7.0 Appendix

7. Appendix A: List of Network Traffic Monitoring and Analysis Tools

Table 7.1: Free NetFlow utility tools

Tool	OS	Functions
flow2rrd	N/A	A "Flow-Tools" toolkit for storing NetFlow data in an Round-Robin-Database
NetFlow2MySQL, NetFlow2XML	Linux, FreeBSD	NetFlow2MySQL is software to store contents of NetFlow packets into MySQL databases. NetFlow2XML is software to convert NetFlow packets into XML format.
Panoptis	Unix-liked	Uses NetFlow accounting data to detect (Distributed) Denial of Service attacks
SiLK	Linux, Solaris, OpenBSD, Mac OS X	A collection of NetFlow tools (by CERT/NetSA (Network Situational Awareness)) to assist the security analysis in large networks
UDP Samplicator	N/A	A redistribution NetFlow data stream to multiple receivers
UPFrame	Linux, FreeBSD	This NetFlow processing framework for real-time processing

Table 7.2: Free network monitoring and analysis tools

Tool	OS	Functions
Bro intrusion detection system	Unix-liked	An open-source, Unix-based Network Intrusion Detection System (NIDS)
Berkeley Packet Monitor	Mac OS X	Mac OS X network traffic monitoring and diagnostic utility
Compaq TeMIP	N/A	Network service assurance solution (link is no longer maintained)
Etherape	Unix-liked	A graphical network monitor
IPaudit	Linux	Monitors network activity on a network by host, protocol and port
iplog	FreeBSD, OpenBSD, BSDI, Solaris, IRIX	TCP/IP traffic logger
Jnettop	UNIX-liked	A traffic visualiser, which captures traffic going through the host it is running from and displays streams sorted by bandwidth they use
Ksnuffle	Linux	A network packet sniffer for KDE
MISPBO Network Monitor	Windows	Network Monitor is a network analytic tool that examines local area network usage and provides a display of upload and download statistics.
Mantra	N/A	Monitor and Analysis of Traffic in Multicast Routers
nstreams	N/A	A tcpdump output analyzer
Network Traffic Analyzer		Network Traffic Analyzer is a software tool that tracks TCP/IP, UDP and ICMP traffic in a LAN that may or may not be connected to the Internet.
Natas	Windows	An open source windows 2000 network sniffer.
Network-I		Network-I is a network analyzer suite, comprised of a packet sniffer with a filtering language and a suite of tools to process the captured packets. The possibilities range from the straightforward display of packets in exhaustive detail, or alternatively, in a one-line summary mode, to measurement of traffic rates and reporting on packet retransmission and losses. It can also import and export capture files in tcpdump and snoop formats.
ngrep		ngrep strives to provide most of GNU grep's common features, applying them to the network layer. ngrep is a pcap-aware tool that will allow you to specify extended regular or hexadecimal expressions to match against data payloads of packets. It currently recognizes IPv4/6, TCP, UDP, ICMPv4/6, IGMP and Raw across Ethernet, PPP, SLIP, FDDI, Token Ring and null interfaces, and understands BPF filter logic in the same fashion as more common packet sniffing tools, such as tcpdump and snoop.
PacketStuff Network Toolkit		PacketStuff Network Toolkit contains a set of very well known tools for network analysis, fingerprinting, traffic monitoring, etc.: ethereal, nmap, ngrep, tcpdump. All these tools are compiled with Packet Sniffer SDK, so you can launch them from any (removable) disk. Installation of the WinPcap is not required.
Pktstat		A real-time list of active connections seen on a network interface, and what are using how much bandwidth. Partially decodes HTTP and FTP protocols to show what filename is being transferred. X11 application names are also shown.
PasTmon		A passive network application response time monitor utilizing packet capture (via libpcap), tracking sessions maintaining transaction state and collecting metrics of server/network response times, segment size negotiation and TCP window size advertisements.
Plab	Linux, FreeBSD	A software platform for packet capture and analysis. It is capable to extract, either from live traffic or from file traces, Inter Packet Times (IPT) and Packet Sizes (PS) inside conversations between couples of hosts It tries to use as few processing resources as possible and it is capable of analyzing traffic traces of hundreds millions packets associated to millions of conversations
RTG		RTG is a flexible, scalable, high-performance SNMP statistics monitoring system. It is designed for enterprises and service providers who need to collect time-series SNMP data from a large number of targets quickly.
Snoop		Similar to tcpdump and is bundled with the Sun/Solaris Unix operating system.
Snuffle		A measurement tool for capturing the protocol messages, internal protocol states and to measure implementation performance on networking nodes. Snuffle consists of a set of modules placed in the kernel, device driver and user space. Currently measuring probes for UDP, IP and IEEE 802.11b MAC are implemented.
Sniffit	Linux, SunOS, Solaris, FreeBSD, Irix	Sniffit is a packet sniffer for TCP/UDP/ICMP packets. Sniffit is able to give you very detailed technical info on these packets (SEQ, ACK, TTL, and Window) but also packet contents in different formats (hex or plain text).
supersniffer		Similar to tcpdump
tcpflow		"tcpflow" is a program that captures data transmitted as part of TCP connections (flows), and stores the data in a way that is convenient for protocol analysis or debugging. A program like 'tcpdump' shows a summary of packets seen on the wire, but usually does not store the data that's actually being transmitted. In contrast, tcpflow reconstructs the actual data streams and stores each flow in a separate file for later analysis.
tcpdump		A popular computer network debugging and security tool which allows the user to intercept and display TCP/IP packets being transmitted or received over a network to which the computer is attached
TCPslice		Tcpslice allows the subsetting of a captured data file using various criteria
TTT: Tele Traffic Tapper		"ttt" is yet another descendant of tcpdump but it is capable of real-time, graphical, and remote traffic-monitoring. ttt won't replace tcpdump, rather, it helps you find out what to look into with tcpdump. ttt monitors the network and automatically picks up the main contributors of the traffic within the time window. The graphs are updated every second by default
TCPurify		A packet sniffer/capture program similar to tcpdump, but with much reduced functionality. What sets TCPurify apart from other, similar programs is its focus on privacy. TCPurify is designed from the ground up to protect the privacy of users on the sniffed network as much as possible.
TCP Sniffer		Marcelo Gornstein's free network tools, including `Easy Sniffer', `Send Packet' and `TCP Listen'.
trafd	Linux, FreeBSD	A traffic accounting daemon for Linux and FreeBSD, built on top of libpcap, with accompanying tools to manage its data.
trafshow		Continuously displays information regarding packet traffic on the configured network interface that match the Boolean expression.
Tstat	Unix-liked, Linux	TCP statistic and analysis tool - allows collecting network performance indexes from passive traffic analysis (i.e. packet traces), at both network (IP) layer, and at transport (TCP/UDP/RTP/RTCP) layer. It can be used to persistently monitor links, thanks to the integration with the RRD database
WinPcap	Win32	Architecture for packet captures and network analysis for the Win32 platforms, based on the model of BPF and libpcap for UNIX.
Web Packet Sniffer	Unix-liked	Web Packet Sniffer is a pair of Perl scripts that together will: Listen to all TCP/IP traffic on a subnet. Intercept all outgoing requests for Web documents and display them. Intercept all incoming requests for Web documents and display them. Decode the Basic authentication passwords, if any
WinDump	Windows	TCPdump for Windows.
xipdump		A snazzy IP packet monitoring tool for X window system
XCounter		XCounter is an X11-based traffic monitoring program that displays information about IP traffic on a selected interface. It returns information like byte counts, duration of current connections and speed for the last five seconds. XCounter works on Ethernet, FDDI, ISDN, PLIP and SLIP/PPP interfaces.
YAF		YAF snoops packets from pcap dump files or live capture, and produces bidirectional flows. These flows can be sent to IPFIX collectors, or be stored in an IPFIX-derived file format.

Table 7.3: Free network utility tools

	OS	Functions
FlowMonitor		Specify a bandwidth usage policy per IP and obtain lists of IP whose usage violates that policy
flow-pairs		A script that extracts lists of the highest bandwidth consumers by host and by port
IPTraf	Linux	IPTraf intercepts packets using the built-in raw socket interface of the Linux kernel.
IPAC	Linux	IPAC is an IP accounting package for Linux. It collects, summarizes and nicely displays IP accounting data. The output of ipac can be a simple ASCII table, an ASCII graph or even images with graphs, showing traffic progression.
ipfm	Linux, FreeBSD	Measures how much bandwidth specified hosts use on their Internet link.
multitail		MultiTail now has a colorscheme included for monitoring the tcpdump output. It can also filter, convert timestamps to timestrings.
NetDude		GUI-based tool that allows you to make detailed changes to packets in tcpdump tracefiles
pcaputils		Includes a tool to combine multiple capture files and produce a combined file, sorted by packet time stamp.
TCPstat		Tcpstat reports certain network interface statistics much like vmstat does for system statistics. tcpstat gets its information by either monitoring a specific interface, or by reading previously saved tcpdump data from a file.
xplot.org		The analysis of TCP packet traces

Table 7.4: Free network monitoring and analysis tools (protocol specific)

	OS	Functions
Free Serial Port Monitor	Windows	Free software serial port monitor, Com Rs232 sniffer with communication packet data analyzer. This monitoring utility can spy, capture, view, analyze, test com ports activity performing com port connection and traffic analysis
Pload		Graphical monitoring of PPP traffic.
Darkstat		A packet sniffer that runs as a background process on a cable/DSL router, gathers all sorts of statistics about network usage, and serves them over HTTP.

DnsEye	Windows	DnsEye is monitoring network traffic by capturing DNS packets in network and displays the host names resolve information. The program allows monitoring requested URLs in network, to open it in browser and save captured DNS name list in the file.
nfswatch/	Unix-liked	Nfswatch is a packet sniffer, which is dedicated to sniffing NFS (Network File System) traffic. nfswatch lets you monitor NFS requests to any given machine, or the entire local network. It mostly monitors NFS client traffic (NFS requests); it also monitors the NFS reply traffic from a server in order to measure the response time for each RPC.
ProxyStat	Windows, Linux, Unix-liked	The set of Perl-scripts is intended for calculation of incoming HTTP/FTP traffic and monitoring of Internet user activity. Its purpose: monitoring incoming HTTP/FTP traffic with the purpose of its minimization and for revelation of users abusing Internet access.

Table 7.5: Commercial NetFlow monitoring and analysis tools

	OS	Functions
AdventNet NetFlow Analyzer		NetFlow Analyzer is a web-based bandwidth monitoring tool that uses Cisco NetFlow technology
Aurora, IBM Apogee Networks		NetFlow Aurora Product is a Flow Based Profiling System The NetCountant network usage-based billing system and the NetScope real-time network monitoring and performance analysis solution support NetFlow, RMON2, RADIUS, other SNMP MIBs, and ``Layer 7'' application/content switches
Arbor Networks		Peakflow DOS detects denial-of-service attacks, and Peakflow Traffic analyzes traffic and routing history. Both can process NetFlow accounting data. As of November 2003, Arbor is said to support NetFlow v9.
Arbor Networks PeakFlow Products,		Traffic Analysis, NetFlow collection and Security DDOS monitoring, and peering analysis
Caligare Flow Inspector		This is a tool for processing and evaluating network traffic, using network flows export statistics sent by router. It is appropriate for network diagnostics. It has the added ability of real-time monitoring and data analysis.
Crannog NetFlow Tracker	Windows	Traffic analysis, NetFlow collection and low cost Windows-based NetFlow product
Cyclades-nQuirer		A network traffic monitoring appliance that can generate data in both NetFlow and nTop formats.
Evident Analyze		Evident Software for NetFlow based Billing and Traffic Analysis
Network Intelligence	Linux, Windows	Traffic measurement and visualization software for GNU/Linux and Windows (client only) platforms.
HP NetFlow Insight Web Site		Traffic Analysis, NetFlow collection using HP Insight Network Performance Monitoring
IsarFlow		IsarFlow is a traffic analysis tool for accounting, capacity planning, QoS monitoring, and application distribution within Citrix sessions based on NetFlow.
Ixia		IxTraffic integrates NetFlow accounting data with topology information from a live BGP-4 feed to allow analysis of inter-domain traffic patterns.
I-ABA and M-NTM	Windows	Windows-based software to analyze NetFlow (and Cisco IP Accounting) statistics. I-ABA specifically analyzes AS-to-AS traffic streams.

LoriotPro		A network monitoring ("supervision" in franglais) system that includes a NetFlow plugin.
Micromuse		Cisco Info Center USM: acquires, analyzes, displays and exports Internet usage data
ManageEngine NetFlow Analyzer	Windows	This is a Web-based bandwidth monitoring tool that uses Cisco NetFlow to show you what applications are using bandwidth, who is using them and for how long.
Mazu Profiler		Analyzes and models enterprise network traffic. It provides visibility into network behavior, protects against worms and other malware, and supports auditing and policy enforcement. It supports NetFlow v1/5/7/9 as well as other data collection mechanisms.
NetFlow FlowCollector/Network Data Analyzer,		Similar to cflowd but productized, with a (Java-based) GUI and possibly better possibilities of defining filters and aggregation schemes from CISCO.
NetFlow Monitor	Windows, Unix-liked	Crannog Software: LAN and WAN bandwidth analysis based on NetFlow data. Includes a Web interface including Java applets to display traffic graphs and to enable drill-down.
Nazca.Billing		Integrated billing software for "Telephony, Internet and Networks". Contains interfaces to many accounting systems including NetFlow.
Network Signature		BENTO stands for BGP Enabled Network Traffic Organizer and is a high-performance NetFlow data processor with an integrated BGP-4 implementation to facilitate traffic analysis based on complex external routing relationships.
PRTG Traffic Grapher	Windows	Windows software to monitor bandwidth usage and other network parameters via SNMP and NetFlow
QRadar from Q1 Labs		The system can use NetFlow data, but also includes its own payload-aware flow collector which produces bi-directional flow information in a format called QFlow.
Scrutinizer NetFlow Analyzer,		NetFlow Collector and analyzer solution NetFlow-based Enterprise-level traffic analysis tool with GUI-based reporting (topN hosts/applications etc.) and zoom/drill-down. Uses MySQL back-end
Traffic and Security Analysis		Cisco NetFlow forensic analysis reporting service. Instant analytics from old Cisco NetFlow collector logs
UTM		A billing system for ISPs. It can use NetFlow (v5) and several other accounting methods. It supports a rich variety of charging and payment schemes.
Watch4net APG (Automated Performance Grapher)		APG is a reporting tool that provides performance and capacity reports on network, servers, applications and NetFlow data
XACCT		Commercial vendor of accounting and billing solutions with the ability to process (among others) NetFlow accounting data

Table 7.6: Commercial network monitoring and analysis tools

	OS	Funcitons
Accurate Network Monitor		This IP traffic monitoring and packet sniffer tool can sniff TCP/IP and UDP/IP communications and capture HTTP data. ANM can spy, view and test network connection data transfers.
Anasil Analyzer	Windows	A software network analyzer of Ethernet networks.
Apoapsis		NetUsage product for network traffic monitoring, capacity planning, business justification and cost control.
Aruba Flow		Powerful Yet Cost-Effective Application Flow Reporting
Accurate Network Monitor	Windows	HHD Accurate Network Monitor - IP packet sniffing, monitoring and protocol analyzer software tool that can sniff internet protocols performing tcp / ip, udp / IP communication traffic analysis. LAN connection sniffer and internet data capture utility
Anasil		Anasil is a software network analyzer and protocol decoder for distributed Ethernet networks. System architecture is based on remote Agent modules what enables IT managers to monitor and manage a multi-segment networks and control stations remotely. Anasil consists of three modules: network discovery and mapping, network traffic monitoring and frame capturing, network event recording and alerting
Billion NetWatcher	Windows	The main purpose of Billion NetWatcher 1.0 is to make you able to collect the information about your network traffic. Those people who use Unix-family operating systems can do this with native OS tools but Windows-user can not.
BWMeter	Windows	BWMeter is a powerful bandwidth meter, monitor and traffic controller, which measures, displays and controls all traffic to/from your computer or on your network.
Bandwidth Monitor		Bandwidth Monitor tracks all network connections traffic and displays real-time graphical and numerical data transfer rates. It can display multiple connections rates at the same time. Bandwidth Monitor logs all network traffic and supplies all kinds of traffic reports. It also includes traffic events. Bandwidth Monitor works with all types of network connections including phone modems, DSL, cable modem, LAN, satellite and more
ClearSight		Provide an Analyzer/sniffer (up through 10Gbits/s) with packet generator capability.
Cymphonix Network Composer		Monitors Internet traffic by user, application, and threat. Includes controls to shape access to Internet resources by user, group, and/or time of day. Also featuring anonymous proxy blocking, policy management, and real time monitoring.
CableMon	Windows	Cable Traffic Monitoring Tool - will monitor the traffic on Ethernet adapters; - it shows the total traffic and download/upload speeds; - require WinPcap to be installed altough it works also without pcap drivers;
CommView Remote Agent	Windows	CommView Remote Agent is an application for remote network traffic monitoring. It allows CommView users to capture network traffic on any computer where Remote Agent is running, regardless of the computer's physical location
Colasoft EtherLook	Windows	An easy to use TCP/IP network traffic monitor for the Windows-based platforms. With the abilities of real time monitoring all traffic flowing around the local network and to/from the Internet, you can manage and supervise the corporate network more easily and efficiently. The Traffic Analysis Module enables you to capture network traffic in real time, display the data received and sent by every host in LAN in different views.
CommTraffic	Windows	CommTraffic is a network utility for collecting, processing, and displaying traffic and network utilization statistics for computer network connections. In a LAN segment, CommTraffic shows traffic and network utilization statistics for each computer.
Colasoft EtherLook	Windows	An easy to use TCP/IP network traffic monitor for the Windows-based platforms. With the abilities of real time monitoring all traffic flowing around the local network and to/from the Internet, you can manage and supervise the corporate network more easily and efficiently. In addition to the Traffic Analysis Module, Colasoft EtherLook has three advanced analysis modules: Email Analysis Module, Web Analysis Module and Login Analysis Module.
Distinct Network Monitor		Distinct Network Monitor translates complex protocol negotiation into natural language, pinpointing where errors occurred. Not only is it easier to use than any other competing products, but it also translates the packet negotiation into natural language, something no other network protocol analyzer does.
dSniff		A packet sniffer and set of traffic analysis tools written by Dug Song, a computer security researcher at the University of Michigan. Unlike tcpdump and other low-level packet sniffers, dSniff also includes tools that decode information (passwords, most infamously) sent across the network, rather than simply capturing and printing the raw data, as do generic sniffers like Wireshark and tcpdump.
Etherpeek	Windows	An Ethernet network traffic and protocol analyzer designed to assist in troubleshooting and debugging mixed-platform, multi-protocol networks (Ethernet, Fast Ethernet, or Gigabit Ethernet NIC).
Etherscan Analyzer	Windows	With Etherscan, you can capture and analyze all packets over the local network. Etherscan decodes all major protocols, including Ethernet, NetBEUI, TCP/IP, and TCP/IP utilities and it is capable of reconstructing TCP/IP sessions. What's more, Etherscan is able to filter and search for specific traffic easily
ettercap		Sniff traffic on a selected connection; dissect protocols; collect passwords; fingerprint OS.
EtherScout	Windows	Centralized Internet traffic logging and analysis combined with customizable online reports shows you exactly which web sites users on your network are visiting in real-time. Allows you track, manage or report on how the Internet is being used.
Edge Security Profiler (ESP)	Windows	Network traffic analyzer. It captures live network traffic, including IP addresses, ports, hosts, conversations, bandwidth used, packets per second, and number of connections. This "top talker" information is displayed in real-time to the user through a standard Web browser on the local machine or from a remote machine. All captured traffic is stored for up to a year on the local file system, and can be referenced and displayed for quick analysis. ESP displays list and graphical views of network traffic. Traffic can be viewed as a whole or filtered and sorted by protocol, port, conversation or host. ESP runs on either Windows or Linux operating systems
FASTech Traffic Grapher	Windows	Real-time bidirectional traffic accounting, monitoring, and graphing for the network devices. Bandwidth monitoring provides visual representation in the form of Web pages containing usage graphs so that network congestion can be avoided. The upload and download usage of each SNMP-enabled network device is recorded for multiple possible network interfaces covering MAC address, IP address, system up time, maximum speed, average, and current in/out traffic per second. Alert mails warn against using more than specified data limit. Provides same functionality as MRTG but more user friendly for Microsoft Windows platform. Equally good for LAN and WAN traffic monitoring
Finisar		Provide sniffer like stand alone network test and monitoring devices for 10/100/1G and iSCSI, Infiniband and Fiber Channel.
GigaMon		Provide a hardware switch to enable connecting a sniffer to multiple links.
Give Me Too	Windows	An easy-to-use network sniffer that controls all network traffic secretly captures all visited Web pages, all incoming and outgoing emails and stores them to a folder of your choice. You can view the captured data using standard tools (browser and e-mail client). This program lets you monitor the activity of other users in your local network, control online behavior and communications of your children, spouse or employees. The network analyzer can work in the command line mode and also features the ability to analyze tcpdump files produced by other sniffers. All data captured by Give Me Too network sniffer is stored to a folder of your choice and organized in the easy to navigate way (the captured Web pages and e-mail messages are sorted by protocol and computer or e-mail account).
hping		TCP/IP packet assembler/analyzer; firewall testing; advanced port scanning; network testing; using different protocols, TOS, fragmentation; manual path MTU discovery; advanced traceroute, under all the supported protocols; remote OS fingerprinting; remote uptime guessing.
Internet Traffic Agent	Windows	Internet Traffic Agent is a network tool useful for monitoring your Internet traffic. It captures all IP packets in the local area network. Therefore, it will be helpful you to measure the Internet or LAN traffic of specific users. Also using Internet Traffic Agent, you can detect the most activity users or your own network activity. With Internet Traffic Agent you can detect the network traffic used by any application.
IP Traffic Monitor	Windows	A network traffic monitor and logger. Monitor all your network connections in real-time or browse historical reports. See what, when and where with a built-in packet sniffer. Automatically resolves IP addresses to hostnames.
Iris Network Traffic Analyzer	Windows	Iris is a network traffic analyzer designed to help IT personnel proactively monitor their organization's network. Iris features advanced, integrated technology that allows it to reconstruct network traffic in a format that is simple to use and understand. Iris allows the network administrator to set up automated filters to monitor for specific network content. Iris can capture traces of worms and viruses that other tools may overlook.
Javvin Packet Analyzer		Software-based network analyzer monitors Ethernet and WLAN traffic in real time, and decode packets.
JDSoft Bandwidth Manager	Windows	By monitoring your network traffic and limiting the bandwidth, the software increases the network efficiency immediately with a reduction in your overall bandwidth requirement while allowing business-critical network applications to run smoothly.
Kismet	Linux, FreeBSD, NetBSD, OpenBSD, Max OS X, Windows	A network detector, packet sniffer, and intrusion detection system for 802.11 wireless LANs. Kismet will work with any wireless card, which supports raw monitoring mode, and can sniff 802.11b, 802.11a and 802.11g traffic.
LAN traffic monitor - RT		Sniffer supports 10/100/1G ethernet packets, MAC/IP/protocol node/conversation matrix tables (realtime telnet terminal output)
LinkFerret Network Monitor	Windows	LinkFerret is a versatile Ethernet/ 802.11b network monitor and packet sniffer. All of the essential wireless monitoring functionality, including signal monitoring, channel scannning, and WEP decryption are supported
LANExplorer	Windows	Provides packet capture, decode, filtering, matrix, host table, statistics, theresholding and alarms for Windows hosts.
LANQuest Net/WRx	Hardware	Sniffer supports IP, Ethernet, GigaEther, Token ring, FDDI
LinkFerret	Windows	Tools are designed to provide a comprehensive set of monitoring utilities and packet sniffers to be used for capture, statistical analysis, and protocol decoding in your Ethernet network.
MeasureNet		Description: MeasureNet gives you measurements of network traffic volumes and response times for each user, application and protocol. That means that you can answer questions about network performance, usage and capacity more easily
MetaGauge		MetaGauge is network traffic monitoring software designed to be easy to configure and maintain. MetaGauge monitors traffic on network devices by using SNMP to track the amount of data passed through the interfaces. The statistics are kept in a database and then displayed in HTML and Graphs. A web server is included but Windows built in web server can be used as well.
MZL & Novatech Traffic Statistics		MZL & Novatech TrafficStatistic shows accumulated bandwidth usage of a network interface like ethernet, DSL or PPP in tray. It generates IP traffic statistics IPDR data and the user can generate reports on his top bandwidth consumers cut by host and service. Reports allow to identify and to analyze unexpected traffic and to optimize volume consumption habbits over long periods. Especially useful it is for users in a bandwidth metered charge plan.
Microsoft Network Monitor	Windows	The packet sniffer which is bundled with Microsoft Windows.
Netlogger Workbench	Windows	An extremely powerful and flexible network sniffer and traffic analyzer. The software is based on Unispeed's famous Netlogger hardware device, which is currently used by intelligence agencies and large corporations worldwide. Netlogger SE is useful for security monitoring, network communication logging, diagnostics, and any network monitoring related tasks.
Netmon		Netmon's built-in packet sniffer allows you to monitor Internet usage, and records a fingerprint of every single network connection in its database. Sophisticated reporting toolset allows you to mine all of this data quickly and easily.
NetworkActiv	Windows	Packet analyzer with a graphical user interface (GUI) and built-in real-time HTTP file capturing capabilities, a Graphical Packets Mode that shows your network traffic with visual effects, per-IP/per-Port/per-IP-Pair statistical information collection. All in a single, easy to use Windows application. No third party components necessary. No ads, banners, spyware, or nags. Version 2.2.1 may include unspecified updates, enhancements, or bug fixes.
Network Probe	Windows, Unix-liked	A network monitor and protocol analyzer providing a picture of the traffic situation on your network and enables you to monitor network traffic in real time, hunt down, identify, and isolate traffic problems and congestions on your network.
NetStumbler		A tool for Windows that facilitates detection of Wireless LANs using the 802.11b, 802.11a and 802.11g WLAN standards. A trimmed-down version called MiniStumbler is available for Windows CE.
Network Protocol Packet Analyzer	Windows	Packet Analyzer is an advanced packet analysis and sniffing tool with powerful protocol decodes capabilities. It captures and analyze all traffic transport over both Ethernet and WLAN network with results displayed in simple English.
NetworkActive PIAFCTM		Network traffic analyzer; packet/protocol analyzer, HTTP file rebuilder, graphical traffic mode (graphical overview of current network communications), and traffic statistics mode. There is also a free for personal and commercial use version that provides a network traffic analyzer plus a packet/protocol analyzer and HTTP file rebuilder.
Network Traffic Monitor Analysis Report		Packet Analyzer enterprise edition is an advanced network monitoring, analysis and reporting tool for network security, performance and troubleshooting. It captures and analyzes traffic realtime, present comprehensive and graphic reports for technical and business purposes. All information is displayed in simple English with easy to use interface for anyone to master the tool with minutes of self training
NetResident	Windows	NetResident is a network content monitoring program that captures, stores, analyzes, and reconstructs various types of network events. NetResident uses advanced technologies to capture the data, reconstruct it, and present it in a convenient form.
NetDetecor		From Nicksun a non-intrusive network security monitoring product that (when deployed as part of your data communications infrastructure) inspects traffic flows, detects the activities of intruders, sets alarms, makes continuous copies of data from the network, and analyzes every packet in the network in real-time at production network traffic rates.
NetQoS ReporterAnalyzer		Scalable solution for network capacity planning, troubleshooting, and traffic analysis, including traffic visualization capabilities.
Network Traffic Multi Optional Report	Windows	This report turns the Traffic Statistics freeware into a traffic monitoring and bandwidth accounting system. Traffic cut by local hosts is shown and users can query the traffic for arbitrary time intervals, services and target hosts using wildcards.
NetLimiter	Windows	NetLimiter is an ultimate internet traffic control and monitoring tool. You can use NetLimiter to set download/upload transfer rate limits for applications or even single connection and monitor their internet traffic.
Network Traffic Monitor		Network Traffic Monitor shows you which processes in your machine are causing how much TCP/IP network traffic and over which IP ports this traffic takes place. For each process it can show detailed information, including the path to the process executable, the remote IP address, and the resolved name of that IP address. Network Traffic Monitor can give you a historic overview and can save that info to a file for later examination.
NADetector	Windows	NADetector monitors and analyzes the network traffic and displays statistical information pertaining to each IP address pair and protocol, displays incoming, outgoing and summary traffic statistics, allows you to set traffic limits.
Nexeye Monitoring Enterprise	Windows	Monitor network users web, e-mail and MSN Messenger activities on a real-time basis with nexeye Monitoring. Monitor on a real-time basis the network traffic from/to the Internet as well as the traffic generated by the individual users.
Net Meter	Windows	Net Meter is a powerful and easy network traffic monitor. It monitors traffic of one or more network connections at the same time. Net Meter displays real-time graphical and numerical details of network traffic.
NetUsage		The NetUsage suite strives to provide visibility of network traffic, producing meaningful reports not only for network professionals, but for IT management, business managers and accounts departments. Supports network traffic monitoring, capacity planning, business justification and cost control.
NetScout		Genius Performance Manager is a complete solution for proactive monitoring, troubleshooting, capacity planning, and Voice over IP (VOIP) monitoring
Netjini Plus Traffic Analyzer '0.9'		This application enables you to see the standard RMON statistics for your whole network segment. Analyze network traffic and Report. PROTOCOLS APPLICATIONS HOSTS CONVERSATIONS HISTORY REPORTS This application enables you to create reports for any of the entries and statistic in the probe, including the most active applications, hosts, and conversation for a given period of time.
Net Activity Diagram	Windows	The program lets you monitor and control your network traffic. Visualizing your Internet activity is simple - the program is easy, even for inexperienced users. You can view all established connections, monitor network traffic over a certain period, setup various notifications, etc.
NetPeek		NetPeek is a GUI-based network monitoring and diagnosis tool. It captures packets from the local network and displays them to the user in two forms: a short one-line description similar to that produced by tcpdump, and a long form that displays the contents of all fields within the packets in full.
OrangeNettrace	Windows	Is an easy to use network monitoring tool, which informs you about your internet traffic and CPU usage. The screenshot says it all. We produced a very useful program with an intelligent user interface, which informs you about your: > current down-, upload speed and average transfer > current CPU usage > daily statistic of down-, uploads, traffic, average data > live update
Observer		From Network Instruments is a network analyser (Packet sniffer) for 10/100/1000 100/1000 Full Duplex and Multi trucked Ethernet links, wireless a, b and g, token ring and FDDI.
PC Network Traffic Monitor and Analyzer	Windows	Packet Analyzer is an advanced packet analysis and sniffing tool with powerful protocol decodes capabilities. It captures analyze traffic passing by the machine where the tool is installed with results displayed in simple English.
PacketBoy	Windows, Unix-liked	A packet sniffer analyzer decoder package capable of decoding many of the commonly used LAN protocols.
PromiScan	Windows	Global standard network sniffing detection software PromiScan is a de facto standard sniffing node detection tool which is recommended by SANS and has been used worldwide ever since its release.
Packeteer		Provides network traffic characterization, using signatures derived from network layers up through 7, it can then use this information to do TCP rate control (using CoS/ToS. DiffServ & MPLS) to ensure timely performance.
RexTraffic Monitor		Small and easy-to-use utility that monitors the traffic on your LAN. RexTrafficMonitor displays information about IP packages such as direction (sender's and receiver's IP address and port) and size and writes this information into LOG-file. Allows filtering received packages by IP address or by port number. Also RexTrafficMonitor has trigger mechanism to start another program when some criteria is met for example SMB or SMTP connection
SoftPerfect Network Protocol Analyzer	Windows	SoftPerfect Network Protocol Analyzer is a professional tool for analyzing, maintaining and monitoring local networks and Internet connections. It captures the data passing through network card and represents this data in an easily readable form.
Sniff-em	Windows	Network analyzer and Network monitoring tool. Through use of our own optimized proprietary network drivers we are able to capture Dialup and Wifi on all Operation systems without packet loss. Sniff'em aids at monitoring network and capturing data traffic in order to recognize and decode all Network data, capturing everything that travels through the Network at any moment.
Shomiti Surveyor	Hardware	Sniffer supports 10/100/1000 Ethernet; 4/16 Token Ring, 7-layer analysis
Sniffer Basic		Sniffer supports 10/100 Ether LAN; 4/16 token ring , pkt capture, bandwidth utilization, protocol utilization, pkt and frame errs, traffic generation
Shomiti Explorer	Hardware	Sniffer supports 10/100/Giga Ethernet, pkt capture (raw data flow)
Sniffer Pro	Hardware	Sniffer supports 10/100 Ether LAN; GigaEther; ATM; Packet over SONET, pkt capture, bandwidth utilization, protocol utilization, pkt and frame errs, traffic generation (GUI)
Traffic Counter		Traffic Counter is an easy-to-use tool to display and count network traffic of your computer. If you have limited monthly Internet traffic and always run P2P software such as BitTorrent, you may be in risk to be fined by your ISP because of your huge traffic consuming. Traffic Counter reports daily and monthly traffic. It allows you to set monthly traffic limit, alerts you when the amount of the traffic is used.
TracePlus Ethernet		TracePlus/Ethernet is a powerful performance and capture tool. Realtime statistics include bandwidth by node, protocol, and address pair. Network dashboard displays network performance updated each second. A history view chronicles the occurrence of specific IP events on your network. Capture packets based on type, address, size, TCP/UDP port, or data pattern. Decodes SNMP packets (all versions). Intelligent data view formats IP user data for easy viewing. Imports capture files from other packet analyzers including UNIX and Linux OS's. Supports VLAN features of the 802.1Q/802.1P protocols
Traffaret		Traffaret is the easy to use tool that monitors bandwidth usage and other the Internet related parameters. Traffaret allows you to quickly and easily set up and run monitoring network connection characteristics: speed, transferred data, opened connections and so on. It is a good idea to run Traffaret before you start your Internet connection.
TrafficEmulator	Windows	Nsasoft Network Traffic Emulator generates IP/ICMP/TCP/UDP traffic from clients to server to stress test servers, routers and firewalls under heavy network load. It is a very simple and fast program, which can simulate client activity. The tool is designed with a user-friendly interface and is easy to use.
Traffic loger	Windows	TrafficLogger is a network traffic sniffer and logger that allow you to monitor all internets and network traffic on your PC. The capability to audit what flows in and out of every piece of software is critical for security aware users
Traffic Calculator	Windows	Traffic Calculator is a software product for monitoring network traffic. Using Traffic Calculator, you will be able to create a full-featured system for monitoring the Internet traffic of the users on your home or office network.
TrafMeter	Windows	TrafMeter provides a powerful accounting and realtime monitoring of Internet traffic to and from a local network. It can produce XML traffic reports or/and log traffic counters into a database. It can track visited websites by its name.
TrackSite Free	Windows, Unix-liked, Linux	TrackSite is advanced, cross-platform, easy-to-use monitoring and statistical analysis system for website traffic, excellent tool for website management and development.
Ultra Network Sniffer	Windows	Ultra Network Sniffer from GJPSoft is a powerfully network visibility tools. It consists of a well-integrated set of functions that you can use to resolve network problem. Ultra Network Sniffer will list all of network packets in real-time from multi network card (Include Modem, ISDN, ADSL) and also support capturing packet base on the application(SOCKET,TDI etc). The user can observe all of traffic of the application that you are interesting. The user can easy to learn and simple to use. Ultra network Sniffer has plug-ins for different protocols such as ETHERNET, IP, TCP, UDP, and so on.
Unsniff		Network Analyzer. Scriptable and extensible network analyzer with fresh new views of protocols URL.
VFWH monitor		VFWH Monitor has the ability to calculate and graph all the network traffic between local machine and any other machines. -- Main features of VFWH Monitor: Calculate statistics for bound Interfaces. Calculate statistics for chosen Connections. Calculate using time for Interfaces and Connections. Graph real-time diagram for Interfaces traffic.
VSS Monitoring		Network taps provide a dedicated inline network monitoring solution for use with analyzers, IDSes, IPSes and other test access monitoring devices.
Wireshark		Sniffer supports Ethernet, FDDI, PPP, token-ring, X.25, IP over ATM, tcpdump (libpcap), various pkt analyzers, protocol distribution (Unix GUI, or TTY-mode)
ZTI		Provide LANTraffic V2 and IP Traffic Test & Measure software testing tools for automatic generation of TCP and UDP traffic

Table 7.7: Commercial network monitoring and analysis tools (protocol specific)

	OS	Functions
Advanced USB Port Monitor		A USB Bus, Device and Protocol Analyzer with the robust functionality to capture and process USB traffic. It offers sophisticated viewing and searching accurately and efficiently debug and test High (480Mbps), Full (12Mbps) and Low (1.5Mbps) speed USB devices. Advanced USB Port Monitor design enables users to use it with any USB device, extending beyond the lab environment with advanced user's tools.
CommView for WiFi PPC		CommView for WiFi PPC is a special lightweight edition of CommView for WiFi that runs on Pocket PC handheld computers. This product is a cost-effective WLAN diagnostic solution designed for express wireless site surveys, as well as capturing and analyzing network packets on wireless 802.11b/g networks. CommView for WiFi PPC gathers information from the wireless adapter and decodes the analyzed data.
Serial Monitor	Windows	Software serial port monitor Rs232 sniffer with protocol analyzer and packet data logger. This monitoring utility can spy, capture, view, log, analyze test com ports activity performing com port connection and traffic analysis with data acquisition
Spb GPRS Monitor		Spb GPRS Monitor is a traffic counter. Complete solution for measuring the amounts of data transfers via your GPRS, CDMA or GSM network connection and calculating network usage costs. This is Pocket PC software for iPAQ, Dell Axim, Acer, T-Mobile MDA, O2 XDA, Orange SVP, Siemens E-Ten and other PDA devices.
Toggle NETLIGHTS		ToggleNETLIGHTS restores the ability to see incoming and outgoing network traffic for Cable and DSL Modems.
USB Monitor Pro	Windows	USB Monitor Pro is an effective and, at the same time, simple in use analyzer of USB traffic for Windows. It allows monitoring incoming and outgoing data of a USB device plugged into the computer. USB Monitor Pro is a complete software solution, so you don't need any additional expensive hardware solutions. It's an indispensable tool for a developer of firmware and drivers for USB devices, expanding developer's drsenal.

Advanced HTTP Packet Sniffer (AHPS)	Windows	Advanced, software network analyzer specifically designed for Web development. It can capture and decode HTTP protocol packets which the Web browser uses to communicate with the Web server. Prepares in-depth HTTP protocol traffic analysis. Automatically identifies and displays it in an easy to understand format.
EffeTech HTTP Sniffer		A HTTP protocol network sniffer, HTTP packet analyzer and file rebuilder. Unlike most other sniffers, it is dedicated to capture IP packets containing HTTP protocol, rebuild and save the HTTP communications and files sent through HTTP protocol. It is a helpful tool for company managers, parents, LAN administrators, security professionals to supervise the web access and HTTP traffic on the LAN.
HTTP Analyzer		HTTP Analyzer is a utility that allows you to capture HTTP/HTTPS traffic in real-time. It displays a wide range of information, including Header, Content, Cookies, Query Strings, Post data, Request and Response Stream, redirection URLs and more. It also provides cache information and session clearing, as well as HTTP status code information and several filtering options.
HttpDetect (EffeTech HTTP Sniffer)		A HTTP protocol network sniffer, packet analyzer and file rebuilder. Unlike most other sniffers, it is dedicated to capture IP packets containing HTTP protocol, rebuild and save the HTTP communications and files sent through HTTP protocol. It is a helpful tool for company manager, parents, LAN administrators, security professionals to supervise the web access and HTTP traffic on the LAN
IE HTTP Analyzer		Integrates into the lower part of IE browser window. It allows you to capture HTTP/HTTPS traffic in real-time. It displays a wide range of information, including Header, Content, Cookies, Query Strings, Post data, redirection URLs and more. It also provides cache information and session clearing, as well as HTTP status code information and several filtering options. A useful developer tool for performance analysis, debugging and diagnostics.
MSN Protocol Analyzer		MSN Protocol Analyzer (MSNPAnalyzer) is a network utility that can monitor (or capture, monitor) the sessions of MSN Protocol. If you use this program in combination with SwitchSniffer program, you can capture and see all the MSNP sessions including conversations and MSN commands.
MailMonitor	Windows	MailMonitor is a program enabling you to monitor incoming and outgoing mail traffic to and from you mail server and clients. It tracks, displays and logs incoming and outgoing SMTP sessions, POP sessions and sent and received e-mails
Summary	Windows, Macintosh, Linux x86, Mac OS X, and Sun SPARC	This utility monitors Web site traffic. It reports over 200 different log analysis reports in an easy-to-read and understand format.

Back to Main page