Re: Session statistics

[Richard Bejtlich <richard_bejtlich () yahoo com>]

Hello,

John Creegan asked for tools that could show:

     1. Who the top talkers are
     2. Where the hotspots on the network are.

In addition to the excellent ideas already posted, you
might try:

trafd:
http://www.riss-telecom.ru/pub/dev/trafd/trafd-3.0.1.tgz

trafshow:
ftp://ftp.nsk.su/pub/RinetSoftware/trafshow-3.1.tgz

I like trafd for historical or batch collection, and
trafshow for "real time" collection.

I like to use both in the /usr/net/ports tree on
FreeBSD as trafd has installation problems on stock
Red Hat 7.3 boxes.  

I mention both in a recent webcast I recorded:

http://searchsecurity.techtarget.com/webcasts/0,289675,sid14,00.html

Good luck,

Richard
http://taosecurity.com

__________________________________
Do you Yahoo!?
Yahoo! SiteBuilder - Free, easy-to-use web site design software
http://sitebuilder.yahoo.com


-------------------------------------------------------
This SF.net email is sponsored by: VM Ware
With VMware you can run multiple operating systems on a single machine.
WITHOUT REBOOTING! Mix Linux / Windows / Novell virtual machines
at the same time. Free trial click here:http://www.vmware.com/wl/offer/358/0
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users