Shadow Network Fingerprinting Engine download

# SNF — Shadow Network Fingerprinting Engine

100% offline. Air-gap-native. Written entirely in Rust.

SNF captures raw packets, reconstructs TCP/UDP flows, and runs them through
14 deterministic protocol analyzers. It detects C2 beacons, DGA domains, DNS
tunnels, lateral movement, data exfiltration, and full ICS/SCADA protocol abuse
across Modbus, S7comm, EtherNet/IP, PROFINET, and DNP3.

Every run produces structured NDJSON with a determinism guarantee — same PCAP,
same config, same version, SHA-256 identical output every time. Court-admissible
evidence bundles built in.

**Zero network calls. Ever. Not a setting. Architecture.**

## Validated Results
- Emotet epoch 3 PCAP — 23 IOC hits, 52 threat matches
- MAWI backbone — 14.9M packets, zero crashes, 332K graph nodes
- nmap standard scan — 1,971 scan events detected

## Links
- Website: https://shadownf.com
- GitHub (open core): https://github.com/padigeltejas/snf-core

Project Activity

See All Activity >

Follow Shadow Network Fingerprinting Engine

Shadow Network Fingerprinting Engine Web Site

Other Useful Business Software

MongoDB Atlas runs apps anywhere

Deploy in 115+ regions with the modern database for every enterprise.

MongoDB Atlas gives you the freedom to build and run modern applications anywhere—across AWS, Azure, and Google Cloud. With global availability in over 115 regions, Atlas lets you deploy close to your users, meet compliance needs, and scale with confidence across any geography.

Start Free

Rate This Project

User Reviews

Be the first to post a review of Shadow Network Fingerprinting Engine!

Additional Project Details

Registered

2026-04-24

Similar Business Software

Paessler PRTG

Paessler PRTG is an all-inclusive monitoring software solution developed by Paessler. Equipped with an easy-to-use, intuitive interface with a cutting-edge monitoring engine, PRTG optimizes connections and workloads as well as reduces operational costs by avoiding outages while saving time and...

See Software
Sniffnet

Sniffnet is a network monitoring tool designed to help users easily keep track of their Internet traffic. Whether gathering statistics or inspecting in-depth network activities, Sniffnet provides comprehensive coverage. It emphasizes user experience, ensuring ease of use compared to other...

See Software
Arkime

Arkime is an open source, large-scale, full packet capturing, indexing, and database system designed to augment existing security infrastructure by storing and indexing network traffic in standard PCAP format. It offers full network visibility, facilitating the swift identification and...

See Software
Azure Network Watcher

Monitor and diagnose networking issues without logging in to your virtual machines (VMs) using Network Watcher. Trigger packet capture by setting alerts, and gain access to real-time performance information at the packet level. When you see an issue, you can investigate in detail for better...

See Software
tcpdump

Tcpdump is a powerful command-line packet analyzer that allows users to display the contents of network packets transmitted or received over a network to which the computer is attached. It operates on most Unix-like systems, including Linux, Solaris, FreeBSD, NetBSD, OpenBSD, and macOS,...

See Software
EtherApe

EtherApe is a graphical network monitor for Unix systems, modeled after Etherman, that displays network activity graphically, with hosts and links changing in size based on traffic volume and color-coded protocols. It supports various devices, including FDDI, ISDN, PPP, SLIP, and WLAN, as well...

See Software