Search Results for "pcap"
Sort By:
Showing 57 open source projects for "pcap"
View related business solutions-
$300 Free Credits to Build on Google CloudPut your $300 in credit toward real workloads, then keep building with free monthly usage for 20+ products. No commitment and no charge until you upgrade.
-
Train ML Models With SQL You Already KnowBuild and deploy ML models using familiar SQL. Automate data prep with built-in Gemini. Query 1 TB and store 10 GB free monthly.
-
1
Kubeshark
The API traffic viewer for Kubernetes providing deep visibility
...Monitors all API traffic and payloads to find API drift and API anomalies and trace them down to source. Instant service dependency mapping through real-time API traffic analysis. Store all or a subset of traffic in PCAP files. View TCP stream request-response pairs and replay requests' payloads to a destination service. -
2
Arkime
A full packet capturing, indexing, and database system
Arkime is an open source, large-scale, full packet capturing, indexing, and database system designed to augment existing security infrastructure by storing and indexing network traffic in standard PCAP format. It offers full network visibility, facilitating the swift identification and resolution of security and network issues. Security teams gain access to the necessary network visibility data essential for responding to and investigating incidents to expose the full attack scope. Designed to be deployed across multiple clustered systems, Arkime provides the ability to scale to hundreds of gigabits per second. ... -
3
netsniff-ng
A Swiss army knife for your daily Linux network plumbing
netsniff-ng is a free Linux networking toolkit, a Swiss army knife for your daily Linux network plumbing if you will. Its gain of performance is reached by zero-copy mechanisms, so that on packet reception and transmission the kernel does not need to copy packets from kernel space to user space and vice versa. Our toolkit can be used for network development and analysis, debugging, auditing, or network reconnaissance. -
4
InterceptSuite
A TLS MITM proxy for Non-HTTP traffic, with support for TLS upgrades
InterceptSuite is a cross‑platform, SOCKS5‑based MITM proxy specially designed to intercept, inspect, analyze, and manipulate encrypted network traffic at the TCP/TLS layer. It goes beyond HTTP‑focused tools like Burp Suite and ZAP by providing universal TLS interception—including STARTTLS and non‑HTTP protocols—offering deep visibility and control for security testing and debugging. InterceptSuite bridges this gap by providing a universal TLS interception engine that works with any... -
Veeam Data Platform v13.1 - Get Your Free TrialTry Veeam Data Platform today. Experience the unified platform that's secure by design, portable by default, and proven to recover clean, fast, and anywhere.
-
5
Scapy
Scapy is a Python-based interactive packet manipulation program
Scapy is a powerful Python-based interactive packet manipulation program and library. It is able to forge or decode packets of a wide number of protocols, send them on the wire, capture them, store or read them using pcap files, match requests and replies, and much more. It is designed to allow fast packet prototyping by using default values that work. It can easily handle most classical tasks like scanning, tracerouting, probing, unit tests, attacks or network discovery (it can replace hping, 85% of nmap, arpspoof, arp-sk, arping, tcpdump, wireshark, p0f, etc.). ... -
6
PcapPlusPlus
Multiplatform C++ library for parsing and crafting of network packets
...PcapPlusPlus is available in popular package managers such as Homebrew and Conan. PcapPlusPlus provides an easy-to-use interface for reading and writing network packets into files.It supports the most popular file formats which are PCAP and PCAPNG. -
7
tcpreplay
edit and replay captured network traffic
tcpreplay is a suite of tools to edit and replay captured network traffic. -
8
Shadow Network Fingerprinting Engine
SNF is a 100% offline, air-gap passive network intelligence engine
...It detects C2 beacons, DGA domains, DNS tunnels, lateral movement, data exfiltration, and full ICS/SCADA protocol abuse across Modbus, S7comm, EtherNet/IP, PROFINET, and DNP3. Every run produces structured NDJSON with a determinism guarantee — same PCAP, same config, same version, SHA-256 identical output every time. Court-admissible evidence bundles built in. **Zero network calls. Ever. Not a setting. Architecture.** ## Validated Results - Emotet epoch 3 PCAP — 23 IOC hits, 52 threat matches - MAWI backbone — 14.9M packets, zero crashes, 332K graph nodes - nmap standard scan — 1,971 scan events detected ## Links - Website: https://shadownf.com - GitHub (open core): https://github.com/padigeltejas/snf-core -
9
IOT network monitor
raspberry pi4 image using wifi in APN mode for IOT network monitoring
A Raspberry pi4 is used to run wifi in APN mode, and IOT devices are subbed to this SSID, and packet capture and interrogation are performed on the IOT traffic. Many statistics and plots are derived from the IOT traffic. This "iotsnoop" project also contains the previous project "imonitorg" which is a full, long term monitoring of a user's Internet connection with stats and plots. All stats and plots are available via webpage served by pi4. 802.11g to max range, minimize IOT traffic. ... -
Custom VMs From 1 to 96 vCPUs With 99.95% UptimeLive migration and automatic failover keep workloads online through maintenance. One free e2-micro VM every month.
-
10
Bit-Twist (Packet generator/editor)
Packet generator and packet editor for Windows, Linux, BSD, and macOS
...It is designed to complement tcpdump, which by itself has done a great job at capturing network traffic. With Bit-Twist, you can now regenerate your captured traffic onto a live network! Packets are generated from tcpdump trace file (.pcap file). Bit-Twist comes with a comprehensive trace file editor to allow you to change the contents of a trace file. Bit-Twist is designed for exceptional speed, allowing you to edit 10 million packets in under 3 seconds and send them over a live network at throughput levels that match your NIC's maximum line rate, up to 10 Gbps. ... -
11
Cockatrice III
A Macintosh m68k emulator
I'm taking an ancient version of BasiliskII and adding features that interest me, starting with SDL support, OS X, Linux and Windows, support for SLiRP and PCAP for native networking. -
12
fwknop
Single Packet Authorization, Port Knocking
fwknop stands for the "FireWall KNock OPerator", and implements an authorization scheme called Single Packet Authorization (SPA). This method of authorization is based around a default-drop packet filter (fwknop supports iptables and firewalld on Linux, ipfw on FreeBSD and Mac OS X, and PF on OpenBSD) and libpcap. SPA is essentially next-generation port knocking (more on this below). The design decisions that guide the development of fwknop can be found in the blog post "Single Packet... -
13
alp
Access Log Profiler
alp is Access Log Profiler. -
14
Termshark
A terminal UI for tshark, inspired by Wireshark
A terminal user-interface for tshark, inspired by Wireshark. If you're debugging on a remote machine with a large pcap and no desire to scp it back to your desktop, termshark can help! Read pcap files or sniff live interfaces (where tshark is permitted). Filter pcaps or live captures using Wireshark's display filters. Reassemble and inspect TCP and UDP flows. View network conversations by protocol. Copy ranges of packets to the clipboard from the terminal. -
15
PacketStreamer
Distributed tcpdump for cloud native environments
...Traffic streams may be compressed and/or encrypted using TLS. The PacketStreamer receiver accepts PacketStreamer streams from multiple remote sensors and writes the packets to a local pcap capture file. PacketStreamer sensors collect raw network packets on remote hosts. It selects packets to capture using a BPF filter, and forwards them to a central receiver process where they are written in pcap format. Sensors are very lightweight and impose little performance impact on the remote hosts. PacketStreamer sensors can be run on bare-metal servers, on Docker hosts, and on Kubernetes nodes. -
16
pyWhat
Identify emails, IP addresses, and more
pyWhat is a Python-based identification tool designed to figure out “what” a piece of text or file content represents, especially in security and OSINT workflows. Given inputs such as hex strings, URLs, email addresses, IP addresses, credit card numbers, cryptocurrency wallets, or entire .pcap capture files, it scans for structured patterns and tells you what it finds. The tool is recursive: it can traverse files and directories to extract meaningful entities, which is useful when analyzing malware samples, network captures, or code repositories at scale. It offers powerful filters called “tags” and distributions that let you narrow results to specific categories like bug bounties, cryptocurrencies, or AWS-related artifacts. ... -
17
pcapfix
repair corrupted pcap and pcapng files
this tool tries to repair your broken pcap and pcapng files by fixing the global header respectively packet blocks and recovering the packets by searching und guessing the packet headers or blocks -
18
Pwnagotchi
Deep Reinforcement learning instrumenting bettercap for WiFi pwning
Pwnagotchi is an A2C-based “AI” powered by bettercap and running on a Raspberry Pi Zero W that learns from its surrounding WiFi environment in order to maximize the crackable WPA key material it captures (either through passive sniffing or by performing deauthentication and association attacks). This material is collected on disk as PCAP files containing any form of handshake supported by hashcat, including full and half WPA handshakes as well as PMKIDs. Instead of merely playing Super Mario or Atari games like most reinforcement learning based “AI” (yawn), Pwnagotchi tunes its own parameters over time to get better at pwning WiFi things in the real world environments you expose it to. ... -
19
jNetPcap - A Libpcap Java Binding
A java PCAP and DPI library
A java wrapper for popular "libpcap" and "WinPcap" libraries. Accurate full API translation. Packet buffers delivered with no copies. Send custom packets, gather statistics. Comprehensive and easily extensible DPI engine. -
20
sharppcap
ully managed, cross platform
Fully managed, cross-platform (Windows, Mac, Linux) .NET library for capturing packets from live and file-based devices -
21
Security Datasets
Re-play Security Events
Security‑Datasets is a community-driven repository maintained by the Open Threat Research Forge (OTRF) that curates publicly available malicious and benign datasets for threat-hunting, machine learning, event analysis, and cybersecurity research. Datasets include Windows events, logs, alerts, and simulated attack data to support detection engineering and academic research. -
22
Sometimes in the process of debugging SIP UAs you are trying to simulate a scenario for which all you have is a packet trace from the user. You can use this program to convert the SIP packets from the pcap trace to sipp xml files, and then use sipp with the resulted scenario to simulate the test case. Note: only supports traces with SIP over UDP See "pcap2sipp doc" for more information
-
23
PCAPAnalyzer
Network traffic analysis from PCAP format
PCAP Analyzer is a tool that helps analyzing network traffic captured in a PCAP format (standard of tcpdump). It has extensible Filters in charge of dissecting packets and printing information like throughput or anything that can be analyzed by Filters (e.g. packet loss, reordering, ...). It comes with several built-in Filters but can be expanded by adding custom-made Filters to the classpath. -
24
SSL Logger
Decrypts and logs a process's SSL traffic
...It attaches to a running process by name or PID and hooks SSL_read and SSL_write calls to capture plaintext data flowing through encrypted connections. Output can be streamed to the console with verbose metadata or written to a PCAP file for later analysis in standard tooling. The utility is powered by dynamic instrumentation using the Frida framework, allowing it to intercept function calls without recompiling or modifying the target binary. Typical workflows include debugging custom clients, validating protocol implementations, or inspecting troubleshooting traces when only an encrypted channel is available. ... -
25
VoIP Honey project provides a set of tools for building an entire honeynet, thus includes honeywall and honeypot emulating VoIP environments such as Asterisk PBX or OpenSer with fully configurable connections. Voip Honey runs on GNU/Linux and Windows Systems. It can be compiled for Mac OSX as well.