Tools Used in USENIX Day One Class

I'm teaching Network Security Monitoring in about 12 hours here at USENIX LISA 2005. If any of you attendees would like to try the tools in the slides, I'm posting links to their home pages. You can download them to your machines if you like!

• IPCAD (net-mgmt/ipcad)


• Trafshow (net/trafshow)


• Tcpdstat (net/tcpdstat)


• Fprobe (net-mgmt/fprobe)


• Flow-tools (net-mgmt/flow-tools)


• Argus (net-mgmt/argus)


• Tcpreplay (net-mgmt/tcpreplay)


• Tcpflow (net/tcpflow)


• Ngrep (net/ngrep)


• Flowgrep (net/flowgrep)


• Netdude (net/netdude)


• Tethereal (net/tethereal)


• Snort (security/snort)

Here are the traces sf0.lpc and em0.lpc.