KNOPPIX-NSM For Linux

KNOPPIX-NSM is dedicated to providing a framework for individuals wanting to learn about Network Security Monitoring.

We have tryed to do most of the hard work to help get the beginner/newbie up and running fast so they spend more time learning about NSM, leaving the details as a later exercise once familiar with the concepts.

KNOPPIX-NSM is based on the ever popular Knoppix, which means that you can test all the tools in a live session running on the cd without installing to harddrive. KNOPPIX-NSM has the added bonus of be able to install to harddisk so you can deploy a NSM framework into your production network and use it for realtime monitoring.

Rapid sensor deployment You can boot you sensors from the live CD, store all data to a local HD partion and have them logging back to a central server.

Complete out of channel Intrusion Detection and Analysis center With KNOPPIX-NSM you can deploy a complete NSM network to monitor your existing network infrastructure. KNOPPIX-NSM comes pre-configured for deployment of multiple sensors and databases, all you need to do is create the sensor accounts in the database and change some passwords.

Secure KNOPPIX-NSM has been built with security in mind. All remote communications are over ssl tunnels so that you do not have to be concerned about eaves droppers if you decide to run KNOPPIX-NSM in your main network channels. Another feature is the use of iptables to ensure that only allowed hosts can connect and only necessary services are visible to the network.

Easy console deployment Need another console, just boot from the cd (setting the host and ip at boot time) and you are up and running straight away.

The intent of KNOPPIX-NSM is to provide a distrubtion with accompanying documentation on the tools that we have selected and how they are put together in the NSM framework.