Software Map

alscan extracts data from Web server access logs. It creates a report based upon the contents of the logs and the options specified on the commandline.

Cisco IP Accounting Fetcher is a set of Perl scripts that allows you to fetch
IP accounting data from Cisco routers. It is capable of fetching this
information from multiple routers. It summarizes this information on a daily
and monthly basis. It optionally generates HTML output with CSS support, and it
is able to ignore specific traffic.

IP Traffic Volume uses Linux kernel iptables to
log incoming and outgoing bytes though your
network device(s) and can dump summarized log
statistics in ASCII to the console or display in
HTML via the included CGI interface for displaying
on a Web server. It is highly configurable as to
what kind of traffic is counted, e.g. to and from
specific ports and/or specific IP addresses or
groups of ports and addresses. It uses a mininum
of resources and doesn't need a database for the
logged data.

Petit was developed to quickly analyze syslog and Apache log files in large environments. It can also be used for word discovery within log data. It is a general purpose tool that can do hashing, word counts, and command line graphing of Apache and syslog files. It is designed to be a standard Unix tool that can be employed with pipes or by opening files. Petit works by sifting data with standard patterns and allows for custom filters and fingerprints. This leaves the analyst with data that is both varied and interesting.

Fido is a multi-threaded file watcher which searches files in real time for user-defined patterns. When it locates a match, it runs a user-defined program. It is useful for monitoring log files for issues and responding to them. It was designed to recognize log file rotation and start monitoring from the beginning of the new file.

webalizer-asn is an autonomous system number (ASN)
extension for Webalizer. It is useful for
high-traffic sites and ISPs that want to know from
which networks visitors are coming from. This
information could be used to plan future peerings
or other things.

Report Magic is an add-on for Analog, a Web site logfile analysis program. Generated reports include a description with tabulated, graphed, and summarized results. All colors, fonts, and background images are completely customizable to help make resulting reports fit the theme of your Web site. Report Magic has translations for several languages. It runs on any platform that will run Perl and pre-compiled versions are available for Win32 and Mac.

lwatch is a log parser/analyzer written in C with the PCRE library. It is small and efficient. You are able to define your own colors using regexp patterns. The biggest advantage compared to other tools written in Perl is its speed.

Qmail-Scanner Statistics (QSS) uses the Qmail-Scanner Logfile to generate
daily, monthly, and yearly statistics. It also shows a complete list of viruses
stopped by Qmail-Scanner, the top five domains from which the viruses came, as
well as the countries of origin.

Apache::Logmonster is a tool to collect log files from multiple Apache Web servers, split them based on the virtual host, sort the logs into chronological order, and then pipe them into a log file analyzer of your choice (Webalizer, http-analyze, AWstats, etc).

stdnoj is a cross-platform C++ class library that
includes classes for using portable strings,
databases, SMTP, POP, NNTP, arrays, files,
directories, logging, email, and sockets. While
templates are used, no reliance upon STL or other
(traditionally error-prone) technologies has been
used, which increases portability between
compilers.

incident.pl is a small script that, when given syslogs generated by
snort or other tools, can generate an incident report for events that
appear to be attempted security attacks, gather information on the
remote host, and report the attack to the appropriate administrators.

NISCA (Network Interface Statistics Collection Agent) is a more flexible PHP4-based MRTG replacement. It supports both SNMP and reading localhost's /proc/net/dev device file directly for statistics gathering. It uses MySQL to store collected data in, and stores statistics for bytes transferred, packets transferred, transfer errors, and dropped packets separated into a per interface incoming and outgoing set. It generates both graphs and a textual report table using the data from any timeframe contained in the database. The entire package runs using PHP4; it uses the CGI binary version of PHP for stats collection (running in the background as a "daemon") and either the CGI or Apache module versions to generate the GUI form and reports. It can also import existing MRTG logfiles.

IDEA is an architecture for implementing a
distributed intrusion detection system on a
computer network. It provides a way to incorporate
many different IDS sensors into an architecture,
and have them report to a central IDS server.
This server collects, aggregates, and correlates
data from the sensors, providing a unified view
of network activity. By specifying an open API,
many different clients can connect to the IDEA
server and "subscribe" to the event notification
service so that the client will be notified any
time a new alert is received from any of the sensors.