Free network packet software for mac

Kismet is an 802.11 layer2 wireless network detector, sniffer, and intrusion detection system.
Kismet will work with any wireless card which comes with support for the raw monitoring (rfmon) mode, and can sniff 802.11a, 802.11b, and 802.11g traffic.
Kismet identifies networks by passively collecting packets and detecting standard named networks, detecting (and given time, decloaking) hidden networks, and infering the presence of nonbeaconing networks via data traffic.

Main features:
- Ethereal/Tcpdump compatible data logging
- Airsnort compatible weak-iv packet logging
- Network IP range detection
- Built-in channel hopping and multicard split channel hopping
- Hidden network SSID decloaking
- Graphical mapping of networks
- Client/Server architecture allows multiple clients to view a single
- Kismet server simultaneously
- Manufacturer and model identification of access points and clients
- Detection of known default access point configurations
- Runtime decoding of WEP packets for known networks
- Named pipe output for integration with other tools, such as a layer3 IDS like Snort
- Multiplexing of multiple simultaneous capture sources on a single Kismet instance
- Distributed remote drone sniffing
- XML output
- Over 20 supported card types

Enhancements
- This is a complete rewrite of Kismet (referred to as Kismet-Newcore while under development).
- It includes a new user interface, improved tracking, IDS functions, a plugin architecture... for both server and client, and auto-detection of drivers and supported channels on sniffing devices

Switzerland is a tool for testing networks, ISPs and firewalls developed by the Electronic Frontier Foundation (www.eff.org).
Switzerland will spot IP packets which are forged or modified between clients, inform you, and give you copies of the modified packets.

Enhancements
Lots of bugfixes and some new features:
- Make the messages that Switzerland gives users less cryptic and more informative! Especially
- Improve on the notification of modified/forged packets in versions 0.0.x. In the case of modifications, provide specific reports of which packet fields have been modified, from what and to what. In the case of injections/forgeries, provide tcpdump-style representations of the packets.
- Include a new command line tool, study-switzerland-pcaps, to perform the above analysis based on the -in and -out pcap modification/forgery logs produced by Switzerland. This will be useful both for old logfiles from 0.0.7 and for newly created logs.
- Reduce the incidence and duration of the "you cant connect, because we already have a connection from your IP" problem.
- Fix several internal bugs in the server, which 0.0.7 "handled" by catching exceptions and trying to ignore them.
- When modified/forged packets are observed, dont tell other parties what your NIC and routers MAC addresses are
Internal improvements and adjustments:
Refactor things out of Switzerland.py:
- Matchmaking is now separated and easier to understand
- Forgery context operations are now part of SwitzerlandLink.py
- There are some minor but incompatible changes to the wire protocol, in which reports on forgeries are passed around with the fo-context and forged-details messages.
- We have some traceroute collection infrastructure now, although were not using it yet

CloudVPN is a multi-protocol mesh virtual network. Simply - CloudVPN is capable of transporting any reasonable packet protocol, for any application that needs to communicate.
Cloud nodes act as a meshing and transporting layer, and applications connect to them using a gate socket.
Such client applications include:
- Ethernet tunnel, that uses the cloud as one big virtual network, which, given the mesh properties, also proves to be efficient and secure; and gives CloudVPN the "classical VPN function".
- Secure chat client, using the same security adventages.
- Filesharing client (which really proposed itself as a bittorrent alternative)
- Optimized radio-like broadcasting client
- Whatever else you like.

Enhancements
- Full Win32 support was added with the TAP-Win32 package. Massive cleanup was done. The build system was migrated to autotools, which allows easy compiling on many platforms. Some... compilation fixes and one local socket improvement were made

AutoScan-Network 1.42 is designed to appeal many users as a high-quality and useful application designed to explore and to manage your network. Entire subnets can be scanned simultaneously without human intervention. The objective of the program is to post the list of all equipment connected to the network. A list of ports preset is scanned for each equipment.

Major Features:

1. Fast multithreaded scanning
2. Automatic network discovery
3. Extreme Low Bandwidth
4. Multi-Site
5. Entire subnets can be scanned simultaneously without human intervention
6. Addition time-reality of the new machines put on the network
7. Monitoring of equipement (router, server, firewall, ...)
8. Monitoring of network services (smtp, http, pop, ...)
9. Detection of the OS, brand and model known (Possibility to add an unknown equipment in the database)
10. Telnet Client
11. Ssh Client
12. Vnc Client
13. Ability to save the network state (XML)
14. Intrusion Alert (If you active this function, the new equipments found will be considered as intruders)

Netstorm is a highly flexible and fast network security and reliability tester that will help you to setup real world low level flood attack scenarios (such as MITM, DoS and DDoS) within a local area network and on the internet.

Main features:
- Platform independent
- Anonymous ARP-Reply attacks
- Anonymous ICMP-Echo attacks (IPv4 and IPv6)
- Anonymous TCP-SYN attacks (IPv4 and IPv6)
- Window based TCP-RST attacks (IPv4 and IPv6)
- Anonymous UDP attacks (IPv4 and IPv6)
- Random or fixed packet count and or attack duration
- Random or fixed send delay for breaking flood detections
- Pattern based packet address configuration
- Intelligent address and address protocol detection
- Address adequate, wildcard based, randomization
- Packet data injection (Random buffering or file based)
- Daemon for setting up controlled DDOS-Attack networks

Enhancements
- Added TCP-ACK attack
- Updated documentation
- Fixed TCP acknowledgement number generation
- Set TCP window field to 0 on TCP-RST attacks

Shoki is a free, open source network intrusion detection system for conducting traffic analysis.
The fundamental design goals of shoki are:
- Simplicity. The components of shoki are designed to be as straightforward (and therefore as easy to understand) as possible
- Modularity. The functionalities provided by the various components of shoki are intended to be as decoupled from each other as practically possible
NOTE: Shoki is licensed and distributed under the terms of the BSD License.

Main features:
- Signature matching using libpcap-style filter expressions
- Support for searches using POSIX extended regular expressions
- Optional support for searches using Perl-compatible regular expressions
- Dynamic rule-based signature generation
- Correlation of data from multiple sources
- Sending alerts to IM clients via the Jabber protocol
- Visualisation of packet data via OpenGL
- Anomaly scoring based on questionable math
- Correlation of events to local assets (and known vulnerabilities)
- Remote OS identification via passive fingerprinting
- RFC 815-style fragment reassembly
- Configurable scan detection
- Configurable threshold-based signature detection
- Analysis of entropy in IP packet fields

System requirements:
- libpcap
- flex
-

Enhancements
- lexer bugfix: Added pcap_close() before exiting
- doctrine logic bugfix: fixed bug in doctrine verifier
- doctrine logic tweak: added canonicalise_pcap()
- search logic bugfix: fixed bug handling NULLs (0x00) in hex searches
- TCP option handling bugfix: fixed bug in TCP option processing on sparc64 (and other platforms where unaligned access fails)
- ac bugfix: fixed memory allocation error in ac(1)
- feature add: added preliminary IDMEF output support
- feature add: added test for dumpfile rewriting
- scripting tweak: changed semantics in some scripts in handling lists of filenames