Network analysis

Portal Home > Knowledgebase > Articles Database > Network analysis

Posted by Maxihost, 09-02-2007, 11:09 AM
Hello, I am looking for a simple program to analyse my network and give me some information about a TCP/UDP attack. I would like to know only the attacker IPs and the destination IPs. I have a server running with two NICs, one to access and the other one logging the traffic in promiscous mode. I am running the program "ntop" but I couldnt identify an attack when it was on going. Anyone have any advice ?
Posted by david510, 09-02-2007, 01:46 PM
Here is a simple code that helps you to find the number of connections to port 80 from a certain IP.
Posted by ximi, 09-02-2007, 02:56 PM
Snort IDS (10 character min)
Posted by Dexqt, 09-02-2007, 10:04 PM
In addition you can use the following to see how many connections per IP for the entire machine.