Sorry Scapy, but you take too long time to parse and dispatch packets. Python is not very efficient for this purpose so I will probably use another programming language for specific and highly parallelizable tasks. Now, I am reflecting on improving performances. Some object have been added so as to balance the tasks. This version is cleaner than the previous one. I don't know if I will put it in another package later. Welcome Go! The IDS has been reimplemented in Go for performances and concurrency reasons.Ī controller (CLI) is also provided so as to manage the NetSpot service. New distributions options (Debian package, Docker image, armhf and aarch64 binaries)īye, bye Python.Developper process has been improved so as to 'easily' add new counters, statistics and exporting modules.Twice as fast: 1M pkt/s on my affordable desktop and 100K pkt/s on a Raspberry 3B+. Better performances! I think that netspot can process.Forget about the server, just run the binary on what you want (a server mode still exists but it is rather minimal) Single and statically-compiled binary.Many things have changed, making the way to use netspot more modern. Pip3 install mkdocs mkdocs-markdownextradata-plugin mkdocs-material pymdown-extensions Notes Version 2.0a Port netspot to arduino or other small dev board.Web-based GUI (or TUI) for the netspot service.(console, file, socket or InfluxDB database currently). These information to some modules that binds to different backends

When an abnormal value occurs, SPOT triggers an alarm.įinally, the analyzer forwards stat values, SPOT thresholds and SPOT alarms to the exporter. This algorithm learns the normal behaviour of the statistic and constantly updates its knowledge. The statistics are the measures monitored by netspot.Įvery statistic embeds an instance of the SPOT algorithm to monitor itself. pcap file (network capture).Īt a given period (for instance every second), counter values are retrieved so as to build statistics. The packet source can either be an network interface or a. This part is performed by the miner subpackage. Architecture overviewĪt the lowest level, netspot parses packets and increment some basic counters. Developers can notablyĬreate their own counters, statistics or exporting modules. Netspot is rather modular so as to let people enriching it.

Netspot lisense key