| GPP - A General Purpose Proxy Java graphical application intended mainly for packet inspection and modification. It's main idea is to be a little user-friendly portable man-in-the-middle tool for security analysis. Later, some protocols should be added. alpha |
| Ethereal - A network protocol analyzer for Unix and Windows. It allows you to examine data from a live network or from a capture file on disk. You can interactively browse the capture data, viewing summary and detail information for each packet. Distributed under the GNU General Public License. For Windows 95/98/NT/2000/XP, all Linux/BSD/UNIX type systems including Mac OS X, Solaris, IBM AIX. Written in C. |
|
jpcap - A set of Java classes which provide an interface and system for network packet capture. A protocol library and tool for visualizing network traffic is included. jpcap utilizes libpcap, a widely deployed system library for packet capture. It is a stable product released under Mozilla Public License 1.1. For Windows 95/98/NT/2000/XP, all Linux/BSD/UNIX type systems, OS X, Solaris. Written in C and Java. The jpcap distribution includes a tool for real-time network traffic capture and analysis, and an API for developing packet capture applications in Java.
The jpcap network capture tool performs real-time decomposition and visual representation of network traffic. The jpcap API allows developers to create their own packet capture applications. The jcap distribution comprises five packages: (1) "capture" provides an interface for capturing packets and a layer of abstraction around libpcap, a portable native system library for capturing network packets. (2) "client" provides sample 'client' applications which utilize the services provided by classes in the capture package. (3) "net" provides a hierarchical inheritance-based library of network packet types and protocols. (4) "simulator" simulates the PacketCapture class available in the jpcap.capture package, to ease development. (5) "util" provides utility classes used by the other jpcap packages. |
| Packetyzer - A network protocol analyzer for Windows, also know as a packet sniffer. It is based on the Ethereal project, but provides a native Windows GUI. Packetyzer can capture from virtually any network adapter and supports many advanced features. Written in C and Delphi/Kylix. Distributed under the GNU General Public License. For Windows 95/98/NT/2000/XP. |
| ipaudit - A distribution of two Packages: (1) Command line network monitoring tool that sniffs packets for a fixed time and then reports total byte and packet counts for each connection (ip/port pairs and protocol). (2) Web reports based on collected data from one. Ipaudit is a stable product licensed persuant to the GNU General Public License. Written in C, Perl, and Unix Shell, ipaudit runs on all Linux/BSD/UNIX type systems. Uses a web-based user interface. |
| libpcap - A system-independent interface for user-level packet capture. libpcap provides a portable framework for low-level network monitoring. Applications include network statistics collection, security monitoring, network debugging, etc. Libcap is a stable package, written in C, and distributed under the BSD License. It runs as a daemon on all Linux/BSD/UNIX type operating systems. |
|
TCPreen - A simple tool to monitor and analyze data transmitted between clients and servers through connection-oriented streams data such as a TCP sessions; it supports TCP over either IPv4 or IPv6. This tool focuses on the data stream (software/socket layer), not on the lower level transmission protocol as packet sniffers do.
TCPreen listens on a TCP port and waits for incoming connections. It forwards data sent by the connecting client to another server port and forwards server responses back to the client. This software it was intended to help developers reverse-engineer TCP-based protocols, but it has also proved very useful for debugging network server or client software. System administrators can monitor a TCP service. For Windows 95/98/NT/2000/XP, and all Linux/BSD/UNIX type operating systems, OS X, and Solaris. GNU General Public License |
| Network Sniffer - Sniffer Server - decodes TCP streams and captures packets in general The captured content may be saved to files or sent to a client over TCP/IP connection (self-defined protocol). For Windows 95/98/NT/2000/XP. Written in C and Java. Distributed pursuant to the GNU General Public License. |
| AirTraf - 802.11b network analyzer - An entirely passive network sniffer/analyzer that auto-detects wireless access points, determines wireless nodes associated with the given access points operating at its channels, tracks packet count/byte information of different types of 802.11b. Written in C, Java, and PHP. AirTraf uses a Curses/Ncurses, as well as a web-based user interface. GNU General Public License. |
| The fairly fast packet filter - FFPF- A network packet filtering framework that adds many new features to existing filtering solutions like BPF. FFPF is designed for high speed by pushing computationally intensive tasks to the kernel or even network processors and by minimizing packet copying. It purports to be considerably more flexible than existing approaches. It is written in C and runs as a daemon on any Linux/BSD/UNIX system. Distributed pursuant to the BSD License, and the GNU General Public License. |
| IPgrab - A verbose packet sniffer that displays a great amount of detail on each packet it reads, including application layer fields. It is a stable package, written in C and Unix Shell. It runs on Linux/BSD/UNIX and is distributed under the GNU General Public License. |
| NetMate Meter - A flexible and extensible tool for network measurement. It can be used for accounting, delay/loss measurement, packet capturing. It supports dynamic loadable packet processing and data export modules and a flexible packet classifier. For FreeBSD, Linux, and Solaris. It is written in C++ and uses command line and web user interfaces. GNU General Public License. |
| NF High Performance Packet Classifier - A high performance packet classification package for netfilter (the linux 2.4 kernel firewall). It uses an additional filter table with an efficient data structure for high bandwidth and/or large rulesets. This is a stable Linux/BSD/UNIX-like package, written in C, and distributed under the GNU General Public License. |
| Radstock - A tool to analyse RADIUS traffic on high volume radius servers. It has the ability to fully decode each packet, and also has extensive filters capabilities to allow you to selectively match radius packets. Written in C for Linux/BSD/UNIX. GNU General Public License. |
|
Packet Inspector - A multipurpose sniffer/interceptor/logger for LAN's. It recognizes a large number of Protocols, and many filtering options. It is possible to define filters that reference packet payload content and TCP flags. You can create your own plugins in VisualBASIC.NET. Additional features include: the ability to reconstruct TCP Sessions; a flexible Packet Generator; network intrusion detection; and other monitoring and disposition capabilities.
For Windows 9x/NT/2000/XP, this package is written in VisualBASIC.net, and therefor requires the .net runtime. It is distributed under the GNU General Public License. |
| PasTmon - The Passive Application Response Time Monitor - A passive network traffic analyser that can measure user transaction response times of web, ftp, dns, irc, pop, mail, postgresql, and mysql database servers. You can define your own signature rules to monitor custom TCP based applications. PasTmon is a server administrator's tool for measuring application performance and response times. PasTmon is licensed under the GNU General Public License. It is available for Linux/Unix systems utilising libpcap packet capture. It runs as a daemon, and through a web interface, can be configured for many protocols. |
| echolot - network station monitor - echolot implements a packet sniffer that grabs ARP packets on any ethernet device. Echolot collects MAC addresses and tries to resolve a name for each host, Collected information is stored in a database, which can be instrumental in identifying intruders on a network. Echolot is a stable package, written in C, for all Linux/BSD/UNIX systems. |
I believe this software to be useful, but naturally, I cannot give assurances about the suitability of any package for a particular purpose.