Wireshark - Network Traffic Analyzer

•    C

---

Wireshark is a network traffic analyzer, or "sniffer", for Linux, macOS, *BSD and other Unix and Unix-like operating systems and for Windows. It uses Qt, a graphical user interface library, and libpcap and npcap as packet capture and filtering libraries.

packet-capture tshark pcap libpcap sniffer traffic-analyzer

netsniff-ng - The packet sniffing beast

•    C

---

netsniff-ng is a free Linux networking toolkit, a Swiss army knife for your daily Linux network plumbing if you will. Its gain of performance is reached by zero-copy mechanisms, so that on packet reception and transmission the kernel does not need to copy packets from kernel space to user space and vice versa.

networking linux packet-sniffer packet-generator packet-capture sniffer

scapy - Scapy: the Python-based interactive packet manipulation program & library

•    Python

---

Scapy is a powerful Python-based interactive packet manipulation program and library. It is able to forge or decode packets of a wide number of protocols, send them on the wire, capture them, store or read them using pcap files, match requests and replies, and much more. It is designed to allow fast packet prototyping by using default values that work.

scapy python-modules network network-analysis network-visualization network-discovery python2 python3 python-2 python-3 pcap packet-capture packet-sniffer packet-analyser packet-analyzer packet-crafting security security-tools network-security

PcapXray - :snowflake: PcapXray - A Network Forensics Tool - To visualize a Packet Capture offline as a Network Diagram including device identification, highlight important communication and file extraction

•    Python

---

Given a Pcap File, plot a network diagram displaying hosts in the network, network traffic, highlight important traffic and Tor traffic as well as potential malicious traffic including data involved in the communication.

forensics pcap network computer-forensics tor-traffic forensic-analysis cybersecurity

PcapPlusPlus - PcapPlusPlus is a multiplatform C++ network sniffing and packet parsing and crafting framework

•    C++

---

PcapPlusPlus is a multiplatform C++ network sniffing and packet parsing and crafting framework. PcapPlusPlus is meant to be lightweight, efficient and easy to use.

c-plus-plus pf-ring dpdk packet-parsing winpcap pcap-files pcap packet-processing cpp libpcap multiplatform mac-osx packet-analyser networking network-forensics network-tools tcp-reassembly packet-crafting

tcpreplay - Pcap editing and replay tools for *NIX and Windows - Users please download source from

•    C

---

Tcpreplay is a suite of GPLv3 licensed utilities for UNIX (and Win32 under Cygwin) operating systems for editing and replaying network traffic which was previously captured by tools like tcpdump and Ethereal/Wireshark. It allows you to classify traffic as client or server, rewrite Layer 2, 3 and 4 packets and finally replay the traffic back onto the network and through other devices such as switches, routers, firewalls, NIDS and IPS's. Tcpreplay supports both single and dual NIC modes for testing both sniffing and in-line devices.Tcpreplay is used by numerous firewall, IDS, IPS, NetFlow and other networking vendors, enterprises, universities, labs and open source projects. If your organization uses Tcpreplay, please let us know who you are and what you use it for so that I can continue to add features which are useful.

tcpreplay pcap netmap replays-pcap-files flow traffic netflow performance performance-testing packet-generator jvm

Moloch - Large scale, full packet capturing, indexing, and database system

•    Javascript

---

Moloch is an open source, large scale, full packet capturing, indexing, and database system. Moloch augments your current security infrastructure to store and index network traffic in standard PCAP format, providing fast, indexed access. An intuitive and simple web interface is provided for PCAP browsing, searching, and exporting.

network-monitoring pcap packet-capture nsm

NetworkMiner packet analyzer

•    CSharp

---

NetworkMiner is a Network Forensic Analysis Tool (NFAT) for Windows that can detect the OS, hostname and open ports of network hosts through packet sniffing or by parsing a PCAP file. NetworkMiner can also extract transmitted files from network traffic. A professional edition of NetworkMiner is available for purchase from NETRESEC at http://www.netresec.com/?page=NetworkMiner

netgraph - A cross platform http sniffer with a web UI

•    Go

---

Netgraph is a packet sniffer tool that captures all HTTP requests/responses, and display them in web page. You can run Netgraph in your linux server without desktop environment installed, and monitor http requests/responses in your laptop's browser.

network-analysis http pcap-analyzer network-monitoring sniffer

skydive - An open source real-time network topology and protocols analyzer

•    Go

---

Skydive is an open source real-time network topology and protocols analyzer. It aims to provide a comprehensive way of understanding what is happening in the network infrastructure. Skydive agents collect topology informations and flows and forward them to a central agent for further analysis. All the informations are stored in an Elasticsearch database.

networking network-topology flow monitoring traffic-analysis traffic-monitoring metrics packet-sniffer packet-analyzer pcap ebpf

tcpdump - the TCPdump network dissector

•    C

---

To report a security issue please send an e-mail to security@tcpdump.org. To report bugs and other problems, contribute patches, request a feature, provide generic feedback etc please see the file CONTRIBUTING in the tcpdump source tree root.

pcap pcapng packet-capture sniffer tcpdump libpcap bpf berkeley-packet-filter

libtins - High-level, multiplatform C++ network packet sniffing and crafting library.

•    C++

---

libtins is a high-level, multiplatform C++ network packet sniffing and crafting library. Its main purpose is to provide the C++ developer an easy, efficient, platform and endianess-independent way to create tools which need to send, receive and manipulate specially crafted packets.

network packet-parsing packet-analyser packets sniffing pcap libpcap

PCAP-ATTACK - PCAP Samples for Different Post Exploitation Techniques

•    

---

Container of PCAP captures mapped to the relevant attack tactic.

detection threat-hunting pcapng pcap-files mitre-attack

joy - A package for capturing and analyzing network flow data and intraflow data, for network research, forensics, and security monitoring

•    C

---

Joy is a BSD-licensed libpcap-based software package for extracting data features from live network traffic or packet capture (pcap) files, using a flow-oriented model similar to that of IPFIX or Netflow, and then representing these data features in JSON. It also contains analysis tools that can be applied to these data files. Joy can be used to explore data at scale, especially security and threat-relevant data. JSON is used in order to make the output easily consumable by data analysis tools. While the JSON output files are somewhat verbose, they are reasonably small, and they respond well to compression.

NFStream - A Flexible Network Data Analysis Framework

•    Python

---

NFStream is a Python package providing fast, flexible, and expressive data structures designed to make working with online or offline network data both easy and intuitive. It aims to be the fundamental high-level building block for doing practical, real world network data analysis in Python. Additionally, it has the broader goal of becoming a common network data processing framework for researchers providing data reproducibility across experiments. NFStream extracts +90 flow features and can convert it directly to a pandas Dataframe or a CSV file.

data-science data-analysis data-mining network-analysis network-security network-monitoring cybersecurity machine-learning artificial-intelligence dataset-generation deep-packet-inspection netflow traffic-analysis traffic-classification pcap packet-capture packet-analyser ndpi

nfstream - NFStream: a Flexible Network Data Analysis Framework.

•    Python

---

NFStream is a Python framework providing fast, flexible, and expressive data structures designed to make working with online or offline network data both easy and intuitive. It aims to be the fundamental high-level building block for doing practical, real world network data analysis in Python. Additionally, it has the broader goal of becoming a common network data analytics framework for researchers providing data reproducibility across experiments. Binary installers for the latest released version are available on Pypi.

data-science machine-learning data-mining netflow pcap packet-analyser traffic-analysis artificial-intelligence cybersecurity network-monitoring data-analysis dataset-generation network-analysis packet-capture ndpi network-security deep-packet-inspection traffic-classification

malcom - Malcom - Malware Communications Analyzer

•    Python

---

Malcom is a tool designed to analyze a system's network communication using graphical representations of network traffic, and cross-reference them with known malware sources. This comes handy when analyzing how certain malware species try to communicate with the outside world. The aim of Malcom is to make malware analysis and intel gathering faster by providing a human-readable version of network traffic originating from a given host or network. Convert network traffic information to actionable intelligence faster.

malware network-traffic pcap threat-intelligence malware-analysis infosec dfir

pwnagotchi - (⌐■_■) - Deep Reinforcement Learning instrumenting bettercap for WiFi pwning.

•    Javascript

---

Pwnagotchi is an A2C-based "AI" leveraging bettercap that learns from its surrounding WiFi environment to maximize the crackable WPA key material it captures (either passively, or by performing authentication and association attacks). This material is collected as PCAP files containing any form of handshake supported by hashcat, including PMKIDs, full and half WPA handshakes. Instead of merely playing Super Mario or Atari games like most reinforcement learning-based "AI" (yawn), Pwnagotchi tunes its parameters over time to get better at pwning WiFi things to in the environments you expose it to.

ai deep-learning deep-reinforcement-learning wpa-psk bettercap deep-neural-network handshakes

NetDash

•    PHP

---

Network Intrusion Detection and Full Packet Capture System

PCAPMerger / PmLib

•    

---

PCAPMerger is console application written in C# to merge mutliple PCAP files into the one file sorted according to timestamp, it benefits separate PmLib library

libpcap merging netfox netmon pcap pcapmerger pcapng