Free network traffic analyser software for linux

Network Traffic Analyzer analyzes the network traffic on multiple network devices and creates HTML statistics with some network usage graphs. Sometimes it is good to know, how the network is used, how many bytes were received and how many bytes were sent.Therefore, here is Network Traffic Analyzer, which creates simple network usage statistics.


Such statistics can tell you, how good your network connection really is (who cares about what Internet provider say, when was the network down, which time is the best time for downloading large packages of data etc. etc. Or with this software you can just better imagine, how many traffic can your home computer generate.

Python Traffic Analyzer is a Python base class and sample driver script written to retrieve and manipulate images from the TrafficLand cameras and calculate a numeric value representing the current traffic flow.

PyTrAn, an example driver script, an image collector and an image mask creator are available for download from the link shown at the bottom. To use the PyTrAn package begin by choosing a camera that you wish to analyze, for this example well use the camera captioned above.

We want to construct a mask over the area of the image that we are interested in, namely the road. In this particular example the road takes up the majority of the image but that is not always the case.

We will apply the mask over captured images to fine tune the area over which we are looking for movement. To create the mask we will first need to collect a sequential series of snapshots from the target camera. The image_collector.py script was written for this task:

$ mkdir mask_200003
$ cd mask_200003
$ ../image_collector.py 200003 30
Collecting 30 images...
30

Done.

The script is hard coded to capture images on a 2-second delay. The delay is necessary to ensure the image has changed. I believe 2-seconds to be the absolute minimum. Once complete, 30 images numbered 1 through 30 will be created in the current directory.

We construct a mask from these captured images by creating a diff-image for each sequential image pair and then adding each diff-image together. Naturally, a script was written to automate this task as well:

$ ../mask_maker.py 1 30
Creating a diff for each sequential image pair.
Diffing 29

Creating the initial mask from the first image pair.

Adding the rest of the diffs to the mask.
Masking 29

Done.

A number of .diff files are generated in this process. These files repesent the movement between individual sequence pairs.

The .diff files are simply intermediary files, the important bit is the mask file, which is generated as the sum of all differences.

The mask file may be dirty (as in this case) and require manual cleanup. The basic shape of the road however is clearly visible, evidence that we can with minimal effort automate the mask generation process. Also, this run was conducted at night, day-time images yield better results.

There are a few final steps we need to take before we can use the example PyTrAn driver script. First we need to convert the mask to ASCII (noraw) format:

$ pnmnoraw mask > mask_200003.ascii

Then we need to open an ImageMagick display window and get its X-window-ID using xwininfo. Finally, update camera_id and window_id in pytran_sampling.py and launch the driver:

$ ../pytran_sampling.py
DEBUG> grabbing frame from camera 200003
DEBUG> rotating image: pytran.this > pytran.last
DEBUG> refreshing image in 3 secs
taking a 5 minute sample at various thresholds.
DEBUG> grabbing frame from camera 200003
DEBUG> generating frame diff on pytran.last, pytran.this
DEBUG> displaying image: pytran.diff
DEBUG> converting pytran.diff to ascii
DEBUG> calculating traffic ratio...
ratio[5]: 55%
DEBUG> calculating traffic ratio...
ratio[10]: 52%
...
...
5 minute sample[5]: 67.88
5 minute sample[10]: 42.66
5 minute sample[15]: 30.57
5 minute sample[20]: 23.03
5 minute sample[25]: 18.39
5 minute sample[30]: 14.79
5 minute sample[35]: 12.42
5 minute sample[40]: 10.53
5 minute sample[45]: 9.06
5 minute sample[50]: 7.85

The sampling script will take 5 minute samples at varying color thresholds. The optimal threshold must be manually chosen. Furthermore, you will need to sample the traffic ratios during both heavy and light traffic times to get a good feel for your acceptable range. Also, keep in mind that the traffic ratio value is simply the percent change detected, or in other words the movement detected within the masked region. This means that a completely empty road will register similar values to a road so congested it looks like a parking lot. The time of day can be combined with the traffic ration to determine the logical truth.

With this task implemented and abstracted more complex systems can be built. When I find the time Id like to create a system that will take multiple potential travel routes and times, and during the travel time e-mail the traveler with the best route to take. Another idea I had would be to record the traffic flow values for each camera, for each day and for each half hour interval. Travelers and other interested parties can then analyze traffic patterns to determine the fastest route dependant on date/time.

KTrafficAnalyzer is meant to provide visual feedback of your current network traffic, similar to tools like DU-Meter. In addition it provides statistics with total down- and upload sums.
Of course feedback is more than welcome. There is still more than enough room for improvements. Also checkout the TODO file what Im already planning - maybe you have ideas what I can add or what ight be useful too!
Enhancements:
- Re-Designed some more settings dialogs to look better and make more space for fonts.
- Added Double-buffering
- Changed the interface-icon in the settings dialog to use the "hwinfo" icon
- Adjusted the Makefile to automatically build on Ubuntu systems

Statistical Traffic Analysis Kit is a set of command-line traffic analysis tools, designed to help a network administrator to see what is happening at a router at the moment.

Unlike tcpdump (1), the stak set uses statistical and stream-oriented methods, and will rarely produce an output stream at a speed beyond human perception. The output is less accurate.

The kit consists of five different utilities, designed to perform the following tasks:
estimating overall traffic rates (stakrate),
determining network nodes generating the highest traffic (stakhosts)
monitoring the amount of traffic exchanged with particular autonomous
systems (stakasta),
extracting strings from packets (stakextract),
determining connections and flows generating the highest traffic
(stakstreams, experimental),

Network Pipemeter is a tool for measuring available bandwidth between hosts. nepim is also useful to generate network traffic for testing purposes.
nepim operates in client/server mode, is able to handle multiple parallel traffic streams, reports periodic partial statistics along the testing, and supports IPv6.
nepim has been tested under Linux, Solaris and FreeBSD, though it should work under other platforms as well. If you manage to build nepim for different systems, please send the patch.
- nepim is useful to assess the throughput at the transport layer (TCP or UDP) as seen by applications.
- nepim runs single-threaded and should impose very light burden on your CPU. Unless, of course, your testing hosts have relatively high network bandwidth compared to low CPU power.
- One single server can service multiple clients simultaneously.
- As of nepim 0.11, one single client can interact simultaneously with multiple servers. For instance, suppose you want to test, from a single client, two remote servers, one located at 10.0.0.1,2000 and another at 192.168.0.1,3000:
- nepim -c 10.0.0.1,2000/192.168.0.1,3000
- The server listens to both TCP and UDP sockets. The client by default uses TCP sockets. Use the "-u" client option to switch the client operation to UDP.
- By default, only the server sends traffic towards the client. Use the "-s" client option to reverse the behavior, then only the client will send traffic. Use the "-d" client option to make both client and server to send traffic.
- Use the "-r" client option to establish an upper bit rate limit. Without a rate limiting option, nepim sends as fast as possible. See also "-R" below. Please notice the rate is specified in bps (bits per seconds); for instance, the following example states a rate limit of 100,000 bps (100 Kbps):
- nepim -c 10.0.0.1 -r 100000
- Use the "-R" client option to establish an upper "packet" rate limit (outbound rate limit for transport layer segments). Without a rate limiting option, nepim sends as fast as possible. If both "-r" and "-R" are given, nepim limits the sending rate at the lower of those bounds.
- Use the "-n" client option to run multiple parallel traffic streams.
- Use the "-b" server option to make the server to listen on specific local addresses.
- Use the "-6" option to disable IPv6 support.
Enhancements:
- Support for randomizing the UDP destination address/port has been added in order to put stress on routers with on-demand (dynamic) forwarding table caches.

Multi Network Firewall is the up-to-date Mandriva Linux security solution dedicated to the business world. Maximum innovation, performance and scalability is only a click away thanks to an easy-to-use web interface.
Combining firewall, Intrusion Detection System and VPN functionality, MNF 2 is the ultimate full-featured security solution meeting all your demands. Furthermore, to make your network even more secure, benefit from a year of free updates through Mandriva Online Pro!
Main features:
- a firewall, to protect your computer network from unauthorized access (filtering).
- Intrusion Detection System, to alert you to abnormal network activity.
- Virtual Private Network, to enable a secure private tunnel over public networks.
- Proxy server, to intercept all web traffic entering the network.
- DHCP server, to enable the automatic configuration of new machines connected to the LAN.
- Caching DNS, to provide a local DNS service for computers connected to the LAN.
New Featurs:
As well as the existing IPSec, MNF2 provides 2 other types of VPN:
PPTP: a desktop under Windows(R) can be automatically connected without installing any special software
OpenVPN: a lighter open source VPN; Compattible with Linux, Mac OS and Windows
Bonding: Channel combines several network interfaces into a single connection. Effectively, it means that data transfer speeds can be multiplied.
Bridging: this new function enables the administrator to build bridges between network interfaces.
Traffic shaping: You can regulate the flow of traffic on your network just by clicking on a wizard.
Network mapping: Makes it possible to connect networks which use the same private network addresses
Peer-to-Peer Filtering: MNF2 automatically blocks network traffic from "Fast Track" peer-to-peer clients.
Better software support
2.6 Linux Kernel
Better hardware support
Improved support for multiple network cards (up to 10)
Wi-Fi Support
Better ADSL support
Services included in the product
Mandriva Online Pro: benefit from updates for one year through Mandriva Online Pro
Support included/