Trisul : Open source network metering and forensics

Trisul meters bandwidth usage, monitors flows, and stores raw packets for future analysis. All traffic data is stored in a SQLITE3 database. It communicates with the outside world via the Trisul Remote Protocol (TRP) and via a Ruby-on-rails application called Web Trisul. What sets Trisul apart from other monitoring tools is its drilldown capabilities (show me top hosts using ICMP at 5AM this morning, etc).

Some applications of Trisul

Remote probe for network analyzers
Source of statistical and flow data
Standalone web based traffic monitor
Forensics
Network Security Monitoring

Trisul is created by Unleash Networks and is dual-licensed under the GPLv3.

Features

Traffic meter	Meters bandwidth usage per IP, Protocol, Subnet, etc. Historical usage stats are stored in a SQLite database for future retrieval
Top N monitor	Continuously tracks the top contributors to traffic by IP, Protocol, Subnet,etc. Historical topper statistics are stored in a SQLite database for future retrieval
Database	All data is persisted in a SQLite database. This allows data to be retained across system reboots or application crashes
Optimized Memory Model	A sophisticated memory model allows you to handle high volume networks without eating up memory endlessly
Flow monitor	Tracks TCP/IP flows in real time and stores them in a SQLite database
Raw Data	Archives raw data in a ring file for later re-analysis and forensics
Trisul Remote Protocol	Allows real time remote monitoring and drilldown. Used to communicate with Unsniff (or other analyzers which support the TRP protocol)
Web Trisul	A open source Ruby on Rails application that can be run alongside Trisul. This setup will turn Trisul into a web based network usage monitoring program like ntop. Web Trisul uses several new technologies like AJAX and SVG Charting to minimize rasterization load on the server

Development Highlights

Link	Details
Multi Core Testing 1	An iterative process driven by measurements to optimize Trisul for multicore processors. This first installment uses the Intel Thread Profiler to look at the internals of Trisul threads.
Trisul Architecture	Block diagram of important functional elements in the Trisul system.