Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have been using FlowMatrix. What do others do on the cheap?

share|improve this question
I was thinking more of tools to analyze netflow traffic, I guess saying "network flows" made the question ambiguous. – Tate Hansen Nov 14 '10 at 18:05
up vote 3 down vote accepted

OSSIM has an Anomalies tab that uses Ntop and can be configured with similar data.

When I did this stuff in the past, I used Ourmon.

share|improve this answer

WireShark is a free tool you can use to monitor network traffic. Excellent tool to see if a hidden keylogger is trying to email and /or FTP logs because it usually has the address and password in the wireshark log.

share|improve this answer
Given that the logs are not encrypted. – Olivier Lalonde Nov 12 '10 at 22:09

I just saw a talk at Shmoocon about the YaF and SiLK tools that looked really good. YaF is a flow collector (which can collect other interesting data as well), and SiLK is an analysis package for them. There's even a nice GUI called iSiLK.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.