Projects sharing features with Moloch

PCAPdroid is an Android network traffic analyzer and packet capture tool that operates without requiring root access. It functions as a VPN-based firewall and network controller, capable of recording traffic in PCAPng format and blocking connections to specific domains or malicious hosts. The project distinguishes itself through a proxy-based system for decrypting TLS traffic and routing device network traffic through SOCKS5 proxies or the Tor network. It further allows for the modification of live HTTP requests and responses via custom scripts. Its capabilities cover application connection

ntopng is a web-based network traffic monitoring tool and flow data aggregator. It functions as a network security monitor, an SNMP network management system, and an industrial protocol analyzer for OT and SCADA environments. The system provides specialized inspection for industrial protocols such as Modbus, DNP3, and IEC 60870. It distinguishes itself through behavioral threat detection, encrypted traffic analysis via handshake fingerprinting, and the ability to identify hardware and operating systems using DHCP and MAC address patterns. Its broader capabilities include real-time traffic an

GoReplay is a network traffic recording and replay tool used to capture live HTTP and binary protocol requests. It functions as a traffic shadowing proxy that duplicates incoming network requests to test environments and a utility for recording traffic to local or cloud storage for later analysis and playback. The system is capable of processing non-textual data formats, such as Thrift and Protocol Buffers, allowing for the capture and replay of specialized application-to-application communication. The tool supports live traffic capture and asynchronous duplication to validate infrastructure

Termshark is a terminal-based network packet analyzer and protocol flow inspector. It serves as a keyboard-driven interface for the tshark command-line utility, providing a terminal user interface to monitor data flow and analyze network traffic. The tool functions as a terminal interface for Wireshark, utilizing its filtering and inspection logic to analyze recorded capture files or live network interfaces. It specifically enables the reassembly and inspection of TCP and UDP flows to isolate traffic patterns and analyze network conversations by protocol. The system includes capabilities for

BCC is an eBPF development toolkit and tracing framework used for monitoring and analyzing the Linux kernel. It functions as a performance analysis tool and debugging utility to capture system events, measure kernel latency, and provide network observability. The project distinguishes itself by providing a build system that integrates with LLVM to compile C-like code into BPF bytecode at runtime. It utilizes BPF Type Format data for relocations to maintain cross-kernel compatibility and extracts kernel headers to ensure the generated programs match the specific kernel version. The toolkit co

Zeek is a network analysis framework and security monitoring tool that transforms raw network packets into high-level semantic logs. It functions as an application protocol analyzer and network intrusion detection system designed to extract meaning from network traffic and monitor for malicious activity. The system focuses on archiving network activity and maintaining historical records of application-layer state for forensic investigation and auditing. It utilizes a combination of modular protocol analyzers and customizable detection policies to perform deep semantic analysis of numerous app

Scapy is a network packet manipulation tool and protocol analysis suite designed for crafting, sending, sniffing, and dissecting network traffic. It functions as a framework for building custom network tools that interact directly with low-level packet headers and payloads, enabling users to perform security research and network diagnostics. The system distinguishes itself through a layer-based construction model that allows users to define protocols as stacked objects, which automatically handle checksums and field offsets. It utilizes dynamic field reflection to map packet structures to bin

Pulse is an Apple platform network logger used for recording and inspecting network traffic and system logs directly within applications. It functions as an on-device network inspector and traffic export tool, allowing for the capture of outgoing requests and the transmission of logs to external systems. The project includes a remote log streamer for the real-time transmission of device logs to an external viewer for live monitoring. It further provides an integrated interface for viewing recorded network requests and system logs on the device without the requirement of an external proxy. Th

Maltrail is a malicious traffic detection system used for network intrusion detection. It consists of a network intrusion sensor for monitoring interfaces, a threat intelligence aggregator for syncing blacklists, and a detection engine that identifies security threats through signature matching and heuristic attack patterns. The system distinguishes itself through a distributed sensor architecture that collects traffic data from multiple remote probes and forwards events to a central analysis server. It employs heuristic behavioral analysis to identify unknown threats, such as port scanning o

bandwhich is a command-line network utility and terminal bandwidth monitor designed for real-time traffic analysis. It functions as a process-based traffic tracker that links network bandwidth usage directly to the system processes and remote hosts responsible for the data transfer. The tool provides a terminal user interface for monitoring active connections and identifying data-consuming applications. It performs background reverse DNS lookups to associate remote IP addresses with human-readable hostnames and tracks cumulative data utilization over the duration of a capture session. Its br

Kubeshark is a network observability platform designed for Kubernetes environments, functioning as an eBPF-powered engine for cluster-wide traffic analysis. It captures, indexes, and visualizes network activity and API calls directly from the kernel, providing deep visibility into service-to-service communication without requiring sidecar proxies or manual code instrumentation. The platform distinguishes itself through its ability to perform protocol-aware traffic dissection and user-space cryptographic hooking, which allows for the inspection of encrypted traffic and the reconstruction of ap

EasyTier is a decentralized peer-to-peer virtual private network and mesh networking tool. It functions as a layer 3 network overlay that establishes secure tunnels between devices without requiring a centralized server or coordinator. It also serves as a WireGuard-compatible VPN, capable of acting as a server for standard WireGuard clients. The project distinguishes itself through multipath latency-based routing and the use of KCP or QUIC proxies to mitigate packet loss and stabilize connections in high-loss environments. It provides a virtual networking manager featuring a web management co

Dshell is a network forensic analysis framework and traffic processor designed for the deep packet inspection of IPv4 and IPv6 traffic. It functions as an extensible forensic plugin system that captures, inspects, and analyzes network data to identify security anomalies and reconstruct communication streams. The system utilizes a plugin-based processing engine that allows for custom plugin development and plugin chaining. This modular architecture enables the creation of specialized analysis pipelines where network data is passed through a sequence of processing units for multi-step analysis.

Stenographer is a packet capture solution which aims to quickly spool all packets to disk, then provide simple, fast access to subsets of those packets. Discussion/announcements at stenographer@googlegroups.com

FakeNet-NG - Next Generation Dynamic Network Analysis Tool

NETworkManager is a comprehensive suite of network administration tools designed for the deployment, monitoring, and diagnostic management of enterprise networks. It provides a centralized interface for subnet management, IP address configuration, and wireless network analysis. The project distinguishes itself by integrating a multi-protocol remote administration client that supports SSH, RDP, VNC, Telnet, and PowerShell sessions within a unified tabbed interface. It further differentiates its capabilities through hardware-level discovery using LLDP and CDP frames, alongside the ability to en

Pcap-Analyzer is a desktop utility designed for the forensic analysis of offline packet capture files. It functions by decoding binary network protocols into structured metadata, allowing users to examine network activity without requiring a live connection. The tool provides comprehensive capabilities for reconstructing communication sessions and extracting application-layer artifacts, such as transmitted files and credentials. It distinguishes itself through integrated geospatial mapping, which correlates source and destination network addresses with physical location databases to visualize

AndroidHttpCapture is a mobile application for intercepting and analyzing HTTP and HTTPS network traffic directly on an Android device. It functions as a local proxy server and traffic interceptor to capture and monitor requests and responses from other installed mobile applications. The tool provides capabilities for MITM HTTPS decryption through root certificate installation and supports exporting captured network sessions as HAR files for external analysis. It allows for real-time response body injection and the modification of request headers via user agent spoofing. The project includes

This project is a browser developer tool designed for inspecting JavaScript execution, network traffic, and page layouts. It functions as a JavaScript debugger and a Chrome DevTools Protocol debugger to manage the state of a web engine and identify logic errors in web applications. The suite provides specialized utilities for web performance profiling, including the detection of memory leaks and the analysis of processing bottlenecks. It also includes a network traffic analyzer for troubleshooting API calls and a browser storage manager for modifying cookies, cache, and local database entries

mitmproxy2swagger is a tool that transforms captured mitmproxy network traffic into structured OpenAPI schemas for reverse-engineering REST APIs. It functions as an OpenAPI schema converter and network traffic documentation utility, extracting API endpoints and data structures from captured network packets to create formal technical references. The tool enables the reconstruction of undocumented APIs by converting intercepted HTTP request and response patterns into specifications. It supports merging multiple traffic capture files into a single schema to incrementally expand an API map and ut

Torsniff is a BitTorrent network sniffer and traffic analyzer designed to intercept and capture torrent metadata and peer traffic. It functions as a network utility that extracts information about available files and trackers from peer-to-peer networks. The tool utilizes a distributed hash table to gather metadata without relying on a central tracker. It includes a bencode data parser to decode specialized metadata formats, allowing for the extraction of file names, directory paths, and total sizes. The project covers network monitoring and data analysis through packet-level traffic inspecti

This project is a specialized browser debugging interface designed to monitor DOM elements, network traffic, and JavaScript execution. It provides a client-side user interface for inspecting and debugging web applications, allowing for the real-time modification of CSS styles and the investigation of the JavaScript runtime. The toolkit includes dedicated analysis tools for WebAssembly, featuring disassembly highlighting, scope inspection, and binary execution profiling. It also provides a network traffic inspector for analyzing HTTP requests and a CSS style editor for testing properties and a

ESP32Marauder is a suite of specialized firmware images and tools designed for wireless network auditing, packet sniffing, and Bluetooth scanning on ESP32 hardware. It functions as a wireless penetration tool used to analyze network security and monitor signal traffic. The project includes capabilities for capturing wireless handshakes and simulating access points to test infrastructure resilience. It also features a Bluetooth low energy scanner used to identify hardware signatures and detect unauthorized signals or skimming devices. The firmware supports broader security operations includin

PCredz is a network credential extraction tool and traffic analyzer designed to intercept passwords, hashes, and tokens from IPv4 and IPv6 traffic. It functions as both a real-time monitor for live network interfaces and a parser for saved packet capture files. The tool identifies sensitive information, including credit card numbers and authentication tokens, using protocol-aware parsing. It further acts as a password hash recovery utility by normalizing captured authentication hashes into specific syntaxes compatible with external recovery software. Capabilities include real-time traffic in

Stetho is a debug bridge that connects Android applications to Chrome Developer Tools. It allows for the real-time inspection of network traffic, internal application state, and the user interface layout directly within a desktop browser. The project provides specialized inspectors for analyzing Android-specific components. This includes a network inspector for capturing HTTP requests and responses, an SQLite database browser for querying local storage, and a view hierarchy inspector for mapping UI elements and styles. Additional capabilities cover runtime execution via an embedded JavaScrip

Django Haystack is a search abstraction layer and framework for integrating full-text search into Django applications. It provides a unified interface for defining search schemas and managing how data models are indexed and stored across different search engines. The framework acts as a modular backend wrapper, allowing applications to switch between interchangeable search providers without rewriting core search logic. It standardizes interactions with external engines through a decoupled provider layer, facilitating search engine migration by changing configuration settings. The system cove

yii2_fecshop is a comprehensive B2C e-commerce platform and CMS built on the Yii2 PHP framework. It functions as a headless commerce API and an international storefront solution, supporting both single-vendor stores and multi-vendor marketplaces where independent merchants can manage their own products and orders. The system is distinguished by a multi-entry point architecture that separates administrative, web, mobile, and API interfaces while sharing a common service layer. It provides high extensibility through configuration-driven service replacement, event-driven functional extensions, a