Free traffic analyser software for linux

Network Traffic Analyser provides a script-driven network traffic monitor.

Network Traffic Analyser (formerly known as sniffer) is designed to be an extremely powerful, configurable, and versatile tool for monitoring network traffic.

It can be used as a plain sniffer, as a tool for accounting, dynamic firewall updates, and many more things.

It features scripting support and an event-driven architecture.

The idea behind this project is to create a powerful tool for playing around with network traffic. The basic concepts are simplicity and flexibility. Instead of building tool that does something specific (and does a good job at it), were trying to build a tool that will be able to do whatever you want it to do (and still be good at it :).

To put it very simply, you write a script that will be invoked for every packet that passes through your network. You write your scripts in a Tcl, fully blown, interpreted programming language. That fact guaranties that you wont be constrained in your creativity.

Python Traffic Analyzer is a Python base class and sample driver script written to retrieve and manipulate images from the TrafficLand cameras and calculate a numeric value representing the current traffic flow.

PyTrAn, an example driver script, an image collector and an image mask creator are available for download from the link shown at the bottom. To use the PyTrAn package begin by choosing a camera that you wish to analyze, for this example well use the camera captioned above.

We want to construct a mask over the area of the image that we are interested in, namely the road. In this particular example the road takes up the majority of the image but that is not always the case.

We will apply the mask over captured images to fine tune the area over which we are looking for movement. To create the mask we will first need to collect a sequential series of snapshots from the target camera. The image_collector.py script was written for this task:

$ mkdir mask_200003
$ cd mask_200003
$ ../image_collector.py 200003 30
Collecting 30 images...
30

Done.

The script is hard coded to capture images on a 2-second delay. The delay is necessary to ensure the image has changed. I believe 2-seconds to be the absolute minimum. Once complete, 30 images numbered 1 through 30 will be created in the current directory.

We construct a mask from these captured images by creating a diff-image for each sequential image pair and then adding each diff-image together. Naturally, a script was written to automate this task as well:

$ ../mask_maker.py 1 30
Creating a diff for each sequential image pair.
Diffing 29

Creating the initial mask from the first image pair.

Adding the rest of the diffs to the mask.
Masking 29

Done.

A number of .diff files are generated in this process. These files repesent the movement between individual sequence pairs.

The .diff files are simply intermediary files, the important bit is the mask file, which is generated as the sum of all differences.

The mask file may be dirty (as in this case) and require manual cleanup. The basic shape of the road however is clearly visible, evidence that we can with minimal effort automate the mask generation process. Also, this run was conducted at night, day-time images yield better results.

There are a few final steps we need to take before we can use the example PyTrAn driver script. First we need to convert the mask to ASCII (noraw) format:

$ pnmnoraw mask > mask_200003.ascii

Then we need to open an ImageMagick display window and get its X-window-ID using xwininfo. Finally, update camera_id and window_id in pytran_sampling.py and launch the driver:

$ ../pytran_sampling.py
DEBUG> grabbing frame from camera 200003
DEBUG> rotating image: pytran.this > pytran.last
DEBUG> refreshing image in 3 secs
taking a 5 minute sample at various thresholds.
DEBUG> grabbing frame from camera 200003
DEBUG> generating frame diff on pytran.last, pytran.this
DEBUG> displaying image: pytran.diff
DEBUG> converting pytran.diff to ascii
DEBUG> calculating traffic ratio...
ratio[5]: 55%
DEBUG> calculating traffic ratio...
ratio[10]: 52%
...
...
5 minute sample[5]: 67.88
5 minute sample[10]: 42.66
5 minute sample[15]: 30.57
5 minute sample[20]: 23.03
5 minute sample[25]: 18.39
5 minute sample[30]: 14.79
5 minute sample[35]: 12.42
5 minute sample[40]: 10.53
5 minute sample[45]: 9.06
5 minute sample[50]: 7.85

The sampling script will take 5 minute samples at varying color thresholds. The optimal threshold must be manually chosen. Furthermore, you will need to sample the traffic ratios during both heavy and light traffic times to get a good feel for your acceptable range. Also, keep in mind that the traffic ratio value is simply the percent change detected, or in other words the movement detected within the masked region. This means that a completely empty road will register similar values to a road so congested it looks like a parking lot. The time of day can be combined with the traffic ration to determine the logical truth.

With this task implemented and abstracted more complex systems can be built. When I find the time Id like to create a system that will take multiple potential travel routes and times, and during the travel time e-mail the traveler with the best route to take. Another idea I had would be to record the traffic flow values for each camera, for each day and for each half hour interval. Travelers and other interested parties can then analyze traffic patterns to determine the fastest route dependant on date/time.

Air Traffic Controller project is an air traffic controller simulation.

Airtraffic is a game/simulator that puts you into an air traffic controllers hotseat. Planes come into your airspace from various directions and you have to guide them safely to their destinations. It uses Python, Corba, and GTK.

Statistical Traffic Analysis Kit is a set of command-line traffic analysis tools, designed to help a network administrator to see what is happening at a router at the moment.

Unlike tcpdump (1), the stak set uses statistical and stream-oriented methods, and will rarely produce an output stream at a speed beyond human perception. The output is less accurate.

The kit consists of five different utilities, designed to perform the following tasks:
estimating overall traffic rates (stakrate),
determining network nodes generating the highest traffic (stakhosts)
monitoring the amount of traffic exchanged with particular autonomous
systems (stakasta),
extracting strings from packets (stakextract),
determining connections and flows generating the highest traffic
(stakstreams, experimental),

DNA (Deep Network Analyser) is an open, flexible, and extensible deep network analyzer server and software architecture for passively gathering and analyzing network packets, network sessions, and applications protocols.
Deep Network Analyser project is designed to be used for Internet security, network management, intrustion detection, protocol and network analysis, information gathering, and network monitoring applications.
Main features:
- Extensible Java based network sensor (processing layers 2-7)
Configurable processing and output:
- Packet flows like Ethereal
- IP Flows like CISCO netflow
- Stateful Sessions (client/server flow pairs)
- Application protocol element output
- Configurable and extensible application protocol element parsing.
- Application protocol parsing toolkit APIs allows for new protocol parser to be easily developed and extended
- Targeting based full session capture facility, like a realtime targeted TCPDump.
- Flexible targeting from IPAddr, Port tuple to Application sensitive targeting.
- Configurable and extensible output forwarding (file, DB, Streams, JMS, RMI, etc.)
- Extensible realtime collection portable to many OS/Packet processing environments
Easily adaptable to packet processing environments:
- Specialized linux drivers mechanismon
- Network Appliances
- Network Switches / Routers
- Highly mutithreaded for increased performance over multi processor environments
Enhancements:
- Adoption of OpenAdaptor(tm) as the Output Adapter mechanism.
- Support for local-only administration.
- A new targeted packet capture parser, new run scripts, and a new install mechanism.
- Many bugfixes.

trafflogger is a conf-based traffic logger. All the logged data can be displayed (graphed) via a web interface. Users can use it to get a global view of network load or to get a closer look at any of the hosts.
This is a conf based traffic logger, each conf log in/out traffic for:
some definable hosts
in a definable device
which match a (optional) definable pcap filter
All the logged data can be displayed (actually graphed) via a web cgi.
So you can get golbal view of your network load and either get a closer look for any of the hosts(very usefull if you are a [mini|wanabe]ISP). Keep in mind that you can make multiples confs for the same host/s, changing only de pcap rule, doing this you are taking photos of your network from multiples angles. You can make a conf to log web traffic, otherone to log mail traffic, and otherone to log kazaa traffic, and finally one to log all traffic. You can also use pcap filter to discrime unwanted traffic for a specific conf.
Main features:
- Coded in Perl
- rrdtool powered
- libpcap powered
- log ip traffic
- traffic grapher/analyzer
- web output
- dynamic ip support

Traffic Control Super Script implements traffic shaping for IP traffic passing through a NAT/bridge box with a single configuration file with one line per host.
Traffic Control Super Script can manage bandwidth to user-specified speeds based on the u32 classifier, and can identify traffic by source, destination, source and destination port, protocol, and ToS field. It then limits the rate of connection in either a single or a bidirectional fashion.
Enhancements:
- This release adds multiple interface support.
- It adds an option to choose between flat file and MySQL rules databases.
- It fixes bug #1469742 (duplicate group breaking child / parent relationships when direction=bi on group definitions).
- Various minor bugs have been fixed.
- There are major code cleanups, and major documentation updates on the Web site.