Reviving PortSentry: A Modern Approach to Network Security Monitoring
summary
PortSentry is modernized: two and a half years of fixes and rewrites produce an imminent v2.0 with libpcap/eBPF capture, IPv6 support, and Docker image on Docker Hub for one‑command deployment. Legacy Unix support is removed, build moves to CMake, linting/static analysis and integration tests are added. fail2ban integration and Prometheus/Loki plans exist. Profiling halves per‑packet handling time to roughly 2 ms making it practical for gigabit links; v3.0 may move to Rust and multithreading.
AI-written summary · about
chapters (7)
- 0:00PortSentry introduction
- 4:52PortSentry history and revival
- 7:20PortSentry 2.0 improvements
- 11:31Unix system support lessons
- 21:59Cross-platform development
- 22:45Future plans and timeline
- 24:52Q&A
related talks
26mNetwork monitoring with FOSS
44mNetsec is Dead(?): Modern Network Fingerprinting for...
41mState of the Onion
01h 45mPeel Back the Layers of Your Enterprise with the NEW Security Onion 2.0!
32mTracing the Linux networking stack with Retis
24mDeep Network Traffic Observability with Pktvisor and Prometheus
35mInnovate Fast, Operate Securely: AI-Powered Protection for Containerized Workloads
39mImproving OT Network and Host Baselines to Secure Critical Infrastructure