Free network traffic software for linux

Network Traffic Analyzer analyzes the network traffic on multiple network devices and creates HTML statistics with some network usage graphs. Sometimes it is good to know, how the network is used, how many bytes were received and how many bytes were sent.Therefore, here is Network Traffic Analyzer, which creates simple network usage statistics.


Such statistics can tell you, how good your network connection really is (who cares about what Internet provider say, when was the network down, which time is the best time for downloading large packages of data etc. etc. Or with this software you can just better imagine, how many traffic can your home computer generate.

This is a traffic generator. It is used to check what massive amounts of traffic of certain type will do to an intervening network.

It does not try to measure throughput or response times. It has been made with the question in mind: If 100 clients does simultaneous TCP transfers for 2 days, will my router break? Or can I configure my firewall while 50 people are doing large TCP transfers through the device?

Network Pipemeter is a tool for measuring available bandwidth between hosts. nepim is also useful to generate network traffic for testing purposes.
nepim operates in client/server mode, is able to handle multiple parallel traffic streams, reports periodic partial statistics along the testing, and supports IPv6.
nepim has been tested under Linux, Solaris and FreeBSD, though it should work under other platforms as well. If you manage to build nepim for different systems, please send the patch.
- nepim is useful to assess the throughput at the transport layer (TCP or UDP) as seen by applications.
- nepim runs single-threaded and should impose very light burden on your CPU. Unless, of course, your testing hosts have relatively high network bandwidth compared to low CPU power.
- One single server can service multiple clients simultaneously.
- As of nepim 0.11, one single client can interact simultaneously with multiple servers. For instance, suppose you want to test, from a single client, two remote servers, one located at 10.0.0.1,2000 and another at 192.168.0.1,3000:
- nepim -c 10.0.0.1,2000/192.168.0.1,3000
- The server listens to both TCP and UDP sockets. The client by default uses TCP sockets. Use the "-u" client option to switch the client operation to UDP.
- By default, only the server sends traffic towards the client. Use the "-s" client option to reverse the behavior, then only the client will send traffic. Use the "-d" client option to make both client and server to send traffic.
- Use the "-r" client option to establish an upper bit rate limit. Without a rate limiting option, nepim sends as fast as possible. See also "-R" below. Please notice the rate is specified in bps (bits per seconds); for instance, the following example states a rate limit of 100,000 bps (100 Kbps):
- nepim -c 10.0.0.1 -r 100000
- Use the "-R" client option to establish an upper "packet" rate limit (outbound rate limit for transport layer segments). Without a rate limiting option, nepim sends as fast as possible. If both "-r" and "-R" are given, nepim limits the sending rate at the lower of those bounds.
- Use the "-n" client option to run multiple parallel traffic streams.
- Use the "-b" server option to make the server to listen on specific local addresses.
- Use the "-6" option to disable IPv6 support.
Enhancements:
- Support for randomizing the UDP destination address/port has been added in order to put stress on routers with on-demand (dynamic) forwarding table caches.

TraffAcct is a platform for gathering network traffic data for use in link volume calculations or billing. TraffAcct can be used to monitor the traffic usage of many network interfaces include Ethernet, serial, ATM, and Frame Relay. It can also be used to account for traffic on virtual connections such as Dialup ISDN, IP Accounting, and VPDN connections (adsl for example).

This product runs on UNIX / Linux only.

Perform the following
./configure
make

That will install the software in the location you specified. It will also localise all scripts and files for your system (i.e. location of the installed software, location of Ember etc).

To access the web interface you must link from your document tree to the installation directory using something like
ln -s /usr/local/traffacct/www /usr/local/apache/htdocs/traffacct

The data acquisition poller must be run at regular intervals. It is recommended that you run the poller every 5 minutes from cron. Depending on the format of your crontab file, you should add something like the following
#
# TraffAcct
#
*/5 * * * * root /usr/local/traffacct/poller
Details for configuring devices, circuits and users is contained in the users guide. There are also some sample configuration files in the sample-config directory.

netAI comes from Network Traffic based Application Identification and has been developed for identifying the end host applications that are responsible for traffic flows in the network.
Unlike previous solutions that identify the application based on port numbers or packet payload (either through protocol decoding or signatures) netAI computes various payload independent features (e.g. packet length and packet inter-arrival time statistics) for a traffic flow and uses machine learning (ML) techniques.
ML is a discipline of the wider area of Artificial Intelligence (AI). Before netAI can be used to classify a particular application it must be trained on a representative set of traffic flows of that application. netAI can be used offline (reading packet data from tracefiles) and online (live capturing on network interfaces).
Main features:
- Reading packet data from live network interfaces or tracefiles (tcpdump or Endance format)
- Direct creation of WEKA data files (.arff files) from the packet data
- Interim flow information export (while flows are still active), TCP and time-based flow timeouts
- Flexible packet classification and filtering thanks to NetMate
- New features can be easily added and used
- Flexible selection of features to be used for classification
- A large number of machine learning algorithms can be used thanks to WEKA
- Feature extraction and ML based flow classification can be run on different machines - feature extractor supports data export via UDP or TCP

Network Security Toolkit is a bootable ISO live CD and its based on Fedora Core 2.
The toolkit was designed to provide easy access to best-of-breed Open Source Network Security Applications and should run on most x86 platforms.
The main intent of developing this toolkit was to provide the network security administrator with a comprehensive set of Open Source Network Security Tools. The majority of tools published in the article: Top 75 Security Tools by insecure.org are available in the toolkit.
What we find rather fascinating with NST is that we can transform most x86 systems (Pentium II and above) into a system designed for network traffic analysis, intrusion detection, network packet generation, wireless network monitoring, a virtual system service server, or a sophisticated network/host scanner.
This can all be done without disturbing or modifying any underlying sub-system disk. NST can be up and running on a typical x86 notebook in less than a minute by just rebooting with the NST ISO CD. The notebooks hard disk will not be altered in any way.
NST also makes an excellent tool to help one with all sorts of crash recovery troubleshooting scenarios and situations.
Enhancements:
- We are pleased to announce the latest NST release: v1.5.0. This release is based on Fedora Core 5 using the Linux kernel 2.6.18. Here are some of the highlights for this release: the NST Web User Interface (WUI), has been greatly enhanced and cleaned up; extensive additions to managing and analyzing network packet captures; the ability to setup and manage printers; the ability to easily mount many different supported file system types; the ability to manage the NST as a file server (both NFS and CIFS); the addition of the Inprotect package (a Nessus manager); the addition of the Zabbix package (another network resource monitoring tool - similar to Nagios)....

net-acct logs network traffic. It provides a daemon (nacctd) that logs all traffic passing through the machine it runs on. Capability is provided to associate traffic to slip/ppp users if you run a slip/ppp server.
You should use this because:
You are providing IP to customers and want to charge them based on the traffic they generate.
You are a statistics freak and want to see how much of your network traffic is for NetNews, FTP, WWW etc.
Enhancements:
- revised docs and Makefile slightly (added -O2 etc)
- increased default hash table size and improved algorithm
- added ICMP masquerading and masq bug fixes
- fixed bug with multiple notdev definitions in naccttab
- added PLIP header entry to naccttab.sample
- fixed disable entry in naccttab from field 8 to 7 for 0.5 compatibility
- fixed problem with promisc devices not being reinitialized on SIGHUP