From owner-freebsd-questions  Sun Sep 30  8:47:22 2001
Delivered-To: freebsd-questions@freebsd.org
Received: from web11705.mail.yahoo.com (web11705.mail.yahoo.com [216.136.172.71])
	by hub.freebsd.org (Postfix) with SMTP id 99AEE37B409
	for <freebsd-questions@FreeBSD.ORG>; Sun, 30 Sep 2001 08:47:19 -0700 (PDT)
Message-ID: <20010930154719.43296.qmail@web11705.mail.yahoo.com>
Received: from [64.81.48.149] by web11705.mail.yahoo.com via HTTP; Sun, 30 Sep 2001 08:47:19 PDT
Date: Sun, 30 Sep 2001 08:47:19 -0700 (PDT)
From: Tim Erlin <tperlin@yahoo.com>
Subject: Re: Network auditing tool
To: BSD Freak <bsd-freak@mbox.com.au>,
	FreeBSD Questions <freebsd-questions@FreeBSD.ORG>
In-Reply-To: <b40244b4529d.b4529db40244@mbox.com.au>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Sender: owner-freebsd-questions@FreeBSD.ORG
Precedence: bulk
List-ID: <freebsd-questions.FreeBSD.ORG>
List-Archive: <http://docs.freebsd.org/mail/> (Web Archive)
List-Help: <mailto:majordomo@FreeBSD.ORG?subject=help> (List Instructions)
List-Subscribe: <mailto:majordomo@FreeBSD.ORG?subject=subscribe%20freebsd-questions>
List-Unsubscribe: <mailto:majordomo@FreeBSD.ORG?subject=unsubscribe%20freebsd-questions>
X-Loop: FreeBSD.ORG


--- BSD Freak <bsd-freak@mbox.com.au> wrote:
> Hiya guys,
> 
> I need somekind of network auditing tool that will
> run the interface in 
> promiscuous mode and sniff the network and give a
> summary of what's 
> been going on. This tool should run at the
> application level rather 
> than at the IP level. I need output similar to the
> following:


You might be able to hack something together using
Snort. There should be a more appropriate tool out
there (anyone?), but Snort will allow you to build the
rules to your specifications, and I believe there are
some useful tools for building pretty reports from
Snort as well. 

--Tim


__________________________________________________
Do You Yahoo!?
Listen to your Yahoo! Mail messages from any phone.
http://phone.yahoo.com

To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-questions" in the body of the message