I'm looking for a GNU/Linux distro that I can install in transparent setup to look for infected hosts on a LAN. I don't need to stop viruses and malwares but only identify them and the host where they come from.

I don't necessarily need fancy graphics but I would like something pre-configured and possibly free. Any suggestions?

  • Is booting with a LiveCD and option for you? – Tim Jun 7 '12 at 13:42
  • Yes Tim i also like livecd – PsyStyle Jun 7 '12 at 14:23
  • 1
    Backtrack perhaps? It's a live CD distro designed for pen-testing but it probably has detection tools as well. Also, you may be interested in the Snort software suite. – jw013 Jul 7 '12 at 15:44
  • +1 for Backtrack. It has penetration testing tools with it by default that will be of great help. This is good ref and will be of help. sectools.org – paintbox Sep 5 '12 at 18:09

securityonion is a ubuntu based distribution for intrusion detection. In its default configuration, it uses snort or suricata and bro-ids to analyse network traffic (that you feed it for instance by configuring your firewall to send it to it, or by using port mirroring on a switch) for signs of malicious activity using rules from VRT or Emerging Threats.

It also comes with an armada of security tools, and tools to inspect traffic. It can also be configured to watch files being downloaded and query databases of malware.


The "SystemRescueCD" distro is gentoo based and comes with at least ClamAV antivirus scanner on it. It might have had a few other AV tools as well.


  • I know SystemRescuCD but it's not suited to my needs. What I'm looking for is a distro wich analyzes traffic passing throw a transparent server and reports for bad virus/malware traffic whith the host source IP address originating the threat. – PsyStyle Jun 7 '12 at 16:38

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.