Open Source Perl Networking Software

BASE is the Basic Analysis and Security Engine. It is based on the code from the Analysis Console for Intrusion Databases (ACID) project. This application provides a web front-end to query and analyze the alerts coming from a SNORT IDS system.

This is a set of perl and php scripts that are used to collect, process, store and display netflow data.

Big Sister is an SNMP aware network and system monitor

netleak is a collection of small perlscripts that detects connectivity between network segments. It is mostly useful to detect "leaks" in large organizations that have private network segments physically separated from the Internet.

360-FAAR (Firewall Analysis Audit and Repair) is an offline, command line, firewall policy manipulation tool to filter, compare to logs, merge, translate and output firewall commands for new policies, in Checkpoint dbedit, Cisco ASA or ScreenOS commands, and its one file! Read Policy and Logs for: Checkpoint FW1 (in odumper.csv / logexport format), Netscreen ScreenOS (in get config / syslog format), Cisco ASA (show run / syslog format), 360-FAAR compares firewall policies and uses CIDR and text filters to split rulebases / policies into target sections and identify connectivity for further analysis. 360-FAAR supports, policy to log association, object translation, rulebase reordering and simplification, rule moves and duplicate matching automatically. Allowing you to move rules to where you need them. Build new rulebases from scratch with a single 'any' rule and log files, with the 'res' and 'name' options. Switch into DROPS mode to analyse drop log entries.

Cisco Perl Tools contains CIPAT (Cisco IP Accounting aggregator) and ISDN-Reporter (Cisco ISDN call aggregation and reporting tool). [NetProvisioning has moved to its own project page on SF]

IP accounting tools package based on Berkeley Packet Filer mechanism. Continue from BPFT by V.Vorobyev, TRAFD by V.Belekhov & S.Svirid. Use the PCAP library to implement connection to bpf kernel pseudo-device.

NeTAMS - Network Traffic Accounting and Monitoring Software. It is built for UNIX and works for networks with Cisco routers or PC Unix routers (Linux/FreeBSD/Solaris).

Netlog is a simple network traffic monitor for Linux, written in Perl. It is very easy to use and suitable for workstations and servers. It can log the traffic on different interfaces and the uptime of the controlled Computer.

Perl logfile analyzer for DELL Sonicwall Firewall logfiles. This Perl program (Windows /Linux / Mac), creates an HTML file containing: hits per protocol, mean, median and variance on hourly and weekday basis, RBL statistics, IPS stats, VPN stats, virus stats, surfing statistics, CFS blocked sites stats.

The nfcount can be used for count network flows by using rules and display it in form of set html pages. Support network flow records from Cisco NetFlow, Argus, Cisco IP Accounting.

Automated Incident Reporting (AirCERT) is an Internet-scalable infrastructure to automatically receive, process, and analyze security event information reported from across administrative domains.

Autocheck is a distributed, extensively configurable, systems monitoring tool for unix'es written in Perl. It includes SMS and email notification and a lot of checks.

Benson is an automated monitoring system designed to ease the life of a network, system, and database administrator. Benson harness the power of Perl for flexibility all while maintaining the low foot print required of a networked monitoring system.

Bionanny is a tool for Web Services providers. It allows to monitor other Web Services. It can intercept requests incoming from clients, pass it to the destination Web Service and log number of requests and elapsed time spend by services.

IP traffic accounting on CISCO routers.

The Distributed Intrusion Detection System.

FWReport is a log parser and reporting tool for IPTables. It generates daily and monthy summaries of the log files, allowing the admin to free up substantial time, maintain better control over security of the network, and reduce unnoticed attacks.

FWNUA (Free Windows Network User Accounting) runs silently in a Windows login script or GPO and collects data about user logins. FWNUA keeps track of the workstations logins so you don't have to! FWNUA now supports syslog and Splunk! Look for the fwnua - syslog version in the files list. Use Splunk or your own syslog server with data mining tools to create a robust user tracking system. Find our Spunk app on Splukbase: https://splunkbase.splunk.com/app/2773/

A set of perl script to be used with Hobbit or Big Brother monitoring system. netapp.pl - check netapp storage via rsh beastat.pl - use weblogic.jar to check BEA WLS Server dbcheck.pl - use DBI/DBD perl libraries to check Oracle/Informix/SQLServer

HotSaNIC is a Web-based information center for Unix-based systems. It gives you a graphical overview about certain network- and system statistics. HotSaNIC is programmed (mainly in Perl 5) in a modular way to give you a great flexibility of which items yo

IP Traffic Volume: Logs (counts) in- & outgoing bytes through network device(s) using kernel iptables. Highly configurable as to which bytes are logged, e.g. to/from specific ports or ip-addresses. Data displayed in html via cgi or plain ascii to console

IPFWstats is a suite of shell, perl and PHP scripts to count network traffic on a per user basis on a server using the FreeBSD IPFW firewall. Statistics are imported into a MySQL database daily and can then be viewed using a PHP script in a web browser

What are the packets rejected by your Netfilter based firewall today ? How often this suspicious host try to connect to your box ? What are the most rejected domains ? Who is this strange host which scan your ports ? The responses are in the iptables log

This very simple perl script parses you iptables log files and produces a report in text format with a summary based on the prefix of the log ( --log-prefix option of iptables ). Prefix description is allowed.