tcpdump

NetworkMiner is a network forensics tool that extracts artifacts such as files, images, emails, and passwords from captured network traffic in PCAP files. It can also capture live network traffic by sniffing a network interface. Detailed information about each IP address in the analyzed network traffic is aggregated into a network host inventory, which can be used for passive asset discovery and to get an overview of communicating devices. NetworkMiner is primarily designed to run on Windows but can also be used on Linux. Since its first release in 2007, it has become a popular tool among incident response teams and law enforcement and is used by companies and organizations worldwide.

Arkime is an open source, large-scale, full packet capturing, indexing, and database system designed to augment existing security infrastructure by storing and indexing network traffic in standard PCAP format. It offers full network visibility, facilitating the swift identification and resolution of security and network issues. Security teams gain access to the necessary network visibility data essential for responding to and investigating incidents to expose the full attack scope. Designed to be deployed across multiple clustered systems, Arkime provides the ability to scale to hundreds of gigabits per second. It allows security analysts to respond, reconstruct, investigate, and confirm information about the threats within your network, enabling appropriate responses quickly and precisely. As an open-source platform, Arkime provides users with the benefits of transparency, cost-effectiveness, flexibility, and community support.