Ourmon is an open-source network management and anomaly detection system. It collects data using both multiple instances of the Berkeley Packet Filter, and also various hashed top N lists and then displays the data using RRDTOOL graphs, histograms, and perl reports. Data is produced in near realtime every thirty seconds. Hourly reports are also produced from some of the top N lists and summarized on a daily basis, giving approximately one week of summarized logging reports. Ourmon is customizable and allows the user to create his or her own graphs by grouping BPF expressions (as used in tcpdump) into RRDTOOL-style graphs. It provides graphs, logging, and reports concerning various kinds of flow lists including conventional IP flows, top N syns, top N ports, ICMP and UDP errors, and syn scanners including 1-N ip src to ip dst, and 1-N ip src to L4 ports. It also provides information about coordinated attacks and various kinds of worms.
Ourmon runs on Linux and FreeBSD. This page updates every thirty seconds with
fresh information. A copy of this page that does NOT update every 30 seconds
may be found here:
static index page .
For more information see the
technical info page ,
Current samples of "ourmon" (rmon-like) data from your core network are shown below in graphs and reports. Ourmon output is roughly organized as a high-level web page that shows "current" graphs, and second-level web pages that provide more information on a given filter. See the technical info page for more information.
pkts/drops | bpf-protocols | bpf-errors | topn reports | topn | tcpsyn | tcpworm | icmperrors | udperrors | topn-ports | scanning |
L2 unicast/multicast/broadcast bits/sec:
L2 packet size distribution pkts/sec:
news versus web traffic plus remainder:
estimate of p2p traffic based on BPF/ports:
campus email TCP connection count:
VPN traffic
total campus ICMP unreachable errors:
total campus TCP control packet counts:
RRDTOOL graph of topn ip basic flow counts (flows/sec):
RRDTOOL graph of topn hash inserts (inserts/30 sec):
top talker (top_n) flows based on IP source
top_n TCP flows
top_n UDP flows
top_n ICMP flows
The syn scanner filter includes many features including the port signature report and a more detailed version of the port report found below called the "tcpworm.txt" report. We also show the RRDTOOL "worm" activity graph, which shows the total count of TCP syn-sending IP sources that have exceeded a certain baseline threshold. This graph is used to indicate the existance of large (often botnet-controlled) attacks. After that one finds a graph that shows the average work weight for the network as a whole (all hosts), worms, and P2P apps. Last we show the topn_syn histogram which displays the top syn sending hosts. Here is the port signature report (portreport.txt) and its longer cousin (tcpworm.txt).
top ICMP senders:
The following graph uses a weighted scheme to show which particular IP source is generating UDP packets which cause the most ICMP errors. It has two forms: first you may view the information as an ASCII report which has more details. This report is called the udp port signature report . Second, you may view the information in the histogram graph below.
top/current UDP error generators
top TCP ports:
top UDP ports:
Here we have top talker histograms showing scanning activity. These graphs are all 1 source to many destinations. These include one IP source to many IP destinations, all L4 port sources to L4 destinations (combined TCP/UDP), and specific TCP and UDP port scanning graphs.
One IP src to many IP destinations:
One IP src to many L4 ports (udp or tcp):
TCP Port scanning:
UDP Port scanning:
Note that the current daily summarization is run hourly "today". Previous days represent the midnight final summarization and thus are daily reports. IP/UDP/ICMP flows are bits/second. Syns are counted per sample period, and sorted by max syn count with total syn count, fin count, and resets shown. The "flow id" for syns is simply an ip address.
all worms today (run hourly) | yesterday (run daily) | today - 2 days | today - 3 days | today - 4 days | today - 5 days | today - 6 days | today - 7 days | today - 8 days |
front-end events for today | yesterday | today - 2 days | today - 3 days | today - 4 days | today - 5 days | today - 6 days | today - 7 days | today - 8 days |
summarization for today (run hourly) | yesterday | today - 2 days | today - 3 days | today - 4 days | today - 5 days | today - 6 days | today - 7 days | today - 8 days |
summarization for today (run hourly) | yesterday | today - 2 days | today - 3 days | today - 4 days | today - 5 days | today - 6 days | today - 7 days | today - 8 days |
summarization for today (run hourly) | yesterday | today - 2 days | today - 3 days | today - 4 days | today - 5 days | today - 6 days | today - 7 days | today - 8 days |
summarization for today (run hourly) | yesterday | today - 2 days | today - 3 days | today - 4 days | today - 5 days | today - 6 days | today - 7 days | today - 8 days |