Open Source BSD Network Monitoring Software

Osquery is an operating system instrumentation framework for Windows, OS X (macOS), Linux, and FreeBSD. The tools make low-level operating system analytics and monitoring both performant and intuitive. Osquery exposes an operating system as a high-performance relational database. This allows you to write SQL queries to explore operating system data. With osquery, SQL tables represent abstract concepts such as running processes, loaded kernel modules, open network connections, browser plugins, hardware events or file hashes.Osquery queries your devices like a database. Osquery uses basic SQL commands to leverage a relational data-model to describe a device. Frequently, attackers will leave a malicious process running but delete the original binary on disk. This query returns any process whose original binary has been deleted, which could be an indicator of a suspicious process.

Zabbix is an enterprise-class open source distributed monitoring solution designed to monitor and track performance and availability of network servers, devices and other IT resources. It supports distributed and WEB monitoring, auto-discovery, and more. An enterprise-class distributed monitoring solution for networks & apps

NSClient++ is a windows service that allows performance metrics to be gathered by Nagios (and possibly other monitoring tools). It is an attempt to create a NSClient and NRPE compatible but yet extendable performance service for windows.

BASE is the Basic Analysis and Security Engine. It is based on the code from the Analysis Console for Intrusion Databases (ACID) project. This application provides a web front-end to query and analyze the alerts coming from a SNORT IDS system.

The fetchlog utility displays the last new messages of a logfile (syslog). fetchlog is similar like tail but offers some extra functionality like pattern matching with regular expressions, output formatting for email, SMS, pager or SNMP tools, etc.

tcpick is a textmode sniffer; it tracks tcp streams, shows the status, reassembles and saves the data captured in files or displays them in the terminal in different modes (ascii, hex..). There is a color-mode. Useful to get files passively.

nload is a console application which monitors network traffic and bandwidth usage in real time. It visualizes the in- and outgoing traffic using two graphs and provides additional info like total amount of transfered data and min/max network usage.

Node Runner is a PHP network monitor which is designed to contact network nodes in a specific order based on the hierarchy of your network. If a node does not respond, each of its parents are systematically checked until the true problem is identified.

Hyperic is application monitoring and performance management for virtual, physical, and cloud infrastructures. Auto-discover resources of 75+ technologies, including vSphere, and collect availability, performance, utilization, and throughput metrics.

Lilith is a logging and access event viewer for Logback, log4j & java.util.logging. It has features comparable to Chainsaw for log4j. This means that it can receive logging events from remote applications using Logback as their logging backend

Output spool reader for Snort! This program decouples output overhead from the Snort network intrusion detection system and allows Snort to run at full speed. It takes input and output plugins and can therefore be used to convert almost any spooled fil

Show system and ISDN information on external liquid crystal displays

pcapsipdump is libpcap-based SIP sniffer with per-call sorting capabilities. It writes SIP/RTP sessions to disk in a same format, as "tcpdump -w", but one file per SIP session (even if there is thousands of concurrent SIP sessions). Getting started: http://pcapsipdump.sf.net/

OpenXDAS is an open source implementation of the Open Group's Distributed Auditing Service (XDAS) specification. OpenXDAS provides a complete implementation of the XDAS specification API, including client-side instrumentation and filtering.

netleak is a collection of small perlscripts that detects connectivity between network segments. It is mostly useful to detect "leaks" in large organizations that have private network segments physically separated from the Internet.

IP accounting tools package based on Berkeley Packet Filer mechanism. Continue from BPFT by V.Vorobyev, TRAFD by V.Belekhov & S.Svirid. Use the PCAP library to implement connection to bpf kernel pseudo-device.

This is a set of perl and php scripts that are used to collect, process, store and display netflow data.

Multiplatform: Easy setup Syslog Server tool for recording network messages. It opens the UDP port 514 on your computer to act as Syslog Server and displays the messages immediately in your screen.

Flexible web-based firewall log analyzer, supporting netfilter and ipfilter, ipfw, ipchains, cisco routers and Windows XP system logs, and mysql or postgresql database logs using the iptables ULOG or NFLOG target of netfilter others mapped to the ulogd format with a view. Fully supports IPv6 for database logs, and netfilter and ipfilter system file logs. Also supports Maxmind's GeoIP version 2 location databases. For Linux, FreeBSD, OpenBSD, Solaris, OSX,etc.

justniffer is a TCP sniffer. It reassembles and reorders packets and displays the tcp flow in a customizable way. It can log network traffic in web server log format. It can also log network services performances (e.g. web server response times) and extract http content (images, html, scripts, etc)

Big Sister is an SNMP aware network and system monitor

glFlow is a robust, fast, portable, pcap-centric (D)DoS detection tool.

Automated Security Tools (autosec) aims to provide automatic tools which network administrators may use to help check and test the security of their network.

What are the packets rejected by your Netfilter based firewall today ? How often this suspicious host try to connect to your box ? What are the most rejected domains ? Who is this strange host which scan your ports ? The responses are in the iptables log

ESM (Extensible System Monitor) is a daemon that lets you tie together plugins to monitor and report on your system. The plugins communicate with ESM via standard input and standard output and can be easilly written in any language.