I have been using FlowMatrix. What do others do on the cheap?

  • I was thinking more of tools to analyze netflow traffic, I guess saying "network flows" made the question ambiguous. Commented Nov 14, 2010 at 18:05

3 Answers 3


OSSIM has an Anomalies tab that uses Ntop and can be configured with similar data.

When I did this stuff in the past, I used Ourmon.


WireShark is a free tool you can use to monitor network traffic. Excellent tool to see if a hidden keylogger is trying to email and /or FTP logs because it usually has the address and password in the wireshark log.

  • Given that the logs are not encrypted. Commented Nov 12, 2010 at 22:09

I just saw a talk at Shmoocon about the YaF and SiLK tools that looked really good. YaF is a flow collector (which can collect other interesting data as well), and SiLK is an analysis package for them. There's even a nice GUI called iSiLK.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .