PCAPTools
118 items from caesar0301/awesome-pcaptools ★3,431
-
softflowd github.com
is a flow-based network monitor, that listens promiscously to a network interface using libpcap and exports NetFlow data.
-
HttpSniffer github.com
A multi-threading tool to sniff TCP flow statistics and embedded HTTP headers from PCAP file. Each TCP flow carrying HTTP is exported to text file in JSON format.
-
pkt2flow github.com
A simple utility to classify packets into flows. It's so simple that only one task is aimed to finish. For Deep Packet Inspection or flow classification, it's so common to analyze the feature of one specific flow. I have make the attempt to use made-ready tools like tcpflows…
-
-
yaraprocessor github.com
With yaraprocessor YARA can be run against individual packet payloads as well as a concatenation of some or all of the payloads. It was originally written for use in Chopshop, but can also be used without it.
-
-
Tcptrace github.com
A tool written by Shawn Ostermann at Ohio University, for analysis of TCP dump files. It can take as input the files produced by several popular packet- capture programs, including tcpdump, snoop, etherpeek, HP Net Metrix, and WinDump. tcptrace can produce several different…
-
OpenFPC github.com
OpenFPC is a set of scripts that combine to provide a lightweight full-packet network traffic recorder & buffering tool. Its design goal is to allow non-expert users to deploy a distributed network traffic recorder on COTS hardware while integrating into existing alert and log…
-
clj-net-pcap github.com
clj-net-pcap is a packet capturing library for Clojure. clj-net-pcap uses jNetPcap and adds convenience functionality around jNetPcap for easing the usability. A paper on clj-net-pcap was published in scope of COMPSACW 2014.
-
Foremost github.com
is a console program to recover files based on their headers, footers, and internal data structures. This process is commonly referred to as data carving. Foremost can work on image files, such as those generated by dd, Safeback, Encase, etc, or directly on a drive. The headers…
-
Suricata suricata-ids.org
Suricata is a high performance Network IDS, IPS and Network Security Monitoring engine. Open Source and owned by a community run non-profit foundation, the Open Information Security Foundation (OISF). Suricata is developed by the OISF and its supporting vendors.
-
Snort snort.org
Snort is a free and open source network intrusion prevention system (NIPS) and network intrusion detection system (NIDS)created by Martin Roesch in 1998. Snort is now developed by Sourcefire, of which Roesch is the founder and CTO. In 2009, Snort entered InfoWorld's Open Source…
-
Ipsumdump github.com
summarizes TCP/IP dump files into a self-describing ASCII format easily readable by humans and programs. Ipsumdump can read packets from network interfaces, from tcpdump files, and from existing ipsumdump files. It will transparently uncompress tcpdump or ipsumdump files when…
-
USBPcapOdinDumper github.com
transforms .pcap files with usbmon and USBPcap frames format of captures from flashing an Android phone with Odin or Heimdall into a set of files with frames payload. Useful for reverse-engineering. Has a modular architecture easily transformable for other applications formats.
-
Tcpslice github.com
Tcpslice is a tool for extracting portions of packet trace files generated using tcpdump's -w flag. It can combine multiple trace files, and/or extract portions of one or more traces based on time.
-
Squey squey.org
Interactive visualization software designed to explore large PCAPs to detect anomalies / weak signals.
-
tcpxtract tcpxtract.sourceforge.net
is a tool for extracting files from network traffic based on file signatures. Extracting files based on file type headers and footers (sometimes called "carving") is an age old data recovery technique.
-
tcpick tcpick.sourceforge.net
is a textmode sniffer libpcap-based that can track, reassemble and reorder tcp streams. Tcpick is able to save the captured flows in different files or displays them in the terminal, and so it is useful to sniff files that are transmitted via ftp or http. It can display all the…
-
-
ntopng ntop.org
Ntopng is a network traffic probe that shows the network usage, similar to what the popular top Unix command does.
-
PF_RING ntop.org
PF_RING is a new type of network socket that dramatically improves the packet capture speed.
-
-
AIEngine bitbucket.org
AIEngine is a next generation interactive/programmable Python/Ruby/Java/Lua packet inspection engine with capabilities of learning without any human intervention, NIDS(Network Intrusion Detection System) functionality, DNS domain classification, network collector, network…
-
Tcpsplit github.com
A tool to break a single libpcap packet trace into some number of sub- traces, breaking the trace along TCP connection boundaries so that a TCP connection doesn't end up split across two sub-traces. This is useful for making large trace files tractable for in- depth analysis…
-
pcaptoparquet github.com
pcaptoparquet is a Python package designed for converting PCAP or PCAPNG files to structured data formats, primarily Apache Parquet. The tool focuses on network traffic analysis by extracting, decoding, and transforming packet data into queryable datasets suitable for analysis…
-
Socket Sentry github.com
Socket Sentry is a real-time network traffic monitor for KDE Plasma in the same spirit as tools like iftop and netstat.
-
Xplot xplot.org
The program xplot was written in the late 1980s to support the analysis of TCP packet traces.
-
Xplico xplico.org
The goal of Xplico is extract from an internet traffic capture the applications data contained. For example, from a pcap file Xplico extracts each email (POP, IMAP, and SMTP protocols), all HTTP contents, each VoIP call (SIP), FTP, TFTP, and so on. Xplico isn't a network…
-
TTT www2.sonycsl.co.jp
(Tele Traffic Tapper) is yet another descendant of tcpdump but it is capable of real-time, graphical, and remote traffic-monitoring. ttt won't replace tcpdump, rather, it helps you find out what to look into with tcpdump. ttt monitors the network and automatically picks up the…
-
WireEdit wireedit.com
WireEdit is a free desktop WYSIWYG editor for network packets. It allows editing any stack layer as "rich text" without having any knowledge of packets syntax and encoding rules. The input and output file format is Pcap.
-
-
-
Wireshark suit wiki.wireshark.org
The well-known tool suit to support packet analyzer and protocol decoder. It also includes a few practical tools and scripts to support most of the common usage.
-
Screenshot wiki.ipfire.org
-
Sanitize web.archive.org
Sanitize is a collection of five Bourne shell scripts for reducing tcpdump traces in order to address security and privacy concerns, by renumbering hosts and stripping out packet contents. Each script takes as input a tcpdump trace file and generates to stdout a reduced, ASCII…
-
ITA web.archive.org
The Internet Traffic Archive is a moderated repository to support widespread access to traces of Internet network traffic, sponsored by ACM SIGCOMM. The traces can be used to study network dynamics, usage characteristics, and growth patterns, as well as providing the grist for…
-
ECap web.archive.org
(External Capture) is a distributed network sniffer with a web front- end. Ecap was written many years ago in 2005, but a post on the tcpdump-workers mailing list requested a similar application... so here it is. It would be fun to update it and work on it again if there's any…
-
Multitail vanheusden.com
now has a colorscheme included for monitoring the tcpdump output. It can also filter, convert timestamps to timestrings and much more.
-
Tstat tstat.tlc.polito.it
A passive sniffer able to provide several insight on the traffic patterns at both the network and transport levels with a tremendous set of flow features.
-
TraceWrangler tracewrangler.com
TraceWrangler is a network capture file toolkit running on Windows (or on Linux, using WINE) that supports PCAP as well as the new PCAPng file format, which is now the standard file format used by Wireshark. The most prominent use case for TraceWrangler is the easy sanitization…
-
Yaf tools.netsa.cert.org
It's a reliable piece of software, quite solid and able to generate flow records from pcap. This is very nice for indexing huge pcap or even doing packet capture. The recent version can even extract payloads and put in the flow records.
-
SiLK tools.netsa.cert.org
SiLK (the System for Internet-Level Knowledge), is a collection of traffic analysis tools developed to facilitate security analysis of large networks. The SiLK tool suite supports the efficient collection, storage, and analysis of network flow data.
-
-
Screenshot tecmint.com
-
Jnettop sourceforge.net
is a traffic visualiser, which captures traffic going through the host it is running from and displays streams sorted by bandwidth they use. Screenshot
-
jNetPcap sourceforge.net
jNetPcap is a packet capturing library for Java that is available for Linux and Windows. jNetPcap leverages libpcap respectively WinPcap and employs the Java Native Interface (JNI) for using the functionality provided by libpcap/WinPcap.
-
Scapy secdev.org
Scapy is a powerful interactive packet manipulation program. It is able to forge or decode packets of a wide number of protocols, send them on the wire, capture them, match requests and replies, and much more. It can easily handle most classical tasks like scanning…
-
WAND research.wand.net.nz
A wonderful collection of tools built on libtrace to process network traffic, which is from The University of Waikato. I love this project!
-
Ostinato ostinato.org
Ostinato is a versatile packet crafter, pcap editor/player and traffic generator with an intuitive GUI. Add-ons include high-speed 10/25/40G traffic generation and scripting/ automation Python APIs. Works on all platforms - Windows, MacOS, Linux and the labbing platforms - CML…
-
Justniffer onotelli.github.io
Justniffer is a network protocol analyzer that captures network traffic and produces logs in a customized way, can emulate Apache web server log files, track response times and extract all "intercepted" files from the HTTP traffic.
- next page of items loading…
