netflow port
Sponsored Links
Sponsored Links
Secleted [ 0 ] software to compare
Results 1 - 15 of about 1661
DB based NetFlow Collector 1.0
DB based NetFLow Collector aims to collect Cisco NetFlow data and store it to a database. more>>
DB based NetFLow Collector aims to collect Cisco NetFlow data and store it to a database.
DB based NetFlow Collector has a plugin interface, which makes it flexible for fitting in particular tasks.
Enhancements:
- First release. post your comments/bug reports.
<<lessDB based NetFlow Collector has a plugin interface, which makes it flexible for fitting in particular tasks.
Enhancements:
- First release. post your comments/bug reports.
Download (0.47MB)
Added: 2006-06-19 License: GPL (GNU General Public License) Price:
1231 downloads
flowd 0.9
flowd application is a fast, small and secure NetFlow collector. more>>
flowd application is a fast, small and secure NetFlow collector.
Main features:
- Understands NetFlow protocol v.1, v.5, v.7 and v.9 (including IPv6 flows)
- Supports both IPv4 and IPv6 transport of flows
- Secure: flowd is privilege separated to limit the impact of any compromise
- Supports filtering and tagging of flows, using a packet filter-like syntax
- Stores recorded flow data in a compact binary format which supports run-time choice over which flow fields are stored
- Ships with both Perl and Python interfaces for reading and parsing the on-disk record format
- Is licensed under a liberal BSD-like license
- Supports reception of flow export datagrams sent to multicast groups (IPv4 and IPv6), thereby allowing the construction of redundant flow collector systems
flowd works with any standard NetFlow exporter, including hardware devices (e.g. routers) or software flow tracking agents, such as my own softflowd and pfflowd. Please refer to the README for more information.
The flowd daemon follows the Unix philosophy of "doing one thing well" - it doesnt try to do anything beyond accepting NetFlow packets and storing them in a standard format on disk. In particular, it does not include support for storing flows in multiple formats or performing data analysis. That sort of thing is left to external tools. The source distribution includes several example tools including a basic reporting script and one to store flows in a SQL database.
Enhancements:
- This release includes major improvements to performance and functionality.
- In particular, the flow format has been modified to store more information and be faster to read, input and output buffering has been improved, new flow filtering options have been added, and the Python API has been rewritten and extended to be many times faster.
<<lessMain features:
- Understands NetFlow protocol v.1, v.5, v.7 and v.9 (including IPv6 flows)
- Supports both IPv4 and IPv6 transport of flows
- Secure: flowd is privilege separated to limit the impact of any compromise
- Supports filtering and tagging of flows, using a packet filter-like syntax
- Stores recorded flow data in a compact binary format which supports run-time choice over which flow fields are stored
- Ships with both Perl and Python interfaces for reading and parsing the on-disk record format
- Is licensed under a liberal BSD-like license
- Supports reception of flow export datagrams sent to multicast groups (IPv4 and IPv6), thereby allowing the construction of redundant flow collector systems
flowd works with any standard NetFlow exporter, including hardware devices (e.g. routers) or software flow tracking agents, such as my own softflowd and pfflowd. Please refer to the README for more information.
The flowd daemon follows the Unix philosophy of "doing one thing well" - it doesnt try to do anything beyond accepting NetFlow packets and storing them in a standard format on disk. In particular, it does not include support for storing flows in multiple formats or performing data analysis. That sort of thing is left to external tools. The source distribution includes several example tools including a basic reporting script and one to store flows in a SQL database.
Enhancements:
- This release includes major improvements to performance and functionality.
- In particular, the flow format has been modified to store more information and be faster to read, input and output buffering has been improved, new flow filtering options have been added, and the Python API has been rewritten and extended to be many times faster.
Download (0.17MB)
Added: 2006-02-27 License: BSD License Price:
1337 downloads
cflowd 2.0
cflowd is a flow analysis tool currently used for analyzing Ciscos NetFlow enabled switching method. more>>
cflowd is a flow analysis tool currently used for analyzing Ciscos NetFlow enabled switching method.
The current release (described below) includes the collections, storage, and basic analysis modules for cflowd and for arts++ libraries. This analysis package permits data collection and analysis by ISPs and network engineers in support of capacity planning, trends analysis, and characterization of workloads in a network service provider environment. Other areas where cflowd may prove useful are: tracking for Web hosting, accounting and billing, network planning and analysis, network monitoring, developing user profiles, data warehousing and mining, as well as security-related investigations.
cflowd is no longer supported by CAIDA. Instead, please consider the use of flow-tools, which will provide a toolset for working with NetFlow data. flow-tools can also be used (like cflowd) in conjunction with FlowScan, maintained by Dave Plonka at the University of Wisconsin, Madison.
<<lessThe current release (described below) includes the collections, storage, and basic analysis modules for cflowd and for arts++ libraries. This analysis package permits data collection and analysis by ISPs and network engineers in support of capacity planning, trends analysis, and characterization of workloads in a network service provider environment. Other areas where cflowd may prove useful are: tracking for Web hosting, accounting and billing, network planning and analysis, network monitoring, developing user profiles, data warehousing and mining, as well as security-related investigations.
cflowd is no longer supported by CAIDA. Instead, please consider the use of flow-tools, which will provide a toolset for working with NetFlow data. flow-tools can also be used (like cflowd) in conjunction with FlowScan, maintained by Dave Plonka at the University of Wisconsin, Madison.
Download (5.4MB)
Added: 2006-06-29 License: GPL (GNU General Public License) Price:
700 downloads
glFlow 0.1.4
glFlow is a (D)DoS logger written with speed in mind. more>>
glFlow is a (D)DoS logger written with speed in mind. glFlow detects attacks on high speed links through real-time flow aggregation and analysis.
What do I run it on ?
It was written on FreeBSD and tested on both FreeBSD and Linux. It should work on any OS to which libpcap and OpenSSL were ported. The rest of the code is perfectly portable.
How does it work ?
Cisco Systems have defined the flow as a four value tuplet: {srcaddr, srcport, dstaddr, dstport}. The format evolved over time. The complete structures for various NetFlow versions are available on Ciscos site. Now, lets assume that the attacker floods the victim with packets that keep the same characteristics throughout the duration of the attack. No source spoof, no
source port increments or randomizations. That would lead to a very large packet rate inside that flow. glFlow calculates the average packet rate in every flow and raises an alarm signal if the threshold is hit.
What about spoofed attacks ? How are they detected ? Simple. glFlow keeps a history for every destination host that it sees. When a new flow is created, the flow counter for that host is incremented. The average number of newly created flows corresponding to a specific host in a specific amount of time is calculated, and, as above, an alarm is raised if the threshold is hit.
To prevent attacks that dont hit any of the above thresholds, theres
a new one starting with v0.1, measuring the packet rate for a destination.
Cant other tools, like SNORT, do this ?
We sincereley believe not. Remember, glFlow was written with high
speeds in mind. Weve been using it at over 500Mbps. At that speed, with an
ordinary x86 machine, even with a strong motherboard/NIC combination, you cant
do anything fancy. glFlow was specifically designed for detecting large floods
in real time, or at least something close to that.
How is it that its so fast ?
Well, Andrei did a great job implementing a very fast binary tree. That allowed us to drop the threaded model and choose a single loop design. The new results were stunning. The tests were made on a P4 Xeon/3 GHz, with an Intel GigE NIC. The average traffic rate was about 500Mbps, with an average packet rate of 100kpps. That lead to about 200k active flows. glFlow managed to clean the inactive ones in less than 0.3 seconds. There was no alarm raised
after more than 5 seconds of flooding. glFlow ate ~50% of the CPU, while consuming about 40MB of system memory.
How do I install and run it ?
Run ./configure --help. Youll see two adjustable knobs: --with-hash and --enable-debug. The first one permits you to switch between MD4 and MD5 summing of the flow and host structures kept in the memory. The second lets you run glflow in the foreground, printing some statistics on stdout.
The thresholds are harcoded in defs.h. You shouldnt have any trouble tweaking them. However, weve observed that the best results are obtained when using the same values for flow lifetime and the time between flow cleanups. And they shouldnt be much over 20. The smaller the tree is, the faster it will be cleaned.
Finally, edit your /etc/syslog.conf and write something like this: "local6.*< tabs >/var/log/something". Restart sys[k]logd afterwards.
Fire glFlow up, like this: "./glFlow < interface > < bpf filter >" and watch /var/log/something for changes. You may play with nmap or some DoS programs to test it. The IPs in the syslog will be shown as integers rather than in dotted notation. We decided to leave this job to the log analyzer.
Can it go even faster ?
Sure. There are a few methods which permit you to improve the packet capture. For more info read Luca Deris paper: http://luca.ntop.org/Ring.pdf
Enhancements:
- This is a bugfix release.
<<lessWhat do I run it on ?
It was written on FreeBSD and tested on both FreeBSD and Linux. It should work on any OS to which libpcap and OpenSSL were ported. The rest of the code is perfectly portable.
How does it work ?
Cisco Systems have defined the flow as a four value tuplet: {srcaddr, srcport, dstaddr, dstport}. The format evolved over time. The complete structures for various NetFlow versions are available on Ciscos site. Now, lets assume that the attacker floods the victim with packets that keep the same characteristics throughout the duration of the attack. No source spoof, no
source port increments or randomizations. That would lead to a very large packet rate inside that flow. glFlow calculates the average packet rate in every flow and raises an alarm signal if the threshold is hit.
What about spoofed attacks ? How are they detected ? Simple. glFlow keeps a history for every destination host that it sees. When a new flow is created, the flow counter for that host is incremented. The average number of newly created flows corresponding to a specific host in a specific amount of time is calculated, and, as above, an alarm is raised if the threshold is hit.
To prevent attacks that dont hit any of the above thresholds, theres
a new one starting with v0.1, measuring the packet rate for a destination.
Cant other tools, like SNORT, do this ?
We sincereley believe not. Remember, glFlow was written with high
speeds in mind. Weve been using it at over 500Mbps. At that speed, with an
ordinary x86 machine, even with a strong motherboard/NIC combination, you cant
do anything fancy. glFlow was specifically designed for detecting large floods
in real time, or at least something close to that.
How is it that its so fast ?
Well, Andrei did a great job implementing a very fast binary tree. That allowed us to drop the threaded model and choose a single loop design. The new results were stunning. The tests were made on a P4 Xeon/3 GHz, with an Intel GigE NIC. The average traffic rate was about 500Mbps, with an average packet rate of 100kpps. That lead to about 200k active flows. glFlow managed to clean the inactive ones in less than 0.3 seconds. There was no alarm raised
after more than 5 seconds of flooding. glFlow ate ~50% of the CPU, while consuming about 40MB of system memory.
How do I install and run it ?
Run ./configure --help. Youll see two adjustable knobs: --with-hash and --enable-debug. The first one permits you to switch between MD4 and MD5 summing of the flow and host structures kept in the memory. The second lets you run glflow in the foreground, printing some statistics on stdout.
The thresholds are harcoded in defs.h. You shouldnt have any trouble tweaking them. However, weve observed that the best results are obtained when using the same values for flow lifetime and the time between flow cleanups. And they shouldnt be much over 20. The smaller the tree is, the faster it will be cleaned.
Finally, edit your /etc/syslog.conf and write something like this: "local6.*< tabs >/var/log/something". Restart sys[k]logd afterwards.
Fire glFlow up, like this: "./glFlow < interface > < bpf filter >" and watch /var/log/something for changes. You may play with nmap or some DoS programs to test it. The IPs in the syslog will be shown as integers rather than in dotted notation. We decided to leave this job to the log analyzer.
Can it go even faster ?
Sure. There are a few methods which permit you to improve the packet capture. For more info read Luca Deris paper: http://luca.ntop.org/Ring.pdf
Enhancements:
- This is a bugfix release.
Download (0.10MB)
Added: 2006-12-05 License: GPL (GNU General Public License) Price:
1054 downloads
dnsreflector 1.02
dnsreflector daemon listens for DNS queries on a local UDP port and answers with records pointing back to localhost. more>>
dnsreflector daemon listens for DNS queries on a local UDP port and answers with records pointing back to localhost. Combined with OpenBSDs packet filter pf(4) this works as a bandwidth efficient spamtrap.
dnsreflector was written and tested with OpenBSD. If you are interested in running dnsreflector on another platform, please contact me .
PF Setup
table < spamd > persist
rdr inet proto udp from < spamd > to any port 53 -> 127.0.0.1 port 53000
Usage
dnsreflector [-d] [-a address] [-p port]
-d Run as daemon in the background
-a address Bind to this address (default: 127.0.0.1)
-p port Bind to this port (default: 53000)
Linux: On popular demand I made a diff to compile dnsreflector with Linux (tested on SuSE). You will need a facility to redirect DNS queries coming from blacklisted hosts to dnsreflector. I dont know how to do this with Linux netfilter, but if you do, please tell me.
<<lessdnsreflector was written and tested with OpenBSD. If you are interested in running dnsreflector on another platform, please contact me .
PF Setup
table < spamd > persist
rdr inet proto udp from < spamd > to any port 53 -> 127.0.0.1 port 53000
Usage
dnsreflector [-d] [-a address] [-p port]
-d Run as daemon in the background
-a address Bind to this address (default: 127.0.0.1)
-p port Bind to this port (default: 53000)
Linux: On popular demand I made a diff to compile dnsreflector with Linux (tested on SuSE). You will need a facility to redirect DNS queries coming from blacklisted hosts to dnsreflector. I dont know how to do this with Linux netfilter, but if you do, please tell me.
Download (0.005MB)
Added: 2006-03-07 License: BSD License Price:
1328 downloads
Tennix! SDL Port 0.3.2
Tennix! SDL Port is a simple two-player tennis game. more>>
Tennix! SDL Port is a simple two-player tennis game.
It features simple image loading (with all game graphics being customizable by simply editing them with a graphics editor like The GIMP), sound effects, stadium audience sounds, and ball shadows.
The source code for this SDL port is released under the terms of the GNU General Public License, Version 2 (or later).
Controls
Player 1 uses the keys W, S and D and Player 2 uses O, L and K.
<<lessIt features simple image loading (with all game graphics being customizable by simply editing them with a graphics editor like The GIMP), sound effects, stadium audience sounds, and ball shadows.
The source code for this SDL port is released under the terms of the GNU General Public License, Version 2 (or later).
Controls
Player 1 uses the keys W, S and D and Player 2 uses O, L and K.
Download (0.47MB)
Added: 2007-07-08 License: Freeware Price:
838 downloads
C-Dogs SDL Port 0.4
C-Dogs is an arcade shoot-em-up which lets players work alone and co-operativly during missions. more>>
C-Dogs SDL is a port of the old DOS arcade game C-Dogs to modern operating systems utilising the SDL Media Libraries. In theory C-Dogs SDL should be able to run on Windows, MacOS X, BeOS and the other systems supported by SDL.
Genererally, the more UNIX like a system is, the greater the chance of C-Dogs working (MacOS X and BeOS people, I mean you guys).
C-Dogs SDL was ported to SDL by Jeremy Chin and Lucas Martin-King, using Gentoo Linux as their development environment.
C-Dogs is an arcade shoot-em-up which lets players work alone and co-operativly during missions, and against each other in the "dogfight" deathmatch mode. The DOS version of C-Dogs came with several built in missions and dogfight maps, this version is no exception.
The author of the DOS version of C-Dogs was Ronny Wester. See the "official" homepage for more details. We would like to thank him for releasing the C-Dogs sources to the public.
<<lessGenererally, the more UNIX like a system is, the greater the chance of C-Dogs working (MacOS X and BeOS people, I mean you guys).
C-Dogs SDL was ported to SDL by Jeremy Chin and Lucas Martin-King, using Gentoo Linux as their development environment.
C-Dogs is an arcade shoot-em-up which lets players work alone and co-operativly during missions, and against each other in the "dogfight" deathmatch mode. The DOS version of C-Dogs came with several built in missions and dogfight maps, this version is no exception.
The author of the DOS version of C-Dogs was Ronny Wester. See the "official" homepage for more details. We would like to thank him for releasing the C-Dogs sources to the public.
Download (0.36MB)
Added: 2007-07-07 License: GPL (GNU General Public License) Price:
847 downloads
NAT and blocking all but Port 22 1.0
NAT and blocking all but Port 22 is a simple iptables firewall script. more>>
NAT and blocking all but Port 22 is a simple iptables firewall script.
Sample:
# Internal and External Devices
dev_world=ppp0
dev_int=eth0
# Firewall IP
addr_int=192.168.1.1
# Internal Net
net_int=192.168.1.0/24
###################################################
# Load Modules
insmod ip_tables
insmod ip_conntrack
insmod ip_conntrack_ftp
insmod ipt_state
insmod iptable_nat
insmod ipt_MASQUERADE
###################################################
# Delete all Rules in Filtertable
iptables -F
###################################################
# Define new chains
iptables -N BLOCK
iptables -N EXT-INT
iptables -N INT-EXT
iptables -N ICMP-DENY
iptables -N INT-IF
iptables -N EXT-IF
###################################################
iptables -A BLOCK -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A BLOCK -m state --state NEW -i ! $dev_world -j ACCEPT
iptables -A BLOCK -j DROP
iptables -A INPUT -j BLOCK
iptables -A FORWARD -j BLOCK
###################################################
# Point to chains
iptables -A INPUT -i lo -j ACCEPT
iptables -A INPUT -i $dev_int -s $net_int -j INT-IF
iptables -A INPUT -d ! $addr_int -i $dev_world -s ! $net_int -j EXT-IF
iptables -A INPUT -j DROP
iptables -A FORWARD -d ! $net_int -i $dev_world -s $net_int -j INT-EXT
iptables -A FORWARD -d $net_int -i $dev_int -s ! $net_int -j EXT-INT
iptables -A FORWARD -j DROP
iptables -A OUTPUT -j ACCEPT
###################################################
# Chain Rules
iptables -A EXT-INT -j DROP
iptables -A EXT-IF -i ! $dev_world -j DROP
iptables -A EXT-IF -p tcp --dport 22 -j ACCEPT
iptables -A EXT-IF -p tcp --dport 5901 -j ACCEPT
iptables -A EXT-IF -p tcp --dport 1024: -j ACCEPT
iptables -A EXT-IF -p udp --dport 1024: -j ACCEPT
iptables -A EXT-IF -j DROP
iptables -A INT-IF -j ACCEPT
###################################################
# NAT Rules
# Standard Routing
iptables -A POSTROUTING -t nat -o $dev_world -j MASQUERADE -s $net_int
# Port Forwarding
#iptables -A PREROUTING -t nat -p tcp -d 192.168.1.1 --dport 5901 --to 192.168.1.2:5901 -j DNAT
##################################################
# Enable IP-Forwarding
echo 1 > /proc/sys/net/ipv4/ip_forward)
<<lessSample:
# Internal and External Devices
dev_world=ppp0
dev_int=eth0
# Firewall IP
addr_int=192.168.1.1
# Internal Net
net_int=192.168.1.0/24
###################################################
# Load Modules
insmod ip_tables
insmod ip_conntrack
insmod ip_conntrack_ftp
insmod ipt_state
insmod iptable_nat
insmod ipt_MASQUERADE
###################################################
# Delete all Rules in Filtertable
iptables -F
###################################################
# Define new chains
iptables -N BLOCK
iptables -N EXT-INT
iptables -N INT-EXT
iptables -N ICMP-DENY
iptables -N INT-IF
iptables -N EXT-IF
###################################################
iptables -A BLOCK -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A BLOCK -m state --state NEW -i ! $dev_world -j ACCEPT
iptables -A BLOCK -j DROP
iptables -A INPUT -j BLOCK
iptables -A FORWARD -j BLOCK
###################################################
# Point to chains
iptables -A INPUT -i lo -j ACCEPT
iptables -A INPUT -i $dev_int -s $net_int -j INT-IF
iptables -A INPUT -d ! $addr_int -i $dev_world -s ! $net_int -j EXT-IF
iptables -A INPUT -j DROP
iptables -A FORWARD -d ! $net_int -i $dev_world -s $net_int -j INT-EXT
iptables -A FORWARD -d $net_int -i $dev_int -s ! $net_int -j EXT-INT
iptables -A FORWARD -j DROP
iptables -A OUTPUT -j ACCEPT
###################################################
# Chain Rules
iptables -A EXT-INT -j DROP
iptables -A EXT-IF -i ! $dev_world -j DROP
iptables -A EXT-IF -p tcp --dport 22 -j ACCEPT
iptables -A EXT-IF -p tcp --dport 5901 -j ACCEPT
iptables -A EXT-IF -p tcp --dport 1024: -j ACCEPT
iptables -A EXT-IF -p udp --dport 1024: -j ACCEPT
iptables -A EXT-IF -j DROP
iptables -A INT-IF -j ACCEPT
###################################################
# NAT Rules
# Standard Routing
iptables -A POSTROUTING -t nat -o $dev_world -j MASQUERADE -s $net_int
# Port Forwarding
#iptables -A PREROUTING -t nat -p tcp -d 192.168.1.1 --dport 5901 --to 192.168.1.2:5901 -j DNAT
##################################################
# Enable IP-Forwarding
echo 1 > /proc/sys/net/ipv4/ip_forward)
Download (MB)
Added: 2007-02-14 License: GPL (GNU General Public License) Price:
985 downloads
flow-tools 0.68
flow-tools is a set of programs for processing and managing NetFlow exports from Cisco and Juniper routers. more>>
flow-tools is a set of programs for processing and managing NetFlow exports from Cisco and Juniper routers. The tools included are: flow-capture, flow-cat, flow-dscan, flow-expire, flow-export, flow-fanout, flow-filter, flow-gen, flow-header, flow-import, flow-mask, flow-merge, flow-nfilter, flow-print, flow-receive, flow-report, flow-send, flow-split, flow-stat, flow-tag, and flow-xlate.
Flow data is collected and stored by default in host byte ordera nd the files are portable across every endian architectures.
Commands that utilize the network use a localip/remoteip/port designation for communication. "localip" is the IP address the host will use as a source for sending or bind to when receiving NetFlow PDUs (ie the destination address of the exporter. Configuring the "localip" to 0 will force the kernel to decide what IP address to use for sending and listen on all IP addresses for receiving. "remoteip" is the destination IP address used for sending or the expected address of the source when receiving. If the "remoteip" is 0 then the application will accept flows from any source address. The "port" is the UDP port number used for sending or receiving. When using multicast addresses the localip/remoteip/port is used to represent the source, group, and port respectively.
Flows are exported from a router in a number of different configurable versions. A flow is a collection of key fields and additional data. The flow key is {srcaddr, dstaddr, input, output, srcport, dstport, prot, ToS}. Flow-tools supports one export version per file.
Export versions 1, 5, 6, and 7 all maintain {nexthop, dPkts, dOctets, First, Last, flags}, ie the next-hop IP address, number of packets, number of octets (bytes), start time, end time, and flags such as the TCP header bits. Version 5 adds the additional fields {src_as, dst_as, src_mask, dst_mask}, ie source AS, destination AS, source network mask, and destination network mask. Version 7 which is specific to the Catalyst switches adds in addition to the version 5 fields {router_sc}, which is the Router IP address which populates the flow cache shortcut in the Supervisor. Version 6 which is not officially supported by Cisco adds in addition to the version 5 fields {in_encaps, out_encaps, peer_nexthop}, ie the input and output interface encapsulation size, and the IP address of the next hop within the peer. Version 1 exports do not contain a sequence number and therefore should be avoided, although it is safe to store the data as version 1 if the additional fields are not used.
Version 8 IOS NetFlow is a second level flow cache that reduces the data exported from the router. There are currently 11 formats, all of which provide {dFlows, dOctets, dPkts, First, Last} for the key fields.
8.1 - Source and Destination AS, Input and Output interface
8.2 - Protocol and Port
8.3 - Source Prefix and Input interface
8.4 - Destination Prefix and Output interface
8.5 - Source/Destination Prefix and Input/Output interface
8.9 - 8.1 + ToS
8.10 - 8.2 + ToS
8.11 - 8.3 + ToS
8.12 - 8.5 + ToS
8.13 - 8.2 + ToS
8.14 - 8.3 + ports + ToS
Version 8 CatIOS NetFlow appears to be a less fine grained first level flow cache.
8.6 - Destination IP, ToS, Marked ToS,
8.7 - Source/Destination IP, Input/Output interface, ToS, Marked ToS,
8.8 - Source/Destination IP, Source/Destination Port,
Input/Output interface, ToS, Marked ToS,
The following programs are included in the flow-tools distribution.
flow-capture - Collect, compress, store, and manage disk space for exported flows from a router.
flow-cat - Concatenate flow files. Typically flow files will contain a small window of 5 or 15 minutes of exports. Flow-cat can be used to append files for generating reports that span longer time periods.
flow-fanout - Replicate NetFlow datagrams to unicast or multicast destinations. Flow-fanout is used to facilitate multiple collectors attached to a single router.
flow-report - Generate reports for NetFlow data sets. Reports include source/destination IP pairs, source/destination AS, and top talkers. Over 50 reports are currently supported.
flow-tag - Tag flows based on IP address or AS #. Flow-tag is used to group flows by customer network. The tags can later be used with flow-fanout or flow-report to generate customer based traffic reports.
flow-filter - Filter flows based on any of the export fields. Flow-filter is used in-line with other programs to generate reports based on flows matching filter expressions.
flow-import - Import data from ASCII or cflowd format.
flow-export - Export data to ASCII or cflowd format.
flow-send - Send data over the network using the NetFlow protocol.
flow-receive - Receive exports using the NetFlow protocol without storing to disk like flow-capture.
flow-gen - Generate test data.
flow-dscan - Simple tool for detecting some types of network scanning and Denial of Service attacks.
flow-merge - Merge flow files in chronoligical order.
flow-xlate - Perform translations on some flow fields.
flow-expire - Expire flows using the same policy of flow-capture.
flow-header - Display meta information in flow file.
flow-split - Split flow files into smaller files based on size, time, or tags.
<<lessFlow data is collected and stored by default in host byte ordera nd the files are portable across every endian architectures.
Commands that utilize the network use a localip/remoteip/port designation for communication. "localip" is the IP address the host will use as a source for sending or bind to when receiving NetFlow PDUs (ie the destination address of the exporter. Configuring the "localip" to 0 will force the kernel to decide what IP address to use for sending and listen on all IP addresses for receiving. "remoteip" is the destination IP address used for sending or the expected address of the source when receiving. If the "remoteip" is 0 then the application will accept flows from any source address. The "port" is the UDP port number used for sending or receiving. When using multicast addresses the localip/remoteip/port is used to represent the source, group, and port respectively.
Flows are exported from a router in a number of different configurable versions. A flow is a collection of key fields and additional data. The flow key is {srcaddr, dstaddr, input, output, srcport, dstport, prot, ToS}. Flow-tools supports one export version per file.
Export versions 1, 5, 6, and 7 all maintain {nexthop, dPkts, dOctets, First, Last, flags}, ie the next-hop IP address, number of packets, number of octets (bytes), start time, end time, and flags such as the TCP header bits. Version 5 adds the additional fields {src_as, dst_as, src_mask, dst_mask}, ie source AS, destination AS, source network mask, and destination network mask. Version 7 which is specific to the Catalyst switches adds in addition to the version 5 fields {router_sc}, which is the Router IP address which populates the flow cache shortcut in the Supervisor. Version 6 which is not officially supported by Cisco adds in addition to the version 5 fields {in_encaps, out_encaps, peer_nexthop}, ie the input and output interface encapsulation size, and the IP address of the next hop within the peer. Version 1 exports do not contain a sequence number and therefore should be avoided, although it is safe to store the data as version 1 if the additional fields are not used.
Version 8 IOS NetFlow is a second level flow cache that reduces the data exported from the router. There are currently 11 formats, all of which provide {dFlows, dOctets, dPkts, First, Last} for the key fields.
8.1 - Source and Destination AS, Input and Output interface
8.2 - Protocol and Port
8.3 - Source Prefix and Input interface
8.4 - Destination Prefix and Output interface
8.5 - Source/Destination Prefix and Input/Output interface
8.9 - 8.1 + ToS
8.10 - 8.2 + ToS
8.11 - 8.3 + ToS
8.12 - 8.5 + ToS
8.13 - 8.2 + ToS
8.14 - 8.3 + ports + ToS
Version 8 CatIOS NetFlow appears to be a less fine grained first level flow cache.
8.6 - Destination IP, ToS, Marked ToS,
8.7 - Source/Destination IP, Input/Output interface, ToS, Marked ToS,
8.8 - Source/Destination IP, Source/Destination Port,
Input/Output interface, ToS, Marked ToS,
The following programs are included in the flow-tools distribution.
flow-capture - Collect, compress, store, and manage disk space for exported flows from a router.
flow-cat - Concatenate flow files. Typically flow files will contain a small window of 5 or 15 minutes of exports. Flow-cat can be used to append files for generating reports that span longer time periods.
flow-fanout - Replicate NetFlow datagrams to unicast or multicast destinations. Flow-fanout is used to facilitate multiple collectors attached to a single router.
flow-report - Generate reports for NetFlow data sets. Reports include source/destination IP pairs, source/destination AS, and top talkers. Over 50 reports are currently supported.
flow-tag - Tag flows based on IP address or AS #. Flow-tag is used to group flows by customer network. The tags can later be used with flow-fanout or flow-report to generate customer based traffic reports.
flow-filter - Filter flows based on any of the export fields. Flow-filter is used in-line with other programs to generate reports based on flows matching filter expressions.
flow-import - Import data from ASCII or cflowd format.
flow-export - Export data to ASCII or cflowd format.
flow-send - Send data over the network using the NetFlow protocol.
flow-receive - Receive exports using the NetFlow protocol without storing to disk like flow-capture.
flow-gen - Generate test data.
flow-dscan - Simple tool for detecting some types of network scanning and Denial of Service attacks.
flow-merge - Merge flow files in chronoligical order.
flow-xlate - Perform translations on some flow fields.
flow-expire - Expire flows using the same policy of flow-capture.
flow-header - Display meta information in flow file.
flow-split - Split flow files into smaller files based on size, time, or tags.
Download (0.96MB)
Added: 2006-06-22 License: BSD License Price:
1238 downloads
jsSnow 0.4
jsSnow project is a port of XSnow for Web pages. more>>
jsSnow project is a port of XSnow for Web pages.
The framerate is auto-adjusted, and it works for Mozilla, Netscape (>=4), and IE (>=4).
Enhancements:
- code clearings
- santa moves with storm
- renamed jsSnow_ .js to jsSnow.js
<<lessThe framerate is auto-adjusted, and it works for Mozilla, Netscape (>=4), and IE (>=4).
Enhancements:
- code clearings
- santa moves with storm
- renamed jsSnow_ .js to jsSnow.js
Download (0.016MB)
Added: 2006-11-10 License: GPL (GNU General Public License) Price:
627 downloads
TCP port scanner 1.0.4
TCP port scanner is a network scanner for Linux. more>>
TCP port scanner is a network scanner for Linux.
Installation:
1. Install - become root and gunzip/tar tcpscan-X-Y-Z.tar.gz.
2. Type ./confugure , make
3. Type install
4. Enjoy and try type tcpscan localhost
5. To get help - run tcpscan without parametres.
Usage:
tcpscan [-f] [hostname || IP_address]
tcpscan [-f] [first_IP_address] [last_IP_address]
<<lessInstallation:
1. Install - become root and gunzip/tar tcpscan-X-Y-Z.tar.gz.
2. Type ./confugure , make
3. Type install
4. Enjoy and try type tcpscan localhost
5. To get help - run tcpscan without parametres.
Usage:
tcpscan [-f] [hostname || IP_address]
tcpscan [-f] [first_IP_address] [last_IP_address]
Download (0.060MB)
Added: 2006-04-14 License: GPL (GNU General Public License) Price:
1299 downloads
Parallel Port Make 0.22
Parallel Port Make can build FreeBSD ports in parallel to fully take advantage of modern multi-core and processor machine. more>>
Parallel Port Make project is a tool to build FreeBSD ports in parallel to fully take advantage of modern multi-core and processor machines.
Default: pportmake.py --clean -- cleanup --install -job=2 [port1] [portn]
Example: pportmake.py irc/irssi irc/epic
Advanced: pportmake.py -rSvD -j 10 irc/irssi
-h --help Show this help usage message
-c --clean Clean port before compiling
-C --cleanup Clean port after compiling
-d --deinstall Deinstall ports, implied by reinstall
-f --force Force a port and all dependancies to be installed
-G --noconfig Dont recursively configure options
-i --install Install port (default)
-j n --jobs=n Number of threads to use, 1 or 2 per CPU core
is recommended
Default is 2
-O args --options=foo List of arguments to pass to make.
E.g. -O -DX11=yes -DFOO
-r --reinstall Reinstall port and ALL dependancies
-S --maxspeed Try and speed up by maximising CPU usuage.
This may break some ports, use with caution
-w --noclean Dont make clean before compiling
-W --nocleanup Dont make clean after compiling
-v --verbose Be extra verbose
-V --version Show version information
-D --debug Show some debugging info
-P --pretend Dont actually alter the ports
NOTES: It is currently only safe to run 1 copy of this and not have other ports compiling simultaneously
<<lessDefault: pportmake.py --clean -- cleanup --install -job=2 [port1] [portn]
Example: pportmake.py irc/irssi irc/epic
Advanced: pportmake.py -rSvD -j 10 irc/irssi
-h --help Show this help usage message
-c --clean Clean port before compiling
-C --cleanup Clean port after compiling
-d --deinstall Deinstall ports, implied by reinstall
-f --force Force a port and all dependancies to be installed
-G --noconfig Dont recursively configure options
-i --install Install port (default)
-j n --jobs=n Number of threads to use, 1 or 2 per CPU core
is recommended
Default is 2
-O args --options=foo List of arguments to pass to make.
E.g. -O -DX11=yes -DFOO
-r --reinstall Reinstall port and ALL dependancies
-S --maxspeed Try and speed up by maximising CPU usuage.
This may break some ports, use with caution
-w --noclean Dont make clean before compiling
-W --nocleanup Dont make clean after compiling
-v --verbose Be extra verbose
-V --version Show version information
-D --debug Show some debugging info
-P --pretend Dont actually alter the ports
NOTES: It is currently only safe to run 1 copy of this and not have other ports compiling simultaneously
Download (0.005MB)
Added: 2007-01-16 License: BSD License Price:
1013 downloads
Just Another Port Scanner 0.1
Just Another Port Scanner (JAPS) is an easy to use, bare-bones TCP port scanner. more>>
Just Another Port Scanner (JAPS) is an easy to use, bare-bones TCP port scanner. JAPS requires the GTK+ library to run. I created JAPS because I felt it would be a fun project and I wanted to learn GTK+ programming basics.
To compile an install JAPS just type make.
Todo
Add subnet scanning
Add progress bar
Display service name next to port number in results box
If you have any suggestions please contact me. 1
<<lessTo compile an install JAPS just type make.
Todo
Add subnet scanning
Add progress bar
Display service name next to port number in results box
If you have any suggestions please contact me. 1
Download (0.029MB)
Added: 2006-07-04 License: GPL (GNU General Public License) Price:
1210 downloads
Fortress 0.3
Fortress is a simple script driven framework for performing security scans. more>>
Fortress is a simple script driven framework for performing security scans. The core of the application is an application which will execute testing scripts written using the embedded LUA scripting engine.
The scripts may perform almost arbitrary operations, including making HTTP requests, conducting port scanning, and taking advantage of several other provided primitives.
<<lessThe scripts may perform almost arbitrary operations, including making HTTP requests, conducting port scanning, and taking advantage of several other provided primitives.
Download (0.076MB)
Added: 2005-10-26 License: GPL (GNU General Public License) Price:
1478 downloads
OSSP flow2rrd 0.9.0
OSSP flow2rrd is a companion tool to the Flow-Tools toolkit. more>>
OSSP flow2rrd is a companion tool to the Flow-Tools toolkit for storing NetFlow network traffic data in an accumulating fixed-size RRDTool Round-Robin-Database (RRD) for visualization purposes.
This file is piece of OSSP flow2rrd, a tool for storing NetFlow data into an RRD which can be found at http://www.ossp.org/pkg/tool/flow2rrd/.
Enhancements:
- Created the initial version of OSSP flow2rrd.
<<lessThis file is piece of OSSP flow2rrd, a tool for storing NetFlow data into an RRD which can be found at http://www.ossp.org/pkg/tool/flow2rrd/.
Enhancements:
- Created the initial version of OSSP flow2rrd.
Download (0.060MB)
Added: 2006-06-29 License: (FDL) GNU Free Documentation License Price:
1214 downloads
Secleted [ 0 ] software to compare
Copyright Notice:
Software piracy is theft, Using crack, password, serial numbers, registration codes, key generators is illegal and prevent future software development. The above netflow port search only lists software in full, demo and trial versions for free download. Download links are directly from our mirror sites or publisher sites, torrent files or links from rapidshare.com, yousendit.com or megaupload.com are not allowed
