Free tcp connections software for linux

Net::Connection::Sniffer can gather stats on network connections.

SYNOPSIS

use Net::Connection::Sniffer;
gather($config)
__top

Net::Connection::Sniffer is a perl module to gather connection statistics by listening to ethernet traffic. Traffic is filtered using standard BPF notation as described in the tcpdump documentation and implemented using the standard pcap library to sniff packets on host network interfaces.

TCP Knocking provides a port knocking implementation.
Often a secure system needs a port open so that only authorized persons can access a particular service and also the service should not exposed to attackers and worms that may use vulnerabilities that exist in the listening server. Port knocking is designed to be used as a complementary service to the existing authentication mechanism. But one of the biggest problems with port knocking is manipulating the firewall with timeouts.
When the correct knock sequence is sent, the firewall is modified for couple of seconds. Having the firewall open automatically for a time period will make any system administrator uncomfortable. TCP knocking attempts to solve the problem by incorporating the knock into the TCP handshake. Tcp knocking is similar to port knocking, but instead sending UDP packets with secret ports, the TCP handshake packets must include secrete codes. It is at least as secure as port knocking and it can be made secure with more hardening.
Modified TCP handshake:
In normal TCP handshake, the client sends the syn packet and chooses a random initial sequence number. The server responds with a packet that has both syn and ack flags set, choosing a random
The modified TCP handshake uses the empty fields in the header. The server does not respond to connection requests without a special code generated along with the syn packet. The server also encrypts the ISN in the ack packet (2) and the final packet of the three-way handshake must have the correct acknowledgment for the servers ISN. The system is further protected from brute-force attacks by closing the connection if the first attempt for the third packet does not have the expected acknowledgment sequence.
Also, rather than use conventional encryption techniques like HMAC for verification, this system uses a file with random numbers as the key. This is because of the limited unused space available in the TCP/IP header which makes HMAC very weak. By using a shared file, the length of the key can be much greater than traditional systems and even though some parts of the key can be revealed by attacks, the server can protect itself from replay attacks.
The handshake:
1) Syn
The syn packet does not use the 32 bit acknowledgment field in the TCP header as it the the first packet to initiate the connection. Further the 16 bit IPID can be used to transmit information. In the current implementation only the 32 bit acknowledgment field is used. Currently the 32 bit ack is derived from a 64 KB file which contains random numbers. The ISN and the source IP address along with the random numbers are used to generate this value.
2) Syn/Ack
The ISN is encrypted using the random numbers from the 64 KB file using the destination IP address as well as a 16 bit random number used as IPID. I do not have code for this part yet.
3) Ack
The client decrypts the syn number from the encrypted syn, the key file, the 16 bit IPID and its own IP address and sends the ack packet. The server closes all connections from the client for couple of minutes if it sends a wrong ack value. Part of the security relies on the fact that the ISN generated by Linux 2.6 is fairly random.
Implementation:
I have implemented only the first part, which is the server expecting secret code along with the first syn packet from the client. Hence it is very possible to brute-force the server. Also the system is designed with the second phase in mind, which is the encrypted Initial Sequence Number in the ack packet and closing the connection if the correct ack is not sent on the first try. I do not have an implementation for that yet. The security will be increased greatly when the second phase is incorporated. Also the ability to detect brute-force attacks can be added to this system.
But the current system can be used for protecting the server from worms and random scanning. The use-case is similar to port knocking but it does not use the ugly system of opening the firewall for a couple of seconds. Vanilla port knocking is susceptible to brute-force attacks as well. Besides, inserting a kernel module to just ssh into your server will increase your mad sysadmin points.
Enhancements:
- TCP knocking with Phase 1 of the protocol was implemented.

tcptunnel is a simple TCP tunnel written in Perl.

Also is a versatile tcp tunnel. The tcptunnel uses:
- tunnelling through a firewall or proxy
- redirecting tcp connections to other ports or machines
- debugging tcp connections in-place
- packet sniffing

The tcptunnel listens on local port < port > and when a connection is made it connects the other end of the tunnel as follows:
a) With no proxy specified, it connects the other end
to < srvport > on < srv >.
b) With a proxy, it connects to < srvport > on < proxy >.
It then directs the proxy to telnet to < srv >, and then it connects the ends of the tunnel.

TCPreen is a simple tool to monitor and analyze data transmitted between clients and servers through connection-oriented streams data such as a TCP sessions; it supports TCP over either IPv4 or IPv6. This tool focuses on the data stream (software/socket layer), not on the lower level transmission protocol as packet sniffers do.
TCPreen listens on a TCP port and wait for incoming connections to come in. Then, it forwards data sent by the connecting client to another server port (possibly on another computer) and forwards server responses back to the client.
TCPreen can display data on your console in real-time and/or save it to log files for later reference.There are various display formats.
While it was originally meant to help developers reverse-engineer TCP-based protocols, it can also be very useful to debug network server or client software or for a system administrator to monitor a TCP service.
Enhancements:
- libsolve/getaddrinfo.{c,h}, src/winstub.{c,h}:
- dirty kludge to resolve getaddrinfo & co at run-time
- so that tcpreen can still run on Windows 2000 and older.

TCPreen is a simple tool to monitor and analyze data transmitted between clients and servers through connection-oriented streams data such as a TCP sessions; it supports TCP over either IPv4 or IPv6. This tool focuses on the data stream (software/socket layer), not on the lower level transmission protocol as packet sniffers do.

TCPreen listens on a TCP port and wait for incoming connections to come in. Then, it forwards data sent by the connecting client to another server port (possibly on another computer) and forwards server responses back to the client.

TCPreen can display data on your console in real-time and/or save it to log files for later reference. Various display formats are available.

While it was originally meant to help developers reverse-engineer TCP-based protocols, it can also be very useful to debug network server or client software or for a system administrator to monitor a TCP service.

Just For Fun Network Management System is a PHP-based network management system that features an integrated syslog, Tacacs, TFTP configuration downloading, SNMP polling, SNMP traps, journalling, auto-discovery, performance graphs (RRD), SLAs, and a lot more.
Just For Fun Network Management System uses MySQL or PostgreSQL as the backend and works under Linux and Windows.
Main features:
- Written in PHP4 (works in PHP5 too)
- Fully tested on Linux, FreeBSD and Win2K
- Should work on any other system which supports PHP
- PHP/cron scripts for polling, analizing and consolidating data
- Database Backend MySQL or PostgreSQL
- Configurable Event Types and Severity Levels
- Modular and Extensible
- Advanced Event Filter
- Interface Autodiscovery
- Licensed under the GNU GPL
- Event Console, Shows Events / Tacacs / Syslog / Alarms in the same time-ordered display
- Map & Sub-Map support
- Graphical Interface Traffic, Round Trip Time, Packet Loss Monitoring, and a LOT more
- Variable Time Span in the graphs
- Total Administration via web
- Sound Alerts in your browser
- Events RDF Feed (for newstickers)
- Works with HTTPS
- Traffic Bytes
- Utilization %
- Packets per Second, Errors per Second, Error Rate
- Round Trip Time and Packet Loss (Cisco & Smokeping)
- Drops
- TCP Connections: Incoming, Outgoing, Established, Delay
- Number of Processes, Number of Users
- Used Memory and Disks with Aggregation
- Processor Utilization and Load Average
- Temperature
- Interfaces (Network cards)
- Host (Processor, Load Average)
- Storage (Disks and Memory)
- Applications Running (HostMIB)
- Cisco Ping (RTT & PL on Cisco)
- BGP4 (BGP sessions status)
- TCP (TCP Connections, Delay)
- Cisco MAC Accounting
- Cisco IP Accounting
- Cisco CSS
- Cisco SA Agent
- Cisco Enviormental (Temperature, Voltage, etc)
- Internet Information Server (IIS) MIB
- Livingstone PortMaster3 Serial Line MIB
- Compaq Insight Manager MIB (Disk, Fan and Temperature)
- Apache /server-status monitoring
- TCP Port Content Regexp Checking (or URL)
- Configurable per Circuit SLAs (with RPN logic)
- Internal Authorization Framework
- Per Event Journals and Acknowledge
- Triggers / Actions Framework for email/others alerts.
- Database Abstraction Framework
- CSV Export
- Distributed Polling
- Object Oriented
- Consistent API
Enhancements:
- Better support for PHP 5 and RRDTool 1.2.x, OS/400 integration, Dell Chassis alarm monitoring, and fixes for all reported issues.

Ptunnel is an application that allows you to reliably tunnel TCP connections to a remote host using ICMP echo request and reply packets, commonly known as ping requests and replies. At first glance, this might seem like a rather useless thing to do, but it can actually come in your help in some cases.
Setting: Youre on the go, and stumble across an open wireless network. The network gives you an IP address, but wont let you send TCP or UDP packets out to the rest of the internet, for instance to check your mail. What to do? By chance, you discover that the network will allow you to ping any computer on the rest of the internet. With ptunnel, you can utilize this feature to check your mail, or do other things that require TCP.
Main features:
- Tunnel TCP using ICMP echo request and reply packets
- Connections are reliable (lost packets are resent as necessary)
- Handles multiple connections
- Acceptable bandwidth (150 kb/s downstream and about 50 kb/s upstream are the currently measured maximas for one tunnel, but with tweaking this can be improved further)
- Authentication, to prevent just anyone from using your proxy

HTTPTunnel is a simple client/server application for creating an HTTP tunnel between two machines, optionally via a Web proxy.
This is a small application for tunnelling an arbitrary TCP socket connection over HTTP. It can be used, for example, to tunnel traffic out from behind a restrictive firewall that only allows outgoing HTTP web connections.
The basic idea is that you run an instance of the HTTP Tunnel application locally in client mode, that then connects out to another instance that you run at the remote end of the tunnel in server mode.
You then connect to the local client end of the tunnel with the application whose traffic you wish to tunnel, and all communications are then wrapped in HTTP. The tunnel may also go via a HTTP proxy, either explicitly or transparently.
Enhancements:
- This release includes some major bugfixes and improvements in the tunneling error detection and retransmission code.
- It also introduces support for building and running under Cygwin.