Free traffic analysis software for linux

Network Traffic Analyser provides a script-driven network traffic monitor.

Network Traffic Analyser (formerly known as sniffer) is designed to be an extremely powerful, configurable, and versatile tool for monitoring network traffic.

It can be used as a plain sniffer, as a tool for accounting, dynamic firewall updates, and many more things.

It features scripting support and an event-driven architecture.

The idea behind this project is to create a powerful tool for playing around with network traffic. The basic concepts are simplicity and flexibility. Instead of building tool that does something specific (and does a good job at it), were trying to build a tool that will be able to do whatever you want it to do (and still be good at it :).

To put it very simply, you write a script that will be invoked for every packet that passes through your network. You write your scripts in a Tcl, fully blown, interpreted programming language. That fact guaranties that you wont be constrained in your creativity.

Python Traffic Analyzer is a Python base class and sample driver script written to retrieve and manipulate images from the TrafficLand cameras and calculate a numeric value representing the current traffic flow.

PyTrAn, an example driver script, an image collector and an image mask creator are available for download from the link shown at the bottom. To use the PyTrAn package begin by choosing a camera that you wish to analyze, for this example well use the camera captioned above.

We want to construct a mask over the area of the image that we are interested in, namely the road. In this particular example the road takes up the majority of the image but that is not always the case.

We will apply the mask over captured images to fine tune the area over which we are looking for movement. To create the mask we will first need to collect a sequential series of snapshots from the target camera. The image_collector.py script was written for this task:

$ mkdir mask_200003
$ cd mask_200003
$ ../image_collector.py 200003 30
Collecting 30 images...
30

Done.

The script is hard coded to capture images on a 2-second delay. The delay is necessary to ensure the image has changed. I believe 2-seconds to be the absolute minimum. Once complete, 30 images numbered 1 through 30 will be created in the current directory.

We construct a mask from these captured images by creating a diff-image for each sequential image pair and then adding each diff-image together. Naturally, a script was written to automate this task as well:

$ ../mask_maker.py 1 30
Creating a diff for each sequential image pair.
Diffing 29

Creating the initial mask from the first image pair.

Adding the rest of the diffs to the mask.
Masking 29

Done.

A number of .diff files are generated in this process. These files repesent the movement between individual sequence pairs.

The .diff files are simply intermediary files, the important bit is the mask file, which is generated as the sum of all differences.

The mask file may be dirty (as in this case) and require manual cleanup. The basic shape of the road however is clearly visible, evidence that we can with minimal effort automate the mask generation process. Also, this run was conducted at night, day-time images yield better results.

There are a few final steps we need to take before we can use the example PyTrAn driver script. First we need to convert the mask to ASCII (noraw) format:

$ pnmnoraw mask > mask_200003.ascii

Then we need to open an ImageMagick display window and get its X-window-ID using xwininfo. Finally, update camera_id and window_id in pytran_sampling.py and launch the driver:

$ ../pytran_sampling.py
DEBUG> grabbing frame from camera 200003
DEBUG> rotating image: pytran.this > pytran.last
DEBUG> refreshing image in 3 secs
taking a 5 minute sample at various thresholds.
DEBUG> grabbing frame from camera 200003
DEBUG> generating frame diff on pytran.last, pytran.this
DEBUG> displaying image: pytran.diff
DEBUG> converting pytran.diff to ascii
DEBUG> calculating traffic ratio...
ratio[5]: 55%
DEBUG> calculating traffic ratio...
ratio[10]: 52%
...
...
5 minute sample[5]: 67.88
5 minute sample[10]: 42.66
5 minute sample[15]: 30.57
5 minute sample[20]: 23.03
5 minute sample[25]: 18.39
5 minute sample[30]: 14.79
5 minute sample[35]: 12.42
5 minute sample[40]: 10.53
5 minute sample[45]: 9.06
5 minute sample[50]: 7.85

The sampling script will take 5 minute samples at varying color thresholds. The optimal threshold must be manually chosen. Furthermore, you will need to sample the traffic ratios during both heavy and light traffic times to get a good feel for your acceptable range. Also, keep in mind that the traffic ratio value is simply the percent change detected, or in other words the movement detected within the masked region. This means that a completely empty road will register similar values to a road so congested it looks like a parking lot. The time of day can be combined with the traffic ration to determine the logical truth.

With this task implemented and abstracted more complex systems can be built. When I find the time Id like to create a system that will take multiple potential travel routes and times, and during the travel time e-mail the traveler with the best route to take. Another idea I had would be to record the traffic flow values for each camera, for each day and for each half hour interval. Travelers and other interested parties can then analyze traffic patterns to determine the fastest route dependant on date/time.

Sequence Analysis project is a collage of coding projects which I have written over the past several years for various clients in my work as a bioinformatics consultant.

These clients have graciously allowed me to release these works into the public domain as freeware for Macintosh OS X in order to promote the platform and to encourage migration from Classic.

The upper window panel can hold several sequences, which are both editable and selectable. The tabs in the lower analysis panel try to keep up with the current sequence selection to provide immediate feedback. The selection is used in some modules as only the portion being analyzed for other modules i.e. Digest is used to determine if enzymes cut in the in or outside of the selection.

Most commonly available sequence formats have been reverse engineered. You can also access a sequences from the NCBI via its GID or UID. This currently cannot be done from behind a firewall.

Most of the analyses are simple enough that they are obvious to use, Composition, pI. Others could stand some documenation i.e. Pairwise and Primer Design. The Publish tab uses a string to control the layout. Click on the Legend button for some help.

Network Security Analysis Tool is a fast, stable bulk security scanner designed to audit remote network services and check for versions, security problems, gather information about the servers and the machine, and much more.

A manpage providing extensive information on NSAT has been included in the distribution. It is available after a make install, or just by typing man doc/nsat.8 from this dir. It is suggested that you inform yourself at least about the -v (scan verbosity) option and edit the configuration file. To learn about changes in this version, please consult doc/CHANGES.

New to this version is support for distributed scanning. The manpage describes how to do a distributed scan. Note that distributed scanning in this version is just a preliminary, proof-of-concept, implementation with no guarantees for its security, reliability, or performance.

Check for updated vulnerability lists, config files, etc. from
http://nsat.sourceforge.net

Currently, these are lists of vulnerabilities:

nsat.cgi (CGI scripts)
nsat.conf (configuration)
src/mod/snmp.h (SNMP community names)

Air Traffic Controller project is an air traffic controller simulation.

Airtraffic is a game/simulator that puts you into an air traffic controllers hotseat. Planes come into your airspace from various directions and you have to guide them safely to their destinations. It uses Python, Corba, and GTK.

IP Traffic Meter is a traffic counter for IPv4 addresses. It uses the DB4 database from Berkeley to keep its counters, the pcap library for monitoring, and the gd library from Boutel to create graphics. The results are displayed in JPEG graphics on an HTML webpage.
Enhancements:
- With ipmeter you can monitor the traffic made by some IPs. It produces daily, weekly, monthly and yearly statistics into jpg graphics. It uses db4 database from Berkeley to keep its internal counters, and gd library from Boutell to create jpg graphic.

TraffStats is a monitoring and traffic analysis application that uses SNMP to collect data from any enabled device. It has the ability to generate graphs (using jpgraph) with the option to compare and sum up different devices.
The project has a multiuser-design with rights-management and support for multiple languages (English and German are implemented).
TraffStats HowTo: http://traffstats.sourceforge.net/howto/
Enhancements:
- updated to the newest version of JpGraph and php-base-sys-zero.
- some work has been investigated in packaging TraffStats and JpGraph; now there is a convenient way to install on debian (a repository will be available soon).
- HowTo updated.