Awesome GitHub RepositoriesNetwork Forensics

Moloch is a full packet capture system and network forensics platform designed for large scale network traffic recording and indexing. It functions as a distributed packet indexer that stores raw data in PCAP format for deep packet analysis and security investigations. The system distinguishes itself through a decentralized architecture that distributes capture and viewing components across multiple nodes to handle high volumes of network traffic. It utilizes a web-based management interface for browsing network sessions and provides a programmable API for exporting captured traffic and metad

Arkime is a distributed packet analysis platform and full packet capture system designed for recording raw network traffic, indexing metadata, and performing network forensics. It functions as a network traffic indexer and security tool that enables the monitoring, querying, and browsing of large-scale network traffic across multi-cluster architectures. The platform distinguishes itself through its ability to manage distributed capture clusters from a centralized administrative dashboard. It integrates external data feeds with internal traffic logs to identify known threats and provides a pro

gopacket is a Go library for live packet capture and multi-layer protocol decoding. It provides a framework for parsing raw network bytes into structured protocol layers, enabling inspection and analysis of network traffic directly from interfaces or packet capture files. The library distinguishes itself through a layered protocol stack that organizes decoders as independent, composable layers, and an interface-based decoder registry that supports extensible custom protocol development. It offers zero-copy packet decoding for high-throughput parsing, stream-based TCP reassembly to reconstruct

Dshell is a network forensic analysis framework and traffic processor designed for the deep packet inspection of IPv4 and IPv6 traffic. It functions as an extensible forensic plugin system that captures, inspects, and analyzes network data to identify security anomalies and reconstruct communication streams. The system utilizes a plugin-based processing engine that allows for custom plugin development and plugin chaining. This modular architecture enables the creation of specialized analysis pipelines where network data is passed through a sequence of processing units for multi-step analysis.

:star: :star: Distributed tcpdump for cloud native environments :star: :star:

Stenographer is a packet capture solution which aims to quickly spool all packets to disk, then provide simple, fast access to subsets of those packets. Discussion/announcements at stenographer@googlegroups.com

TCP/IP packet demultiplexer. Download from: