sf

Stenographer is a full-packet-capture utility for buffering packets to disk for intrusion detection as well as incident response purposes. It provides a high-performance implementation of NIC-to-disk packet writing, handles deleting those files equally disk fills up, as well as provides methods for reading dorsum specific sets of packets speedily as well as easily. It is designed to: Write packets to disk, really speedily ( 10Gbps on multi-core, multi-disk machines) Store equally much history equally it tin (managing disk usage, storing longer durations when traffic slows, as well as thus deleting the oldest packets when it hits disk limits) Read a really pocket-sized per centum (<1%) of packets from disk based on analyst needs It is NOT designed for: Complex packet processing (TCP flow reassembly, etc) It’s fast because it doesn’t practice this.  Even amongst the really minimal, single-pass processing of packets nosotros do, processing 1Gbps for indexing lo...

netsniff-ng is a gratuitous Linux networking toolkit, a Swiss terra firma forces knife for your daily Linux network plumbing if you lot will. Its gain of functioning is reached yesteryear zero-copy mechanisms, so that on parcel reception and transmission the gist does non involve to re-create packets from gist infinite to user infinite in addition to vice versa. Our toolkit tin move used for network evolution in addition to analysis, debugging, auditing or network reconnaissance. The netsniff-ng toolkit consists of the next utilities: netsniff-ng , a fast zero-copy analyzer, pcap capturing in addition to replaying tool trafgen , a multithreaded low-level zero-copy network parcel generator mausezahn , high-level parcel generator for HW/SW appliances amongst Cisco-CLI* bpfc , a Berkeley Packet Filter compiler, Linux BPF JIT disassembler ifpps , a top-like gist networking statistics tool flowtop , a top-like netfilter connector tracking tool curvetun , a lightweight ...

PF_RING™ is a novel type of network socket that dramatically improves the bundle capture speed, in addition to that’s characterized yesteryear the next properties: Available for Linux kernels 2.6.32 in addition to newer. No ask to piece the kernel: simply charge the heart module. 10 Gbit Hardware Packet Filtering using commodity network adapters User-space ZC (new generation DNA, Direct NIC Access) drivers for extreme bundle capture/transmission speed equally the NIC NPU (Network Process Unit) is pushing/getting packets to/from userland without whatsoever heart intervention. Using the 10Gbit ZC driver y'all tin send/received at wire-speed at whatsoever bundle sizes. PF_RING ZC library for distributing packets inward zero-copy across threads, applications, Virtual Machines. Device driver independent. Support of Accolade, Exablaze, Endace, Fiberblaze, Inveatech, Mellanox, Myricom/CSPI, Napatech, Netcope in addition to Intel (ZC) network adapters. Kernel-based bundle ...

Joy is a BSD-licensed libpcap-based software bundle for extracting information features from alive network traffic or packet capture (pcap) files, using a flow-oriented model like to that of IPFIX or Netflow, too and then representing these information features inward JSON. It also contains analysis tools that tin travel applied to these information files. Joy tin travel used to explore information at scale, peculiarly safety too threat-relevant data. JSON is used inward social club to brand the output easily consumable past times information analysis tools. While the JSON output files are somewhat verbose, they are reasonably small, too they response good to compression. Joy tin travel configured to obtain intraflow data, that is, information too information virtually events that hap inside a network flow, including: the sequence of lengths too arrival times of IP packets, upwards to roughly configurable number of packets. the empirical probability distrib...