me. Yes, it sounds interesting that I havent even tested it out on the popular Linux platform. There should be little reason why it wont work on other platforms (especially UNIX variants), since its fully implemented in Perl.