35 best open source packet capture projects.

We have collection of more than 1 Million open source products ranging from Enterprise product to small libraries in all platforms. We aggregate information from all open source repositories. Search and find the best for your needs. Check out projects section.

Displaying 1 to 20 from 35 results

Moloch - Large scale, full packet capturing, indexing, and database system

Javascript

Moloch is an open source, large scale, full packet capturing, indexing, and database system. Moloch augments your current security infrastructure to store and index network traffic in standard PCAP format, providing fast, indexed access. An intuitive and simple web interface is provided for PCAP browsing, searching, and exporting.

network-monitoring pcap packet-capture nsm

npcap - Nmap Project's packet sniffing library for Windows, based on WinPcap/Libpcap improved with NDIS 6 and LWF

Npcap is an update of WinPcap to NDIS 6 Light-Weight Filter (LWF) technique. It supports Windows Vista, 7, 8 and 10. It is sponsored by the Nmap Project and developed by Yang Luo under Google Summer of Code 2013 and 2015. It also received many helpful tests from Wireshark, libpcap and NetScanTools.Run git clone https://github.com/nmap/npcap: pull this repo. This repo contains libpcap as a submodule, so make sure that you have also pulled all the submodules.

packet-capture libpcap pcap

TCPDump - Network Packet Analyzer

TCPDump, a powerful command-line packet analyzer; and libpcap, a portable C/C++ library for network traffic capture. It prints out a description of the contents of packets on a network interface that match the boolean expression. The Packet Capture library provides a high level interface to packet capture systems. All packets on the network, even those destined for other hosts, are accessible through this mechanism.

packet-capture network packet capture sniffer

Snort - Network Intrusion Prevention and Detection System

Snort is an open source network intrusion prevention and detection system (IDS/IPS) developed by Sourcefire. Snort can perform protocol analysis and content searching/matching. It can be used to detect a variety of attacks and probes, such as buffer overflows, stealth port scans, CGI attacks, SMB probes, OS fingerprinting attempts, and much more.

intrusion-detection intrusion-prevention network attack port-scanner packet-capture

Wireshark - Network Traffic Analyzer

Wireshark is a network traffic analyzer, or "sniffer", for Linux, macOS, *BSD and other Unix and Unix-like operating systems and for Windows. It uses Qt, a graphical user interface library, and libpcap and npcap as packet capture and filtering libraries.

packet-capture tshark pcap libpcap sniffer traffic-analyzer

libpcap - the LIBpcap interface to various kernel packet capture mechanism

To report a security issue please send an e-mail to security@tcpdump.org. To report bugs and other problems, contribute patches, request a feature, provide generic feedback etc please see the file CONTRIBUTING in the libpcap source tree root.

pcap pcapng packet-capture sniffer libpcap bpf berkeley-packet-filter

tcpdump - the TCPdump network dissector

pcap pcapng packet-capture sniffer tcpdump libpcap bpf berkeley-packet-filter

scapy - Scapy: the Python-based interactive packet manipulation program & library

Python

Scapy is a powerful Python-based interactive packet manipulation program and library. It is able to forge or decode packets of a wide number of protocols, send them on the wire, capture them, store or read them using pcap files, match requests and replies, and much more. It is designed to allow fast packet prototyping by using default values that work.

scapy python-modules network network-analysis network-visualization network-discovery python2 python3 python-2 python-3 pcap packet-capture packet-sniffer packet-analyser packet-analyzer packet-crafting security security-tools network-security

pyshark - Python wrapper for tshark, allowing python packet parsing using wireshark dissectors

Python

Python wrapper for tshark, allowing python packet parsing using wireshark dissectors. Looking for contributors - for various reasons I have a hard time finding time to maintain and enhance the package at the moment. Any pull-requests will be reviewed and if any one is interested and is suitable, I will be happy to include them in the project. Feel free to mail me at dorgreen1 at gmail.

wireshark capture-packets tshark packet-capture

DPDK - Data Plan Development Kit

DPDK is a set of libraries and drivers for fast packet processing. It was designed to run on any processors. The first supported CPU was Intel x86 and it is now extended to IBM Power 8, EZchip TILE-Gx and ARM. These libraries can be used to receive and send packets within the minimum number of CPU cycles (usually less than 80 cycles), develop fast packet capture algorithms (tcpdump-like) and run third-party fast path stacks.

packet-processing packet-capture networking-library tcp-dump

ngrok - Introspected tunnels to localhost

ngrok is a reverse proxy that creates a secure tunnel between from a public endpoint to a locally running web service. ngrok captures and analyzes all traffic over the tunnel for later inspection and replay. You can give this URL to anyone to allow them to try out a web site you're developing without doing any deployment.

reverse-proxy tunnel proxy packet-capture

Bro - Network Security Monitor

Bro is a powerful network analysis framework that is much different from the typical intrusion detection system you may know. Bro provides a comprehensive platform for more general network traffic analysis as well.

intrusion-detection intrusion-prevention ids network-analyzer monitoring packet-capture

nfstream - NFStream: a Flexible Network Data Analysis Framework.

Python

NFStream is a Python framework providing fast, flexible, and expressive data structures designed to make working with online or offline network data both easy and intuitive. It aims to be the fundamental high-level building block for doing practical, real world network data analysis in Python. Additionally, it has the broader goal of becoming a common network data analytics framework for researchers providing data reproducibility across experiments. Binary installers for the latest released version are available on Pypi.

data-science machine-learning data-mining netflow pcap packet-analyser traffic-analysis artificial-intelligence cybersecurity network-monitoring data-analysis dataset-generation network-analysis packet-capture ndpi network-security deep-packet-inspection traffic-classification

netsniff-ng - The packet sniffing beast

netsniff-ng is a free Linux networking toolkit, a Swiss army knife for your daily Linux network plumbing if you will. Its gain of performance is reached by zero-copy mechanisms, so that on packet reception and transmission the kernel does not need to copy packets from kernel space to user space and vice versa.

networking linux packet-sniffer packet-generator packet-capture sniffer

gsnova - Private proxy solution & network troubleshooting tool.

GSnova: Private Proxy Solution. go1.9 is requied.

tcp quic kcp tls http2 http websocket ssh proxy transparent-proxy mitmproxy packet-capture

Divert - Windows Packet Divert

Windows Packet Divert (WinDivert) is a user-mode packet interception library for Windows 7, Windows 8 and Windows 10. WinDivert enables user-mode capturing/modifying/dropping of network packets sent to/from the Windows network stack. In summary, WinDivert can Capture network packets, Filter/drop network packets, Sniff network packets, (re)inject network packets, modify network packets. It can be used to implement user-mode packet filters, sniffers, firewalls, NATs, VPNs, IDSs, tunneling applications, etc.

packet-capture packet-sniffer firewall divert-sockets packet-interception sniffing

Zmap - The Internet Scanner

ZMap is an open-source network scanner that enables researchers to easily perform Internet-wide network studies. With a single machine and a well provisioned network uplink, ZMap is capable of performing a complete scan of the IPv4 address space in under 45 minutes, approaching the theoretical limit of gigabit Ethernet. ZMap can be used to study protocol adoption over time, monitor service availability, and help us better understand large systems distributed across the Internet.

network monitoring scanner packet-capture ip-scanner

homer - HOMER - 100% Open-Source SIP / VoIP Packet Capture & Monitoring

Shell

HOMER is a robust, carrier-grade, scalable SIP Capture system and VoiP Monitoring Application offering HEP/EEP, IP Proto4 (IPIP) encapsulation & port mirroring/monitoring support right out of the box, ready to process & store insane amounts of signaling, logs and statistics with instant search, end-to-end analysis and drill-down capabilities for ITSPs, VoIP Providers and Trunk Suppliers using SIP signaling protocol. Powered at the core by SIPCAPTURE Module for industry-standard Kamailio or OpenSIPS, HOMER provides virtually unlimited scope for granular capture configuration either stand-alone or using our companion Capture Agent Project.

monitoring troubleshooting voip rtc pcap flow callflow cdr correlation capture-agent packet-capture packet-sniffer analytics webrtc encapsulation sip statistics opensips kamailio hep

NFStream - A Flexible Network Data Analysis Framework

Python

NFStream is a Python package providing fast, flexible, and expressive data structures designed to make working with online or offline network data both easy and intuitive. It aims to be the fundamental high-level building block for doing practical, real world network data analysis in Python. Additionally, it has the broader goal of becoming a common network data processing framework for researchers providing data reproducibility across experiments. NFStream extracts +90 flow features and can convert it directly to a pandas Dataframe or a CSV file.