Does anyone know if theres NFAT for Linux? The Linux community seems to always be on top of security/admin related tools but this is one area where it isn't. NFAT would help to increase a admins ability for Fault, Configuration, Accounting, Performance, and Security management (FCAPS), and also incident response and forensics. I want a NFAT server without having to buy NetIntercept or similar.

have you tried snort???

http://www.snort.org


there's also distros aimed at forensics, for example, FIRE:

http://fire.dmzs.com/

NFAT is used to store and analyze network traffic information, which is great for amoung other things, having more evidence about a incident. It's different than FIRE. Its a great addition to IDS's such as Snort, infact i'm sure you could use Snorts packet sniffing ability to create a basic NFAT server. It could log information about every connection like the socket pairs, protocol, time the session took place, duration of the session, amount of data transfered, user ID's, FTP file names transfered, etc. Unfortunately i don't know of any addon to Snort that could do that.

I use a package calle IPtraf, and another called Ethereal.

here's the links for those in case anybody needs them:

http://www.ethereal.com

http://iptraf.seul.org/


here's a nice article about ethereal:

http://www.linuxjournal.com/article.php?sid=6842

This is pretty ghetto compared to NFAT but i'll take what i can get. Why do you use IPtraf and Ethereal? Theres no doubt Ethereal is nice but i want something that can automatically analyze a packet dump or work in real time, and produce some useful information. Ethereal has some nice filters but it would be to manual and tedious to go through a huge packet dump.

http://www.qosient.com/argus/ Doesn't come close to being a NFAT system but it looks promising. I'll keep googling around for traffic analysis and see if i can come up with anything else.