tcpdump - the TCPdump network dissector

•    C

---

To report a security issue please send an e-mail to security@tcpdump.org. To report bugs and other problems, contribute patches, request a feature, provide generic feedback etc please see the file CONTRIBUTING in the tcpdump source tree root.

pcap pcapng packet-capture sniffer tcpdump libpcap bpf berkeley-packet-filter

Wireshark - Network Traffic Analyzer

•    C

---

Wireshark is a network traffic analyzer, or "sniffer", for Linux, macOS, *BSD and other Unix and Unix-like operating systems and for Windows. It uses Qt, a graphical user interface library, and libpcap and npcap as packet capture and filtering libraries.

packet-capture tshark pcap libpcap sniffer traffic-analyzer

TCPDump - Network Packet Analyzer

•    C

---

TCPDump, a powerful command-line packet analyzer; and libpcap, a portable C/C++ library for network traffic capture. It prints out a description of the contents of packets on a network interface that match the boolean expression. The Packet Capture library provides a high level interface to packet capture systems. All packets on the network, even those destined for other hosts, are accessible through this mechanism.

packet-capture network packet capture sniffer

npcap - Nmap Project's packet sniffing library for Windows, based on WinPcap/Libpcap improved with NDIS 6 and LWF

•    C

---

Npcap is an update of WinPcap to NDIS 6 Light-Weight Filter (LWF) technique. It supports Windows Vista, 7, 8 and 10. It is sponsored by the Nmap Project and developed by Yang Luo under Google Summer of Code 2013 and 2015. It also received many helpful tests from Wireshark, libpcap and NetScanTools.Run git clone https://github.com/nmap/npcap: pull this repo. This repo contains libpcap as a submodule, so make sure that you have also pulled all the submodules.

packet-capture libpcap pcap

netsniff-ng - The packet sniffing beast

•    C

---

netsniff-ng is a free Linux networking toolkit, a Swiss army knife for your daily Linux network plumbing if you will. Its gain of performance is reached by zero-copy mechanisms, so that on packet reception and transmission the kernel does not need to copy packets from kernel space to user space and vice versa.

networking linux packet-sniffer packet-generator packet-capture sniffer

scrub-tcpdump: an anonymizer for libpcap

•    C

---

The first stage of development is do write a tool to anonymize packet capture files captured with libpcap. After that we will be integrating this with tcpdump to anonymize in real-time and analyze and look for its effect on different IDS's.

scapy - Scapy: the Python-based interactive packet manipulation program & library

•    Python

---

Scapy is a powerful Python-based interactive packet manipulation program and library. It is able to forge or decode packets of a wide number of protocols, send them on the wire, capture them, store or read them using pcap files, match requests and replies, and much more. It is designed to allow fast packet prototyping by using default values that work.

scapy python-modules network network-analysis network-visualization network-discovery python2 python3 python-2 python-3 pcap packet-capture packet-sniffer packet-analyser packet-analyzer packet-crafting security security-tools network-security

The RPCAP Remote Packet Capture System

•    C

---

RPCAP is a Remote Packet Capture system. It provides a libpcap-compatible client library which when linked with a user program running on a client system, initiates and controls a network sniffer RPC service running on a remote host.

PcapPlusPlus - PcapPlusPlus is a multiplatform C++ network sniffing and packet parsing and crafting framework

•    C++

---

PcapPlusPlus is a multiplatform C++ network sniffing and packet parsing and crafting framework. PcapPlusPlus is meant to be lightweight, efficient and easy to use.

c-plus-plus pf-ring dpdk packet-parsing winpcap pcap-files pcap packet-processing cpp libpcap multiplatform mac-osx packet-analyser networking network-forensics network-tools tcp-reassembly packet-crafting

bpftrace - high-level tracing language for Linux enhanced Berkeley Packet Filter (eBPF)

•    C++

---

bpftrace is a high-level tracing language for Linux enhanced Berkeley Packet Filter (eBPF) available in recent Linux kernels (4.x). bpftrace uses LLVM as a backend to compile scripts to BPF-bytecode and makes use of BCC for interacting with the Linux BPF system, as well as existing Linux tracing capabilities: kernel dynamic tracing (kprobes), user-level dynamic tracing (uprobes), and tracepoints.

bpf ebpf tracing kprobes uprobes tracepoints usdt bcc

Bit-Twist (Packet Generator)

•    C

---

Bit-Twist is a simple yet powerful libpcap-based Ethernet II (IEEE 802.3) packet generator that comes complete with a comprehensive pcap capture file editor. Bit-Twist runs on Mac OS X (and *BSD), Linux, and Windows.

homer - HOMER - 100% Open-Source SIP / VoIP Packet Capture & Monitoring

•    Shell

---

HOMER is a robust, carrier-grade, scalable SIP Capture system and VoiP Monitoring Application offering HEP/EEP, IP Proto4 (IPIP) encapsulation & port mirroring/monitoring support right out of the box, ready to process & store insane amounts of signaling, logs and statistics with instant search, end-to-end analysis and drill-down capabilities for ITSPs, VoIP Providers and Trunk Suppliers using SIP signaling protocol. Powered at the core by SIPCAPTURE Module for industry-standard Kamailio or OpenSIPS, HOMER provides virtually unlimited scope for granular capture configuration either stand-alone or using our companion Capture Agent Project.

monitoring troubleshooting voip rtc pcap flow callflow cdr correlation capture-agent packet-capture packet-sniffer analytics webrtc encapsulation sip statistics opensips kamailio hep

libtins - High-level, multiplatform C++ network packet sniffing and crafting library.

•    C++

---

libtins is a high-level, multiplatform C++ network packet sniffing and crafting library. Its main purpose is to provide the C++ developer an easy, efficient, platform and endianess-independent way to create tools which need to send, receive and manipulate specially crafted packets.

network packet-parsing packet-analyser packets sniffing pcap libpcap

python-libpcap

•    C

---

Python module for the libpcap packet capture library, based on the original python libpcap module by Aaron Rhodes.

Divert - Windows Packet Divert

•    C

---

Windows Packet Divert (WinDivert) is a user-mode packet interception library for Windows 7, Windows 8 and Windows 10. WinDivert enables user-mode capturing/modifying/dropping of network packets sent to/from the Windows network stack. In summary, WinDivert can Capture network packets, Filter/drop network packets, Sniff network packets, (re)inject network packets, modify network packets. It can be used to implement user-mode packet filters, sniffers, firewalls, NATs, VPNs, IDSs, tunneling applications, etc.

packet-capture packet-sniffer firewall divert-sockets packet-interception sniffing

Network Packet Capture Facility for Java

•    Java

---

jpcap is a set of Java classes which provide an interface and system for network packet capture. A protocol library and tool for visualizing network traffic is included. jpcap utilizes libpcap, a widely deployed system library for packet capture.

The libpcap project

•    C

---

libpcap is a system-independent interface for user-level packet capture. libpcap provides a portable framework for low-level network monitoring. Applications include network statistics collection, security monitoring, network debugging, etc.

joy - A package for capturing and analyzing network flow data and intraflow data, for network research, forensics, and security monitoring

•    C

---

Joy is a BSD-licensed libpcap-based software package for extracting data features from live network traffic or packet capture (pcap) files, using a flow-oriented model similar to that of IPFIX or Netflow, and then representing these data features in JSON. It also contains analysis tools that can be applied to these data files. Joy can be used to explore data at scale, especially security and threat-relevant data. JSON is used in order to make the output easily consumable by data analysis tools. While the JSON output files are somewhat verbose, they are reasonably small, and they respond well to compression.

Packet Peeper

•    Objective-C

---

Packet Peeper is a network protocol analyzer (or 'packet sniffer') for Mac OS X. Its features include TCP stream reassembly, privilege separation, simultaneous capture sessions, filters, Python plugins and support for pcap capture files.

IPdump

•    C

---

IPdump is a tool to generate detailed packet header dumps from packet traces in LBNL's libpcap format (such as generated by tcpdump).