Watersrc-stack/NetOtter
1
0
Fork 0
Code Issues Projects Releases 7 Packages Wiki Activity
7 releases 7 tags
  • release-1.2.0 aa240e387e

    release-1.2.0 Stable

    Watersrc-stack released this 2026-10-14 03:12:21 +00:00 | 2 commits to master since this release

    NetOtter r1.02.00

    New: traffic anomaly detection

    Every packet, captured live or loaded with -I, now goes through a set of detectors. New findings are printed as they happen, colour-coded by severity.

    • Connections: port scans, host sweeps, request floods and bursts, SSH/RDP/database brute force, hosts outside your trusted networks (-T <file>), hosts reached without a DNS lookup
    • Errors: services refusing or not answering, SYN floods, failed DNS lookups (random domain names), failing resolvers, unreachable reports, HTTP error ratios
    • Timing: beaconing (regular check-ins, jitter-tolerant), traffic spikes
    • Content: protocols on the wrong port (SSH on 443, HTTP on 53...), DNS tunnels
    • ARP and sniffers (passive): an address changing MAC (critical for the gateway), IP conflicts, one MAC answering for many addresses, reverse-DNS bursts

    New commands: w (every anomaly, most severe first), s (statistics: top talkers, services, flows, packets-per-second chart), and the anomaly <kind|all> filter. -c prints the statistics and the report after the list.

    Other changes

    • Every packet has a capture time: l shows the seconds since the first packet, i the full date
    • l now shows what it recognizes in packets: [DNS NXDOMAIN], [HTTP 404], [port unreachable ...], [echo request]
    • i shows what a packet's data looks like (TLS, SSH, HTTP, DNS, QUIC...)
    • Faster capture on Linux: a memory-mapped kernel ring (8 MiB) instead of the socket buffer; frames dropped by the kernel or Npcap are now reported instead of lost silently
    • New regression lab, tools/lab/: 22 scenarios in a virtual network that needs no root
    • Wiki: new Anomaly detection, Anomaly lab and Traffic anomalies pages; examples re-recorded

    Compatibility

    • Save format is now v16: files from earlier versions (v13 to v15) can't be loaded
    Downloads