| netcat | Hobbit | Network cat for Unix, using TCP or UDP protocol (Windows) |
| CryptCat | Farm9.com | netcat enhanced with twofish encryption (Windows, BSD & Linux) |
| SDB | Cycom | Shadowinteger's Backdoor: a netcat clone (portable & strong encryption) |
| Project Loki | daemon9, alhambra | ICMP tunneling: description & implementation |
| redir | Sam Creasey | Linux TCP port redirector |
| nstx | Florian Heinz | The Nameserver Transfer Protocol: DNS tunneling |
| Analysis |
|
| Ethereal | Gerald Combs | Multi-platform graphical protocol analyzer |
| TcpDump | V. Jacobson, C. Leres, S. McCanne | Sniffer: dump traffic on a network (WinDump) |
| ngrep | Jordan Ritter | Network grep |
| Snort | Marty Roesch | The open-source network intrussión detection systems (NIDS) |
| tcpflow | Jeremy Elson | A TCP Flow Recorder |
| tcpstat | Paul Herman | Reports certain network interface statistics (like vmstat for system) |
| EtherApe | Juan Toledo | Graphical network monitor for Unix modeled after etherman |
| Chaosreader | Brendan Gregg | Trace TCP/UDP/... sessions and fetch application data from tcpdump logs |
| Ndiff | James Levine | Compares two nmap scans and outputs the differences |
| NWatch | James Levine | Sniffer and passive port scanner |
| Injection |
|
| Hping(2) | Antirez (S. Sanfilippo) | Command-line oriented TCP/IP packet assembler/analyzer |
| Tcpreplay | Aaron Turner | Pcap editing and replay tools for *NIX |
| Nemesis | Mark Grimes, M. Schiffman | Command-line network packet injection utility for Unix and Windows |
| PackIT | Darren Bounds | Packet toolkit is a network auditing tool: network injection and capture |
| ISIC | Mike Frantzen | IP Stack Integrity Checker |
| SendIP | Mike Ricketts | Commandline tool to allow sending arbitrary IP packets |
| Firewalk | M. Schiffman, D. Goldsmith | Active reconnaissance network tool to analyze IP forwarding devices |
| Ant | Marek Wardzinski | Graphical tool for building and injectionf network frames |
| Scapy | Phil Biondi | Interactive packet manipulation tool, packet generator... |
| Libraries |
|
| (Lib)PCAP | V. Jacobson, C. Leres, S. McCanne | Packet Capture library (WinPCAP) |
| (Lib)NET | Mike D. Schiffman | Packet (network) Construction library |
| (Lib)NIDS | Rafal Wojtczuk | NIDS library: IP defrag, TCP reassembly and TCP port scan detection |
| (Lib)radiate | M. Schiffman, T. Newsham | 802.11b frame assembly/injection library |
| (Lib)sf | S. Bracken, M. Schiffman | IP stack fingerprinting library |
| (Lib)ipg (ipgeo) | Mike D. Schiffman | Library for the IP2LOCATION database:geo-targeting of IP addresses |
| Libdnet | Dug Song | Provides a simplified, portable interface to several low-level networking routines |
| OS & Service identification |
|
| Nmap | Fyodor | Active
OS fingerprinting (nmap -O) and
version scanning (nmap -sV) |
| THC-Amap | van Hauser (The Hackers Choice) | Active application protocol detection |
| PADS | Matt Shelton | Passive network signature-based detector |
| Xprobe(2) | Ofir Arkin, Fyodor Yarochkin | Active OS fingerprinting tools based on the ICMP protocol |
| ISNprober | Tom Vandepoel | Samples TCP Initial Sequence Numbers to determine TCP/IP stack matching |
| Firewalling |
|
| iptables/netfilter | Netfilter Core Team | Network filtering, NAT and packet mangling framework inside the Linux kernel |
| Shorewall | Tom Eastep | High-level tool for configuring Netfilter |
| FireHOL | Costa Tsaousis | The iptables stateful packet filtering firewall builder |
| GuardDog | Simon Edwards | A firewall configuration utility for Linux systems |
| Easy Firewall Generator | Scott Morizot | PHP Web application that generates an iptables firewall script |
| IPSec |
|
| ike-scan | NTA Monitor | VPN Discovery and Fingerprinting tool |
| IKECrack | Anton T. Rager | Bruteforce crack for IPSec authentication |
