Awesome GitHub RepositoriesNetwork Traffic Analyzers

Agent-skills is a collection of structured instructions and behavioral personas designed to standardize how AI coding agents perform engineering tasks. It functions as a workflow orchestrator that maps natural language intent to repeatable technical sequences and verification checklists. The project distinguishes itself through the use of specialized markdown-defined roles, such as security auditors or test engineers, to apply targeted domain expertise. It employs an evidence-based verification model that requires runtime data or passing tests as mandatory exit criteria to ensure AI-generated

Mitmproxy is an interactive, programmable network proxy engine designed for traffic analysis and protocol manipulation. It functions as a gateway that intercepts, inspects, and modifies network traffic in real-time, supporting HTTP, HTTPS, WebSocket, DNS, and generic TCP or UDP streams. By acting as a trusted certificate authority, the proxy can dynamically generate and sign certificates to decrypt and analyze secure TLS-encrypted connections. The project distinguishes itself through a highly extensible, event-driven architecture that allows users to automate traffic transformation using cust

This application is a desktop network traffic analyzer that provides real-time monitoring and forensic inspection of data packets. By interfacing directly with low-level system drivers, it captures raw network traffic from physical or virtual adapters to identify communication patterns, track bandwidth usage, and diagnose connectivity issues. The system distinguishes itself through an immediate-mode graphical interface that rebuilds the display state every frame, ensuring high responsiveness during live data updates. It maintains performance by using asynchronous message passing to decouple t

CLIProxyAPI is a command-line utility designed for routing, inspecting, and managing API network traffic directly from the terminal. It functions as a local proxy server that intercepts outgoing system-level requests, allowing users to monitor and troubleshoot connectivity without the need for external proxy software or browser-based tools. The tool distinguishes itself by providing a unified workflow for managing authentication credentials and connection settings through environment-based injection. It utilizes a middleware request pipeline that enables the real-time inspection and modificat

This project is an agentic framework designed to enable autonomous web navigation and browser automation. It functions as a controller that translates natural language instructions into deterministic browser actions, allowing agents to interact with websites, perform data extraction, and manage complex authentication flows. By leveraging accessibility trees and semantic element resolution, the framework mimics human-like navigation, moving beyond brittle DOM selectors to interact reliably with modern web interfaces. The framework distinguishes itself through its focus on secure, scalable exec

PhantomJS is a scriptable, headless browser engine based on WebKit that provides a programmatic interface for automating web page interactions. It operates without a graphical user interface, allowing for the execution of JavaScript to navigate pages, manipulate the document object model, and perform functional testing of web applications. The tool distinguishes itself by providing low-level control over the browser rendering lifecycle and network stack. It enables real-time interception and modification of network traffic, alongside the ability to generate visual snapshots and document expor

Envoy is a cloud-native service proxy and distributed system traffic manager designed to route and control network traffic between services and clients. It operates as an L4 and L7 network proxy, managing communication at the edge and middle levels of a distributed cloud environment. The project provides capabilities for API gateway implementation and edge proxy routing to direct external requests to internal services. It serves as a foundation for service mesh traffic management and cloud-native load balancing to ensure high availability across backend instances. The system also includes to

Envoy is a high-performance, cloud-native service proxy designed for service-to-service communication in distributed architectures. It functions as a service mesh data plane, providing a centralized mechanism for managing, securing, and observing network traffic between microservices. The project is distinguished by its ability to perform dynamic traffic management and configuration updates in real-time without requiring service restarts or downtime. It utilizes a non-blocking, event-driven architecture to handle high-concurrency connections and supports hot-restart process management, which

v86 is a browser-based virtual machine and x86 hardware simulator that allows 16-bit and 32-bit operating systems to run directly within a web page. It functions as an x86 emulator for WebAssembly, simulating CPUs, memory, and storage devices to execute legacy software without original native hardware. The project utilizes a WebAssembly just-in-time compiler to translate x86 machine code into WebAssembly modules for high-performance execution in the browser. The system covers hardware emulation and lifecycle management, including the ability to boot from disk images, configure virtual hardwa

BCC is an eBPF development toolkit and tracing framework used for monitoring and analyzing the Linux kernel. It functions as a performance analysis tool and debugging utility to capture system events, measure kernel latency, and provide network observability. The project distinguishes itself by providing a build system that integrates with LLVM to compile C-like code into BPF bytecode at runtime. It utilizes BPF Type Format data for relocations to maintain cross-kernel compatibility and extracts kernel headers to ensure the generated programs match the specific kernel version. The toolkit co

This project is a comprehensive educational guide and framework for building web scrapers using Python. It provides a course-based approach to data extraction, combining a Python crawler framework with tutorials on web reverse engineering and network traffic analysis. The project distinguishes itself by covering advanced extraction challenges, including the decryption of obfuscated JavaScript and the bypass of anti-scraping measures. It specifically addresses mobile application scraping through the simulation of user interactions and the interception of network traffic. The capability surfac

DoraemonKit is a mobile frontend development toolset designed to optimize the lifecycle of web and hybrid mobile applications. It functions as a comprehensive suite of productivity tools, providing specialized utilities for mobile UI inspection, web view debugging, and on-device performance monitoring. The toolset distinguishes itself through several targeted simulation and interception capabilities. It includes a network traffic interceptor for mocking API responses without modifying source code, a device state simulator for overriding GPS coordinates, and a mobile web debugging bridge that

This project is a command-line utility designed for HTTP load testing and network stress testing. It functions as a benchmarking tool that generates high volumes of concurrent traffic to evaluate the performance, reliability, and throughput capacity of web applications and APIs under sustained load. The tool allows for precise control over traffic generation by enabling users to configure request parameters, including custom headers, authentication credentials, and specific HTTP methods. It manages load through a worker-pool system that regulates request frequency, allowing for both time-boun

Gor is a set of specialized utilities for recording, replaying, and shadowing network traffic to validate system behavior under real-world conditions. It functions as an HTTP traffic recording tool, a network traffic capture engine, and a system for duplicating live production traffic. The project provides capabilities for recording real-time HTTP network traffic and storing it for later playback or analysis. It can duplicate live production network traffic and redirect it to a staging environment in real time, or replay recorded network requests against a target environment to validate syste

GoReplay is a network traffic recording and replay tool used to capture live HTTP and binary protocol requests. It functions as a traffic shadowing proxy that duplicates incoming network requests to test environments and a utility for recording traffic to local or cloud storage for later analysis and playback. The system is capable of processing non-textual data formats, such as Thrift and Protocol Buffers, allowing for the capture and replay of specialized application-to-application communication. The tool supports live traffic capture and asynchronous duplication to validate infrastructure

This project is a comprehensive, community-curated directory of cybersecurity resources, tools, and educational materials. It functions as a centralized index for researchers and students to discover frameworks and utilities across the entire security lifecycle, ranging from initial vulnerability assessment to post-exploitation analysis. The repository distinguishes itself through a hierarchical taxonomy that organizes diverse security disciplines into a searchable, version-controlled knowledge base. Rather than hosting software directly, it utilizes a decentralized aggregation model that lin

Reactotron is a desktop application and collection of developer tools designed for monitoring runtime errors, analyzing network requests, and inspecting state within JavaScript and React environments. It serves as a debugger for both React JS and React Native projects, providing a visual interface to monitor internal application state and performance. The tool provides specialized inspectors for React Native mobile applications and React web applications. It allows for the real-time tracking of state changes and the dispatching of actions to a state manager to test different application scena

Reactotron is a desktop application for inspecting the state, network traffic, and logs of React and React Native applications. It serves as a specialized debugging interface for monitoring network requests, performance metrics, and state transitions in JavaScript and mobile application frameworks. The tool provides a real-time interface for tracking data flow and dispatching actions to test different state transitions. It includes a network traffic monitor to intercept and display API requests and responses, as well as a performance analysis tool for capturing execution data and measuring op

Reactotron is a desktop-based development environment designed for inspecting, monitoring, and manipulating mobile and web applications in real time. It functions as a centralized hub that connects to a running application via a persistent WebSocket connection, allowing developers to observe internal state, network traffic, and console output without manual instrumentation. The tool distinguishes itself through a modular plugin architecture that enables custom debugging commands and specialized extensions. It provides advanced diagnostic capabilities, including the ability to overlay design m

Apache Pulsar is a cloud-native distributed pub-sub messaging system designed for high-performance data ingestion. It functions as a geo-replicated data streamer and a multi-tenant event streaming platform, providing a serverless stream processing engine and a tiered storage messaging broker. The system distinguishes itself by separating serving layers from storage layers to allow independent scaling of compute and data retention. It features native geo-replication to synchronize messages across different geographical regions and employs a multi-layered tenant isolation model using authentica