nDPI
securityonion
| nDPI | securityonion | |
|---|---|---|
| 3 | 7 | |
| 3,611 | 2,848 | |
| 0.6% | 2.9% | |
| 9.7 | 8.8 | |
| about 12 hours ago | 7 days ago | |
| C | Shell | |
| GNU Lesser General Public License v3.0 only | - |
Stars - the number of stars that a project has on GitHub. Growth - month over month growth in stars.
Activity is a relative number indicating how actively a project is being developed. Recent commits have higher weight than older ones.
For example, an activity of 9.0 indicates that a project is amongst the top 10% of the most actively developed projects that we are tracking.
nDPI
-
The catch with the free version of ProtonVPN?
The free Proton VPN servers use deep package inspection (nDPI) to block BitTorrent traffic which negatively affects their performance. Other than that, they keep no logs which keeps the privacy and security aspects intact.
-
FOSS Deep Packet Inspection Options
nDPI for ntopng - https://github.com/ntop/nDPI
-
Tools to monitor network traffic for local network
You can try Netify or ntopng / nDPI. I have no experience with them. See also this article.
securityonion
-
Security Onion on Proxmox with Linux Bridges and LACP Bond
I'm trying to get Security Onion running in my lab on my Proxmox server. I'm having trouble getting my WAN traffic to my SO VM. My WAN comes in on VLAN 100 to my switch and goes to my router (Virtual VyOS on the same physical host). I have a ton of VMs and really don't want to move to OVS if I don't absolutely have to. I found this discussion which included some commands for getting SO working on a Linux bridge, but this didn't work for me. Probably because my environment is different. Does anybody have SO setup this way? If so, how did you do it?
- Do I need to be concerned? Ipinfo.io says the ip adress is from Slovakia.
- Elastic Stack 8.2 and Suricata Integration
- Security Onion 2: #distro de #Linux para la caza de amenazas, la supervisión de la seguridad empresarial y la gestión de registros 💯
-
FOSS Deep Packet Inspection Options
https://securityonionsolutions.com/software/ https://github.com/Security-Onion-Solutions/securityonion
-
PFsense vs Mikrotik
I have been debating in my head whether to keep my current setup (PFsense on an old laptop) or buy a 'proper?' solution, by this I mean specialised hardware. PFsense has had a few issues like randomly dropping out, but it has been fine for around 4 days now. My question is: Should I buy a Mikrotik HEX S and use the laptop for other things, or not buy a Mikrotik and instead buy a Dell Optiplex 3020 from Ebay and run SecurityOnion (https://github.com/Security-Onion-Solutions/securityonion) or pfELK (https://github.com/pfelk/pfelk) on it.
-
SecurityOnion
Community support is here. You can also purchase support from the developers on their website.
What are some alternatives?
nfstream - NFStream: a Flexible Network Data Analysis Framework.
arkime - Arkime is an open source, large scale, full packet capturing, indexing, and database system.
pmacct - pmacct is a small set of multi-purpose passive network monitoring tools [NetFlow IPFIX sFlow libpcap BGP BMP RPKI IGP Streaming Telemetry].
Malcolm - Malcolm is a powerful, easily deployable network traffic analysis tool suite for full packet capture artifacts (PCAP files), Zeek logs and Suricata alerts.
zapret - Обход DPI в linux
pfelk - pfSense/OPNsense + Elastic Stack
GreenTunnel - GreenTunnel is an anti-censorship utility designed to bypass the DPI system that is put in place by various ISPs to block access to certain websites.
core - OPNsense GUI, API and systems backend
AIMOD2 - Adversarial Interception Mission Oriented Discovery and Disruption Framework, or AIMOD2, is a structured threat hunting approach to proactively identify, engage and prevent cyber threats denying or mitigating potential damage to the organization.
GoodbyeDPI - GoodbyeDPI — Deep Packet Inspection circumvention utility (for Windows)
hardening - Hardening Ubuntu. Systemd edition.