LinuxQuestions.org
Latest LQ Deal: Complete CCNA, CCNP & Red Hat Certification Training Bundle
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Networking
User Name
Password
Linux - Networking This forum is for any issue related to networks or networking.
Routing, network cards, OSI, etc. Anything is fair game.

Notices


Reply
  Search this Thread
Old 04-11-2004, 06:46 PM   #1
OlRoy
Member
 
Registered: Dec 2002
Posts: 304

Rep: Reputation: 86
Network Forensic Analysis Tool for Linux?


Does anyone know if theres NFAT for Linux? The Linux community seems to always be on top of security/admin related tools but this is one area where it isn't. NFAT would help to increase a admins ability for Fault, Configuration, Accounting, Performance, and Security management (FCAPS), and also incident response and forensics. I want a NFAT server without having to buy NetIntercept or similar.
 
Old 04-11-2004, 07:11 PM   #2
win32sux
LQ Guru
 
Registered: Jul 2003
Location: Los Angeles
Distribution: Ubuntu
Posts: 9,870

Rep: Reputation: 377Reputation: 377Reputation: 377Reputation: 377
have you tried snort???

http://www.snort.org


there's also distros aimed at forensics, for example, FIRE:

http://fire.dmzs.com/
 
Old 04-11-2004, 07:45 PM   #3
OlRoy
Member
 
Registered: Dec 2002
Posts: 304

Original Poster
Rep: Reputation: 86
NFAT is used to store and analyze network traffic information, which is great for amoung other things, having more evidence about a incident. It's different than FIRE. Its a great addition to IDS's such as Snort, infact i'm sure you could use Snorts packet sniffing ability to create a basic NFAT server. It could log information about every connection like the socket pairs, protocol, time the session took place, duration of the session, amount of data transfered, user ID's, FTP file names transfered, etc. Unfortunately i don't know of any addon to Snort that could do that.
 
Old 04-11-2004, 08:13 PM   #4
tekhead2
Member
 
Registered: Apr 2004
Distribution: slackware/FreeBSD/Vector
Posts: 291

Rep: Reputation: 52
I use a package calle IPtraf, and another called Ethereal.
 
Old 04-11-2004, 08:18 PM   #5
win32sux
LQ Guru
 
Registered: Jul 2003
Location: Los Angeles
Distribution: Ubuntu
Posts: 9,870

Rep: Reputation: 377Reputation: 377Reputation: 377Reputation: 377
here's the links for those in case anybody needs them:

http://www.ethereal.com

http://iptraf.seul.org/


here's a nice article about ethereal:

http://www.linuxjournal.com/article.php?sid=6842



Last edited by win32sux; 04-11-2004 at 08:23 PM.
 
Old 04-12-2004, 11:52 AM   #6
OlRoy
Member
 
Registered: Dec 2002
Posts: 304

Original Poster
Rep: Reputation: 86
Quote:
Originally posted by tekhead2
I use a package calle IPtraf, and another called Ethereal.
This is pretty ghetto compared to NFAT but i'll take what i can get. Why do you use IPtraf and Ethereal? Theres no doubt Ethereal is nice but i want something that can automatically analyze a packet dump or work in real time, and produce some useful information. Ethereal has some nice filters but it would be to manual and tedious to go through a huge packet dump.

http://www.qosient.com/argus/ Doesn't come close to being a NFAT system but it looks promising. I'll keep googling around for traffic analysis and see if i can come up with anything else.
 
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off



Similar Threads
Thread Thread Starter Forum Replies Last Post
Any Network Traffic Analysis Program for LINUX? seow_ming Linux - Software 6 12-25-2012 07:04 AM
Graphical Network Analysis tokehs Linux - Networking 3 06-09-2005 01:00 PM
Linux chat tool for internal network ramdak5000 Linux - Software 5 01-31-2005 08:40 AM
Network Forensic satimis Linux - Security 3 02-27-2004 11:48 AM
Can anyone recommend an IPtables log analysis tool? steppin_razor Linux - Networking 2 11-13-2001 11:14 AM

LinuxQuestions.org > Forums > Linux Forums > Linux - Networking

All times are GMT -5. The time now is 02:24 PM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration