Learn how to a build a cloud-first strategyRegister Now

x
  • Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 283
  • Last Modified:

net traffic analyzer for linux firewall needed - looking for software suggestions

net traffic analyzer for linux firewall needed - looking for software suggestions

Here is what I'm looking for:
A tiny console tool which dynamically shows all incoming nettraffic.

Here is what I want to improve:
A linux firewall (SuSE 7.3) with tools like (tail -f /var/log/firewall and iptraf [from Gerard Paul Java])

Any software suggestions ?
What experience did you make ? and with wich software ?

Thanks for your help

mathias



0
mfuerlinger
Asked:
mfuerlinger
  • 2
  • 2
  • 2
  • +2
1 Solution
 
lrmooreCommented:
try the man pages for tcpdump. If you don't have it, it is freely available.
0
 
jlevieCommented:
I find that ntop (http://www.ntop.org) is a very nice traffic analyzer for networks in general. You can monitor overall traffic as well as see statistics relating to a single host, like who they are talking to and how much data is assocaited with a connection.
0
A Cyber Security RX to Protect Your Organization

Join us on December 13th for a webinar to learn how medical providers can defend against malware with a cyber security "Rx" that supports a healthy technology adoption plan for every healthcare organization.

 
mfuerlingerAuthor Commented:
hi Irmoore
, tried 'tcpdump' before but got stuck somewhere in the manual.
trying again...more precise:
searching a way to report all unknown incomming nettraffic except port 80 on the firewals eth0 dynamically on stdout.
Did not find a really helpfull expression and/or switch in 'tcpdump' yet.
...


salut ahoffmann
just downloaded mrtg2.9.18pre9 - hold on.
...
0
 
lrmooreCommented:
Try Ethereal as an alternative. It might be easier to set filters.
http://www.ethereal.com/download.html

What do you have in front of the firewall for a router? If it is a Cisco router, you can setup access-lists to send all that traffic off to a syslog server..
0
 
ahoffmannCommented:
hmm, seems that you need to clarify what you want to see:
   a) just packet headers
   b) packet content
   c) data streams (packets belonging/related to a connection)
   d) statistics about traffic (that's what I assumed according to the question)

for a) and b) go with tcpdump, or ethereal if you know how to use a mouse
for c) ethereal might be the better choice, there are some more of such programs
0
 
smiskCommented:
Try this for tcpdump :

tcpdump -x -X -i eth0 'dst 192.168.0.10 and dst port not 80 and src net not 192.168.0.0/24'

Where the following applies :

192.168.0.10 : firewall that you want to monitor.
80 : http port.
192.168.0.0/24 : subnet on which to allow incoming traffic from w/out printing to stdout.  use this if you have some trusted hosts on a network (you said all "unkown incoming traffic").

Also, if you're doing this over an ssh connection you probably want to add 'and host not my.ip.address' so your ssh connection doesn't flood the screen.

tcpdump has a lot of really great features.  Check the man pages for more useful options (ie, 'tcp' if you only want to see tcp traffic).

Steve
0
 
mfuerlingerAuthor Commented:
Finally to finish this question.
0

Featured Post

Put Machine Learning to Work--Protect Your Clients

Machine learning means Smarter Cybersecurity™ Solutions.
As technology continues to advance, managing and analyzing massive data sets just can’t be accomplished by humans alone. It requires huge amounts of memory and storage, as well as the high-speed power of the cloud.

  • 2
  • 2
  • 2
  • +2
Tackle projects and never again get stuck behind a technical roadblock.
Join Now