Search Results for "pcap analysis"

Xplico is a Network Forensic Analysis Tool (NFAT). The goal of Xplico is extract from an internet traffic capture the applications data contained. For example, from a pcap file Xplico extracts each email (POP, IMAP, and SMTP protocols), all HTTP contents, each VoIP call (SIP, MGCP, MEGACO, RTP), IRC, WhatsApp... Xplico is able to classify more than 140 (application) protocols.

...It attaches to a running process by name or PID and hooks SSL_read and SSL_write calls to capture plaintext data flowing through encrypted connections. Output can be streamed to the console with verbose metadata or written to a PCAP file for later analysis in standard tooling. The utility is powered by dynamic instrumentation using the Frida framework, allowing it to intercept function calls without recompiling or modifying the target binary. Typical workflows include debugging custom clients, validating protocol implementations, or inspecting troubleshooting traces when only an encrypted channel is available. ...