Summary Of Tools Commonly Used To Support Network Forensic Investigations

Summary of tools commonly used to support network forensic investigations Key: C=Collection & filtering L=Logfile analysis S= Stream reassembly

R=correlation and analysis of multiple raw data sources A= Application layer viewer W=Workflow or case management

Name

Provider

Platform

Features

TCPDump, Windump

Open Source

C

www.tcpdump.org

Unix, Windows

Ngrep

Open source

Unix

C

Windows

C C

http://ngrep.sourceforge.net/ Network Stumbler

Open source

Kismet

Open source

Unix

http://www.kismetwireless.net

Windows

Open Source

Unix

CL

Unix

CL

Unix

L

Unix

C

Unix

C

Appliance

C

Unix

C

Argus

http://www.netstumbler.com/

http://www.qosient.com/argus/index.htm Flow-tools

Open Source http://www.splintered.net/sw/flow-tools/

Flow-extract, Flow Scripts

Open Source

Etherape

Open Source

http://security.uchicago.edu/tools/net-forensics/ http://etherape.sourceforge.net/

Snort

Open Source www.snort.org

Observer

Network Instruments http://www.networkinstruments.com/

Honeyd

Honey source http://www.citi.umich.edu/u/provos/honeyd/

Ethereal

Open Source

Windows

www.Ethereal.com

Unix

Wild Packets, Inc.

Windows

CLS

Windows with collector appliance

CS

Open Source http://www.dsd.gov.au/library/software/flag/

Unix

L

ACID

Analysis Console for Intrusion Databases http://www.andrew.cmu.edu/~rdanyliw/snort/snortacid.html

Unix

L

Shadow

http://www.nswc.navy.mil/ISSEC/CID/index.html

Unix

LS

DeepNines and Sleuth9

http://www.deepnines.com/sleuth9.html

Unix

CSR

Infinistream

Network Associates

Appliance

CSR

Unix

CLSR

Windows

CLSRW

Unix

CLSRW

Appliance

CSRA

CSRA

http://www.sandstorm.net/products/netintercept/

‘Bundled Software’ (dedicated Linux box)

Forensics Explorers

Windows

CLSRA

Etherpeek

CLS

www.wildpackets.com SecureNet

Intrusion Inc. http://www.intrusion.com

FLAG Forensic and Log Analysis GUI

http://www.networkassociates.com/us/promos/sniffer/infinistream.asp Dragon IDS

Enterasys http://www.enterasys.com/

NSM Incident Response

Intellitactics

neuSecure

GuardedNet

http://www.intellitactics.com/ http://www.guarded.net/investigation.html

NetDetector

Niksun http://www.niksun.com/

NetIntercept

NetWitness

Sandstorm Tech

http://www.forensicsexplorers.com/