Dshell

An extensible network forensic analysis framework. Enables rapid development of plugins to support the dissection of network packet captures. This is a major framework update to Dshell. Plugins written for the previous version are not compatible with this version, and vice versa. By extension, dpkt and pypcap have been replaced with Python3-friendly pypacker and pcapy (respectively). Enables development of external plugin packs, allowing the sharing and installation of new, externally-developed plugins without overlapping the core Dshell libraries. Plugins can now use all output modules, available to the command line switch, -O. That does not mean every output module will be useful to every plugin (e.g. using netflow output for a plugin that looks at individual packets), but they are available.