Mencegah User Agar Tidak Bisa Membuka LAN Setting Pada Window Dengan Hide Tool

Terkadang ada diantara beberapa user yang sekedar iseng mengganti ip-address nya sendiri, entah ingin tahu atau ada maksud lain. Tetapi pada sisi admin dan system hal tersebut sedikit menjengkelkan karena dengan bergantinya ip address tersebut ada beberapa konfigurasi yang tidak berjalan dengan semestinya.

Dengan Aplikasi Hide Tool ini, itu bisa diamankankan dengan menutup dialog box Internet Protocol (TCP/IP) pada LAN Connection Properties.

Bagi anda yang belum mengetahui tentang Hide Tool, silahkan membuka artikel pada blog ini. Download dan install Aplikasi tersebut.

Freeware NetFlow Software

Caida

Freeware Collector and Reporting

• Cflowd Analysis Software 
• NetraMet 
  

Dynamic Networks

Is a step by step process to build a detailed Network Usage Reports using RRDTool, flow-tools, FlowScan, and CUFlow.

• Dynamic Networks 
  

Ngrep

Ngrep is a tool that provides GNU grep's features applying them to the network layer.

Contents  [hide] 1 Overview 2 Examples 3 Limitations 4 Patches

Overview

Ngrep recognizes IPv4/6, TCP, UDP, ICMPv4/6, IGMP and Raw across Ethernet, PPP, SLIP, FDDI, Token Ring and null interfaces.

Examples

Example 1: dump all common HTTP requests on a live network (eth0):

ngrep -qd eth0 '^(GET|POST|HEAD|CONNECT)' 'tcp'

Example 2: the same, but from a network dump (out.pcap):

ngrep -qI out.pcap '^(GET|POST|HEAD|CONNECT)' 'tcp'

Limitations

Ngrep cannot reconstruct data streams, it has no ability to match a string that is broken across two or more packets.

Patches

• IPv4 and IPv6 fragment reassembly patch

benchmark-linux

	Linux Benchmarks.htm	22-Mar-2011 15:48	30K
	OCBBuild_0714.zip	22-Mar-2011 15:48	67K
	bench.tar.gz	22-Mar-2011 15:48	179K
	bonnie++-1.03e.tgz	22-Mar-2011 15:48	79K
	bonnie++-1.96.tgz	22-Mar-2011 15:48	103K
	bonnie.tar.gz	22-Mar-2011 15:48	7.0K
	hpl.gz	22-Mar-2011 15:48	511K
	lmbench-summary.htm	22-Mar-2011 15:48	6.4K
	lmbench2.tar.gz	22-Mar-2011 15:48	251K
	lmbench3.tar.gz	22-Mar-2011 15:48	402K
	nbench-byte-2.2.2.tar.gz	22-Mar-2011 15:48	109K
	netperf-2.4.0-rc2.tar.gz	22-Mar-2011 15:48	1.4M
	sysbench-0.4.8.tar.gz	22-Mar-2011 15:48	458K
	unixbench-4.1.0.tgz	22-Mar-2011 15:48	62K
	unixbench-5.1.2.tar.gz	22-Mar-2011 15:48	136K
	webbench-1.5.tar.gz	22-Mar-2011 15:48	7.5K

Open Source Next Generation Intrusion Detection and Prevention Engine

The Suricata Engine is an Open Source Next Generation Intrusion Detection and Prevention Engine. This engine is not intended to just replace or emulate the existing tools in the industry, but will bring new ideas and technologies to the field.

OISF is part of and funded by the Department of Homeland Security's Directorate for Science and Technology HOST program (Homeland Open Security Technology), by the the Navy's Space and Naval Warfare Systems Command (SPAWAR), as well as through the very generous support of the members of the OISF Consortium. More information about the Consortium is available, as well as a list of our current Consortium Members. 

 The Suricata Engine and the HTP Library are available to use under the GPLv2. 

The HTP Library is an HTTP normalizer and parser written by Ivan Ristic of Mod Security fame for the OISF. This integrates and provides very advanced processing of HTTP streams for Suricata. The HTP library is required by the engine, but may also be used independently in a range of applications and tools. 

http://www.openinfosecfoundation.org/index.php/download-suricata

prelude faq

Prelude's FAQ v. 0.02 (February 2002) This document is the Frequently Asked Questions on the Network Instrusion Detection System called "prelude". This document easily can be enhanced by your suggestions, which are welcome. You can send anything you want talking about this FAQ to Sebastien Tricaud, toady@cell-security.com. This FAQ is divided in two parts : - Part I : General Questions, which talk about IDS and prelude in general. - Part II : Technical Questions, talking about prelude's installation, configuration and using problems.

The SAMHAIN file integrity / host-based intrusion detection system

The Samhain host-based intrusion detection system (HIDS) provides file integrity checking and log file monitoring/analysis, as well as rootkit detection, port monitoring, detection of rogue SUID executables, and hidden processes.

Samhain been designed to monitor multiple hosts with potentially different operating systems, providingcentralized logging and maintenance, although it can also be used as standalone application on a single host.

Samhain is an open-source multiplatform application for POSIX systems (Unix, Linux, Cygwin/Windows).

http://la-samhna.de/samhain/index.html

SA Network Connection Profiler

Security Analyst Network Connection Profiler [sancp] is a network security tool designed to create connection logs and record network traffic for the purpose of auditing, historical analysis, and network activity discovery.


http://sourceforge.net/projects/sancp/

Sguil's

Sguil's (pronounced sgweel) main component is an intuitive GUI that receives realtime events from snort/barnyard. It includes other components which facilitate the practice of Network Security Monitoring (NSM) and event driven analysis of IDS alerts


http://sourceforge.net/projects/sguil/

Use tools running on M-Lab to test your Internet connection.

Use these tools running on M-Lab to test your internet connection and perform diagnostics.

About the tools:

• By using these tools, you help advance research by contributing valuable data about broadband performance.
• The tools only collect data related to the specifically orchestrated communication "flows" between your machine and the M-Lab server.
• The tools do not collect information about your other Internet traffic, such as your emails, Web searches, etc., or any personally identifiable information, unless you affirmatively provide it in response to a specific request, such as a form that asks you to provide your email address, etc..
• All data collected by the tools will be made publicly available.
• All tools are created by individual researchers, not M-Lab itself.

Network diagnostic tool

Test your connection speed and receive sophisticated diagnosis of problems limiting speed.

Glasnost test

Test whether certain applications or traffic are being blocked or throttled on your broadband connection.

Network path & application diagnostics

Diagnose common problems that impact last-mile broadband networks.

Bandwidth test

See how much bandwidth your connection provides

Traffic shaping test

Determine whether an ISP is performing traffic shaping.

Bismark Gateway

Apply to host a router device to test Internet connectivity over time.

Mobile traffic test

Detect whether your mobile broadband provider is performing application or service specific differentiation.

Network Diagnostic Tool

Network Diagnostic Tool (NDT) provides a sophisticated speed and diagnostic test. An NDT test reports more than just the upload and download speeds -- it also attempts to determine what, if any, problems limited these speeds, differentiating between computer configuration and network infrastructure problems. While the diagnostic messages are most useful for expert users, they can also help novice users by allowing them to provide detailed trouble reports to their network administrator.

Run the network diagnostic tool 

Download Android NDT Client 

Data collection

The server collects test results, records the user's IP address, upload/download speed, packet headers and TCP variables of the test. Archived results are publicly available on Amazon's EC2, and details on the structure of the data can be found here.

More information

http://www.internet2.edu/performance/ndt/

Glasnost test

Glasnost attempts to detect whether your Internet access provider is performing application-specific traffic shaping. Currently, you can test if your ISP is throttling or blocking email, HTTP or SSH transfer, Flash video, and P2P apps including BitTorrent, eMule and Gnutella .

Run the Glasnost test 

Data collection

The measurement server records the user's IP address, and all data packets received by the server from your computer or sent by the server to your computer. In addition, it monitors errors in the communication with the server and the throughput of the transfers for those communication "flows," and sends them to the server.

More information

http://broadband.mpi-sws.org/transparency/bttest-mlab.php

Network path & application diagnostics

NPAD diagnoses some of the common problems effecting the last network mile and end-users' systems. These are the most common causes of all performance problems on wide area network paths.

Run NPAD test 

Data collection

As NPAD transfers bulk data between the server and your computer it gathers detailed statistics about what mechanisms actually regulate performance. In doing so, the server collects test results and records the IP addresses, upload/download speed, packet headers and TCP variables of the test.

Archived results are publicly available on Amazon's EC2, and details on the structure of the data can be found here.

More information

http://www.psc.edu/networking/projects/pathdiag/

Pathload2 bandwidth test

Pathload2 measures the "available bandwidth" of your Internet connection. The available bandwidth is the maximum bit rate you can send to a network link before it gets congested.

We are currently working on a Windows 7 compatible version of Pathload2.

Run Pathload2 (Windows Binary)

Run Pathload2 (Mac OS X Binary)

Run Pathload2 (Linux Source)

Data collection

For every measurement, Pathload2 collects a user's IP address, the time of measurement, the measured available bandwidth in the downstream and upstream directions, and other related statistics.

More information

http://www.cc.gatech.edu/fac/Constantinos.Dovrolis/Papers/NetDov0248.pdf

ShaperProbe traffic shaping test

ShaperProbe detects whether your ISP performs "traffic shaping". Traffic shaping means that your ISP automatically drops your access rate after you have downloaded or uploaded a certain number of bytes. ShaperProbe detects whether traffic shaping is used in either the upload or download directions, and in that case that it is used, ShaperProbe reports the shaping rate and the "maximum burst size" before shaping begins.

We are currently working on a Windows 7 compatible version of ShaperProbe.

Run ShaperProbe (Windows Binary)

Run ShaperProbe (Mac OS X Binary)

Run ShaperProbe (Linux Source)

Data collection

ShaperProbe records the user's IP address, per-packet timestamps and delay/loss measurements as packets traverse the path from the client to the M-Lab server and back.

More information

http://www.cc.gatech.edu/~partha/diffprobe/shaperprobe.html

WindRider mobile traffic test

WindRider attempts to detect whether your mobile broadband provider is performing application or service specific differentiation, i.e. prioritizing or slowing traffic to certain websites, applications, or content.

Run WindRider (SmartPhone or Pocket PC Binary)

Data collection

The measurement server records the mobile device's IP address, and measures the delays of traffic sent to and from the mobile device. It also records delays experienced by different webpages.

The mobile application initiates a series of downstream and upstream transfers with the Measurement Lab Server and records statistics regarding the observed performance. The different transfers are initiated on different ports in order to see if the provider is differentiating traffic based on application, for example web transfers experience faster speeds than applications on other ports. These active measurement results are stored on the considered Measurement Lab Server.

In addition, over time the application measures the delays experienced by different web pages and records the explicit user feedback about different applications. The statistics are uploaded to our servers and not on the Measurement Lab infrastructure. The user can opt out if they desire. In this part, we collect statistics regarding the delays experienced by same pages on different providers and locations and we will determine if certain web pages experience higher delays on certain providers or do not load at all.

More information

http://www.cs.northwestern.edu/~ict992/mobile.htm

Bismark test

Bismark is a project to benchmark broadband performance in homes. Georgia Tech is working with the FCC and SamKnows to deploy programmable gateways nationwide. Bismark is a hardware-based test, but the research team is taking applications for people interested in hosting a test box.

Apply to host a Bismark gateway

Data collection

The boxes will connect to the servers every 5-10 minutes and run a series of tests (latency, packet loss, jitter). Throughput tests are run every 30 minutes or so (single threaded upstream and downstream file transfer using curl; these are also scheduled on the server side to prevent conflicts). Capacity tests are run once every 6 hours.

More information

http://projectbismarck.net

NANO user test (coming soon!)

NANO attempts to detect whether an ISP is degrading the performance of a certain subset of users, applications, or destinations.

Data collection

NANO will perform two functions and collect two sets of data:

• NANO will conduct some tests between the client and an M-Lab server, such as generating downloads of different types of application traffic. This data will be sent to the M-Lab server.
• NANO will also monitor the user's network traffic and collect summary statistics about performance when the user visits popular Internet destinations. Rather than generating tests, it monitors the user's activity in the course of his or her normal Internet usage. NANO sends anonymized and aggregated versions of these statistics back to the NANO research team at Georgia Tech. This data will not be sent to the M-Lab server.

A full explanation of NANO's data collection and anonymization will be listed when the tool is made public.

More information

http://www.cc.gatech.edu/~feamster/papers/nano-hotnets2008.pdf

Network Performance Tools

Links to some of the most useful free open source tools available for network performance testing, debugging, and monitoring. You may already have some of these installed on your system. Some may be available via RPM or the BSD ports library, etc. These links take you to the source/homepage for each tool. All of these run on Linux/Unix, but many of them also have Windows ports.

Connectivity and Path Testing

You probably already have these:
• ping / ping6
• traceroute / traceroute6
• tracepath / tracepath6
Above are in Linux packages iputils and traceroute. Windows comes with ping/ping6, tracert/tracert6, and pathping.

Additional related tools:
• synack - a tcp version of ping
• fping - ping a list of machines, see what is up
• traceroute - The "NANOG Traceroute". May have features that your traceroute does not, such as mtu discovery.
• tcptraceroute - good for finding where ports are blocked. Some modern traceroutes can do the same thing (select protocol TCP).
• Layer Four Traceroute (LFT) - a fairly powerful TCP traceroute
• Paris Traceroute - features for tracing load balanced paths
• scamper - a powerful, scriptable, parallel destination traceroute
• nmap - for finding open/closed/filtered ports
• mtr - a combined graphical ping/traceroute tool
• mturoute.exe - a Windows app for finding path mtu

Multicast Tools

• mtrace - multicast traceroute
• ssmping - multicast ping tools
• Multicast Beacon

TCP/UDP Testing

• nuttcp - the essential TCP/UDP testing tool (a Nuttcp-HOWTO guide)
• iperf - a popular alternative to nuttcp (SourceForge copy)
• thrulay - throughput and delay measurement

Internet2's Testing Tools

• owamp - one way ping
• bwctl - front end controller to iperf

Packet Capture and Display

• wireshark - a network sniffer / protocol analyzer (formerly ethereal)
• tcpdump - raw packet capture (windows version)
• tcptrace - tcp data and graphs from tcpdump files
• xplot - essential for viewing tcptrace output (or get the version on the tcptrace website, which includes a windows port link)
• gnuplot - good for general purpose graphs
• xgraph - great for quick and simple graphs (old but good)

Utilization, Monitoring, Flows

• MRTG - Multi Router Traffic Grapher (loved by all)
• rrdtool - Round Robin Database Tool (MRTG's little brother)
• Net-SNMP - SNMP library and tools
• flow-tools - tools for NetFlow data
• sflowtool - useful in the translation of sflow to pcap
• ntop - NetFlow/SFlow analysis and web interface
• Nagios - powerful open source network monitoring

Tools for Advanced Users Only

• abing - available bandwidth estimation
• pchar - path characterization
• pathrate/pathload - available bandwidth and link capacity estimation
• abget - available bandwidth estimation from web servers
• netpipe - a Network Protocol Independent Performance Evaluator
• hping - the swiss army knife of pings
• drtcp - performance tuning tool for Windows
• mping - a windowed ping
Note that Microsoft has a multicast ping called mping.
• web100 - Linux kernel mods/tools for performance debugging
If you have a web100 kernel, you can use these tools:
• ndt - Network Diagnostic Tool
• npad - Network Path and Application Diagnosis

http://www.wcisd.hpc.mil/tools/

Monitoring and Measurement Projects

The Performance Initiative is actively involved in a variety of projects, many of which are linked to the international perfSONAR effort:

• perfSONAR-PS -- an implementation of the perfSONARnetwork performance measurement framework. MORE>>
• OWAMP -- a tool developed as a sample implementation of IETF RFC 4645 to measure latency; this has been used on Internet2 networks for several years and is in active use by the LHC community.
• BWCTL -- a tool developed to schedule authorized bandwidth tests in a non-conflicting manner; currently using Iperf to conduct the tests, BWCTL prevents tests to and from a given location from interfering with one another.
• NDT -- a user-friendly tool to identify certain known problems and to provide data on performance problems that can be emailed to technical support staff, giving them a 'snapshot' of the problem as it occurred.
• pS-Performance Toolkit -- a customized version of a Knoppix Live-CD bootable disk; this product offers a complete network performance suite pre-installed (and, in many cases, pre-configured) that is ready to be dropped directly into a network operations center (NOC) of any size. With the integration of perfSONAR tools, the results of both passive and active measurements can be shared in a federated environment with your peers enabling the early detection of performance issues.
• Internet2 Network Observatory Data -- data collected at the 11-Internet2 Network router nodes (OWAMP, BWCTL, and other tools) is provided to the community via the Internet2 Observatory.

Performance Enhancement Projects

• Phoebus -- a session-layer approach to increasing performance, Phoebus allows users to identify the required parameters for data transfer (latency, loss, speed, etc.) to optimize their application's use of the network.
• Dynamic Circuits -- This project is working with the Performance Initiative to identify and apply tools and techniques to provide users with the information they require when setting up, using, and dismantling dynamic circuits.

Outreach and Training

• Network Performance Workshops (NPWs) -- one of theInternet2 hands-on workshops, the NPWs use the pS-NPToolkit and other open-source performance and monitoring tools during this 1.5-day hands-on workshop to lead participants through using a variety of tools to solve commonly occuring but troublesome issues, where straightforward trouble-shooting often fails.

General Information

• Jumbo Frames Equipment Testing --This page lists gigabit networking gear tested to identify gear that IS jumbo frame (MTU>=9000 bytes) clean, and gear that is NOT jumbo frame clean.
• ESnet's TCP tuning site is highly recommended for information on bulk data transfers over WANs:fasterdata.es.net
• BGP Tutorial (Netcast Summer 2009)

http://www.internet2.edu/performance/

Know what you are doing

>>> Know what you are doing <<< Works ------------------------------------ | Ettercap Credentials Repository [ Download ] - [ README ] | DefensePro logs visualization tool | v1.0.1 - CLI [ Download ] | v2.0.0 - GUI [ Download ] | => requires ATT Graphic Visualization Library from http://www.graphviz.org/.
| DNS Flooder [ Download ] - [ README ]
| DCE-RPC Evasion proof-of-concept [ Download ]
| HTTP I(D|P)S detection & evasion tools [ Download ] - [ README ]
| Packet injection tool [ Download ] - [ README ]
| URL mutation [ Download ] - [ README ]
| IPS detection [ Download ] - [ README ]
| Multi-purpose port knocker [ Download ] - [ README ]
| Fake SNMP server module for honeyd [ Download ] - [ README ]
| Network, service (HTTP,FTP,SMTP,NNTP,POP3) and HTML pages integrity checking software [ Download ] - [ README ]

Papers -----------------------------------
| Web Services Security [ View ]
| Mitigating Scanners and Crackers [ View ]
| Contourner les I(D|P)S sans rien y connaître [ View ]
| How to test an IPS [ View ]
| Denial of Service Attacks [ View ]
| Covert Channels [ View ]
| Concepts and implementation of a security operation center [ View ]

Major Technical Conferences ------------------------
| OWASP France 2009 - Attacks on Web Services [ View ] [ POC ]
| BlackHat US 2006 - IPS Shortcomings [ View ]
| SSTIC 2006 - Contounement des I(D|P)S pout les nuls [ View ]
| IT Underground Prague 2006 - Some More DCE-RPC Tips and Tricks [ View ]
| CanSecWest 2006 - How to test an IPS [ View ]
| RSA 2006 - Encryption Issues [ View ]
| Assises de la sécurité 2005 - IPS Mythes et Réalité [ View ]
| BlackHat US 2005 - A dirty blackmail story [ View ]

Non Technical Talks ------------------------
| OSSIR Bretagne 2008 - Représentation graphique d'événements de sécurité [ View ]
| IT Security Summit 2008 - Fighting the Botnet Ecosystem [ View ]
| InfoSecurity 2007 - Turning an Intrusion Attempt into a Waterloo disaster [ View ]

Publications -----------------------------
|
| >> Published in MISC - French Security Magazine [ More ]
| #50 - Modèles de sécurité des WAF - July 2010
| #50 - Dossier Jeux en Ligne - July 2010
| #43 - Dossier Web Services - May 2009
| #37 - Dossier Dénis de Services - May 2008
| #34 - Représentation graphique des attaques - November 2007
| HS1 - Outils de scan - November 2007
| #30 - Analyse des botnets - March 2007
| #29 - Les Network Processors - January 2007
| #26 - Comment tester les IPS - July 2006
| #24 - HTTP Smuggling and splitting - March 2006
| #22 - Reporting et procédures de réaction - November 2005
| #22 - Collecte d'informations - November 2005
| #21 - Détecter les équipements en ligne - September 2005 - [ http-ips-detect.pl ]
| #19 - Les Dénis de Service réseau - May 2005
| #18 - Canaux cachés (ou furtifs) - March 2005
| #15 - Protocole RADIUS - September 2004
| #15 - Principes de l'authentification - September 2004
| #13 - Méthodes d'analyses de logs - May 2004
| #11 - Utilisation de SNMP (get|set) - January 2004 - [ SNMaP.sh ] [ SNMPoof.pl ]
| #10 - Technologies de VPNs - November 2003
| #09 - Le rôle d'un CERT - September 2003
| #09 - Collecte de traces Post-intrusion - September 2003
| #07 - Méthodologies d'audit de sécurité - May 2003
| #07 - Fuite d'informations - May 2003 - [ imgsrc.pl ]
| #04 - Les failles du protocole DHCP - November 2002 - [ maraveDHCP.pl ]
| #03 - Concept et contournement des IDS – June 2002
|
| >> Published in LinuxMag - [ More ]
| #HS13 - Définition d’architectures sécurisées – January 2003
| #HS12 - Gestion de logs de firewalls hétérogènes – November 2002
|
| >> Books
| Maîtrise des risques informatiques - Editions WEKA - [ More ]

Other ------------------------------------
| CTO of DenyAll [ Go ]
| Reach me : renaud @ domain.name.of.this.web.site
| Twitt (for site updates) : http://twitter.com/rbidou

http://www.iv2-technologies.com/~rbidou/