A tool to catch spoofed NBNS responses.
The main features of netspi/spoofspotter are: Network Security Monitoring.
Open-source alternatives to netspi/spoofspotter include: security-onion-solutions/securityonion — Security Onion is a security information and event management platform and network security monitoring suite. It… zeek/zeek — Zeek is a network analysis framework and security monitoring tool that transforms raw network packets into high-level… ntop/ndpi — nDPI is a deep packet inspection toolkit and network protocol classifier designed to identify protocols and detect… skeeto/endlessh — Endlessh is an SSH tarpit and network honeypot designed to mitigate automated SSH brute force attacks. It acts as a… google/tsunami-security-scanner — Tsunami Security Scanner is a network vulnerability scanner and security auditor designed to identify high-severity… mitrecnd/chopshop — Protocol Analysis/Decoder Framework.
Security Onion is a security information and event management platform and network security monitoring suite. It functions as an intrusion detection system and a network traffic analysis tool designed to identify malicious activity and network intrusions through signature-based detection and host-based monitoring. The platform integrates a security case management system to organize investigations by tracking detections and grouping related security events. It provides capabilities for full packet capture, network metadata extraction, and the collection and indexing of security logs from dive
Zeek is a network analysis framework and security monitoring tool that transforms raw network packets into high-level semantic logs. It functions as an application protocol analyzer and network intrusion detection system designed to extract meaning from network traffic and monitor for malicious activity. The system focuses on archiving network activity and maintaining historical records of application-layer state for forensic investigation and auditing. It utilizes a combination of modular protocol analyzers and customizable detection policies to perform deep semantic analysis of numerous app
nDPI is a deep packet inspection toolkit and network protocol classifier designed to identify protocols and detect security threats through packet payload inspection. It functions as a network security monitor and a traffic analysis framework used to determine the services originating network flows. The system utilizes a modular dissector architecture and a sequence-based dissector chain to interpret network traffic. It supports custom protocol definition and protocol dissector extensions, allowing for the identification of proprietary or new network protocols. The toolkit provides capabilit
Endlessh is an SSH tarpit and network honeypot designed to mitigate automated SSH brute force attacks. It acts as a defensive layer that protects servers by diverting malicious connection attempts into a slow-motion trap. The project implements a tarpit by sending endless, throttled banners to clients, which keeps connections open indefinitely to occupy attacker resources and slow down network scans. The service includes connection rate limiting to prevent system resource exhaustion and provides monitoring through connection activity and diagnostic data logging to system logs. Process manage