clsniffer – Dynamically change firewall.

Clamav sniffer/clsniffer scans network traffic through a given interface for malware by performing real-time scanning of your network. If malware is detected it will then optionally block the remote site for a minute.

Tested on:
– Debian 8/9, Ubuntu14/16 and Fedora Linux
– Linux2.6, FreeBSD7.0, Solaris10, OpenBSD4.2 and NetBSD4.0

Clamav-sniffer

Dependencies:
– libpcap-dev (Based Debian)
– libpcap-devel (Based Fedora)

Usage:

git clone https://github.com/nigelhorne/clamav-sniffer && cd clamav-sniffer
aclocal
./configure
automake --add-missing (for install ./compile file)
make

example:
./clsniffer -d -s -vv -w 212.159.0.0/19 -W /var/run/clamav/clamd.sock&

Source: https://github.com/nigelhorne