Open Source PHP Network Monitoring Software

Zabbix is an enterprise-class open source distributed monitoring solution designed to monitor and track performance and availability of network servers, devices and other IT resources. It supports distributed and WEB monitoring, auto-discovery, and more. An enterprise-class distributed monitoring solution for networks & apps

BASE is the Basic Analysis and Security Engine. It is based on the code from the Analysis Console for Intrusion Databases (ACID) project. This application provides a web front-end to query and analyze the alerts coming from a SNORT IDS system.

Weblooker monitors serveral services on multiple systems for their status, up- and downtimes. A webgui and Android client to view the current status and logged downtimes is available as separately package.

A complete OpenSource Network Management System Is SNMP-Standard Oriented (tested on Cisco and Linux). It Integrates Syslog, Tacacs, RRDtool (Performance Graphs), Maps, Traps, TFTP, Autodiscovery, Sound Alerts, AAA, Modular and Extensible.

Flexible web-based firewall log analyzer, supporting netfilter and ipfilter, ipfw, ipchains, cisco routers and Windows XP system logs, and mysql or postgresql database logs using the iptables ULOG or NFLOG target of netfilter others mapped to the ulogd format with a view. Fully supports IPv6 for database logs, and netfilter and ipfilter system file logs. Also supports Maxmind's GeoIP version 2 location databases. For Linux, FreeBSD, OpenBSD, Solaris, OSX,etc.

This is a set of perl and php scripts that are used to collect, process, store and display netflow data.

"Google Hack" Honeypot Project. GHH is written in PHP and assists the development of web based honeypots designed to lure search engine hackers.

Automated Security Tools (autosec) aims to provide automatic tools which network administrators may use to help check and test the security of their network.

IP accounting tools package based on Berkeley Packet Filer mechanism. Continue from BPFT by V.Vorobyev, TRAFD by V.Belekhov & S.Svirid. Use the PCAP library to implement connection to bpf kernel pseudo-device.

Node Runner is a PHP network monitor which is designed to contact network nodes in a specific order based on the hierarchy of your network. If a node does not respond, each of its parents are systematically checked until the true problem is identified.

FWNUA (Free Windows Network User Accounting) runs silently in a Windows login script or GPO and collects data about user logins. FWNUA keeps track of the workstations logins so you don't have to! FWNUA now supports syslog and Splunk! Look for the fwnua - syslog version in the files list. Use Splunk or your own syslog server with data mining tools to create a robust user tracking system. Find our Spunk app on Splukbase: https://splunkbase.splunk.com/app/2773/

SB EventLog Monitor is monitoring and consolidating Windows EventLogs. Events are collected from server using VBS and WMI or by Windows agent. Events are parsed using PHP and YOUR rules and are stored in MySQL database. Email alerts are supported.

The NetworkLens project provides a flexible alarm capturing, analysis, and reporting system for NOC personnel and/or system administrators. Several different input mechanisms are available, as are customized queries and logging facilities.

PotHead What is it? Pothead: A simple lightweight packet for creating a minimal interaction honeypot How does it work? Magic, Well kinda you don’t need super dupper knowledge to use this! Oops the magic failed ;) a really nice INSTALL.md will be written unfortunately it’s not yet available. 1) Download all the files 2) Check if you got everything 3) Upload and configure the Website and backend (includes/Config.php & the .SQL files) 4) Do not forget to change your APIKEY! 5) Run the python file! Pothead.py -pp 22 23 -site http://YOURSITE.COM/api/write.php -apikey YOURAPIKEY 6) Profit! Is this for anyone? Hmmmm, yes and no I would suggest you know a thing or two about PHP & Python. It’s a pre-release and still in the early alpha stage. Is it safe? It’s pretty safe ;) Does it work? Yeah check it live! http://7ol.eu/view.php

TrafficCounter for Draytek Routers (TCDR)

phpWebStats is an opensource project whose purpose is to develop a web statistics package, based on PHP and an arbitrary SQL database (currently only MySQL is supported).

Aware is a high performance distributed event processing framework built for systems management/monitoring. See http://www.elegant-software.com for more info.

BASE+ (Basic Analysis and Security Engine) is based on ACID project. This application provides a web front-end to query and analyze the alerts coming from various IDS systems (e.g. Snort).

PHP-Vegi is a statistical application mainly intended for those desiring an easily customizable and easily deployed system. It relies on the mySQL/PHP interface and displays a wide variety of useful information based on collected data.

UptimeSite is the code behind the Uptimes Project <http://uptimes.hostingwired.com/>. Clients send uptime reports to the server, which are parsed into a wide variety of useful statistics in realtime via the website.

phpIpacStats is a PHP4 script that displays IP accounting statistics generated by 'ipac' or 'ipac- ng' on a Web page. It allows you to view data in predefined timeframes or between two absolute points. It supports multiple styles and languages.

Cupido is a project aimed at heterogenus systems monitoring, passively (trough SNMP Traps), actively (trough various monitoring techniques). Managing and reporting is all WEB Based.

monitor - pings nodes, records response times, and alerts when unreachable checkinout - check in/out tracker for Helpdesk items logger - configuration change logger and notifier assets - asset manager (yet to be developed) projects - project tracker (yet to be developed)

The High Interaction Honeypot Analysis Toolkit (HIHAT) allows to transform arbitrary PHP applications into a web-based Honeypot. A semi-automatic user interface supports the analysis process, scans for attacks etc.

What are the packets rejected by your Netfilter based firewall today ? How often this suspicious host try to connect to your box ? What are the most rejected domains ? Who is this strange host which scan your ports ? The responses are in the iptables log