Analyzer: a public domain protocol analyzer win32, freeware
Argus: auditing network activity can be used to analyze and report on the contents of packet capture files or it can run as a continuous monitor, examining data from a live interface; generating an audit log of all the network activity seen in the packet stream. Argus can be deployed to monitor individual end- systems, or an entire enterprises network activity. As a continuous monitor, Argus provides both push and pull data handling models, to allow flexible strategies for collecting network audit data. Argus data clients support a range of operations, such as sorting, aggregation, archival and reporting. There is XML support for Argus data, which makes handling Argus data a bit easier, see ArgusRecord.xsd.
Hunt : tool for exploiting well known weaknesses in the TCP/IP protocol suite
IPAudit : Monitor network activity on a network by host, protocol and port Ipaudit listens to a network device in promiscuous mode, and records of every 'connection', each conversation between two ip addresses. A unique connection is determined by the ip addresses of the two machines, the protocol used between them and the port numbers (if they are communicating via udp or tcp).
LanGuard : Network Scanner freeware security scanner to audit your network security. It scans entire networks and provides NETBIOS information for each computer such as hostname, shares, logged on user name. It does OS detection, tests password strength, detects registry issues and much more. Reports are outputted in HTML.
LanGuard : Port Scanner freeware tool that allows you to scan your network for active ports and identify unused applications such as web servers that could be a security hole. You can also identify trojans. A unique port scan compare feature will alert you for new ports,which could possibly be trojans or unauthorised applications. It runs as a service in the background.
LSRScan : checks the behaviour of remote hosts to loose source routed packets
LSRtunnel : spoofs connections using source routed packets
MingSweeper : windows-based network reconnaissance tool capable of performing Ping sweeps, Reverse DNS sweeps, TCP & UDP port scans, OS identification and application identification.
NBTScan : NetBIOS Name Network Scanner scanning IP networks for NetBIOS name info
Ngrep : network grep
pcap-aware tool that will allow you to specify extended regular or hexadecimal expressions to match against data payloads of packets. It currently recognizes TCP, UDP and ICMP across Ethernet, PPP, SLIP, FDDI, Token Ring and null interfaces, and understands bpf filter logic in the same fashion as more common packet sniffing tools, such as tcpdump and snoop.
ProbeTS : find Terminal servers when not using port 3389
proDETECT : open source promiscious mode scanner with a GUIIt uses ARP packet analyzing technique to detect adapters in promiscious mode.This tool can be used by security administrators to detect sniffers in a LAN.It can be scheduled for regular scanning over periods.It also has some advanced reporting capabilities such as SMTP reporting.Full source code is included.
Promiscuous:
AntiSniff : scan ethernet network, detect computers in promiscuous mode NT
PromiScan W2K Pro; searches for promiscuous nodes on the local net
Sniffit : LINUX, SunOS, Solaris, FreeBSD and IRIX scanner
snmp scanners
IconLabs : SNMP Sniffer
Snmp : Windows snmp scanner freeware, also discover interface information, routing and ARP tables, as well as port scans, Traceroutes, NSLookups, and IP Scans
SnmpSniff
SolarWinds
SolarWinds : Network Analysis and Diagnostic Tools
SSS : Shadow Security Scanner
STAT Scanner vulnerability assessment tool for Windows NT and Windows 2000
Strobe very small, fast scanner which operates over class B networks and a perl script which uses it to scan for open e-mail relays
SuperScan : Foundstone's fast TCP port scanner, pinger, resolver multithreaded and asynchronous techniques making it extremely fast and versatile. You can fingerprint responding ports by viewing connect strings, and use helper apps to maintain connections. Port scans can be driven from a text file, and output from SuperScan can be directed into a text file.
THC-Parasite
sniff on switched networks by performing ARP man-in-the-middle spoofing. Selective targets, DOS and various other features present. Changes: Now running on Solaris and OpenBSD as well
Whisker : information, scripts, and updates web server vulnerabilities