Suricata is an open-source network intrusion detection and prevention engine that analyzes live network traffic in real-time to identify and alert on malicious activity. It operates as a rule-based threat detection system, matching traffic against user-defined signatures to detect known attack patterns and policy violations, and can be placed inline to actively block malicious packets before they reach their target. The engine inspects a wide range of application-layer protocols including HTTP, DNS, TLS, SMB, and MQTT, and supports high-performance packet capture through specialized hardware a
Arkime is a distributed packet analysis platform and full packet capture system designed for recording raw network traffic, indexing metadata, and performing network forensics. It functions as a network traffic indexer and security tool that enables the monitoring, querying, and browsing of large-scale network traffic across multi-cluster architectures. The platform distinguishes itself through its ability to manage distributed capture clusters from a centralized administrative dashboard. It integrates external data feeds with internal traffic logs to identify known threats and provides a pro
GoReplay is a network traffic recording and replay tool used to capture live HTTP and binary protocol requests. It functions as a traffic shadowing proxy that duplicates incoming network requests to test environments and a utility for recording traffic to local or cloud storage for later analysis and playback. The system is capable of processing non-textual data formats, such as Thrift and Protocol Buffers, allowing for the capture and replay of specialized application-to-application communication. The tool supports live traffic capture and asynchronous duplication to validate infrastructure
Goreplay is an HTTP traffic mirroring tool designed to capture live network traffic from production environments and replay it into test systems for validation. It includes a specialized Kubernetes traffic capturer that operates as a daemonset to mirror traffic from specific pods using label selectors and namespace filters, alongside a TCP traffic recorder for intercepting raw network packets. The project features a Kafka traffic pipeline for streaming captured payloads to topics or ingesting messages for playback, and an HTTP request transformer to mask sensitive data or rewrite headers and
:star: :star: Distributed tcpdump for cloud native environments :star: :star:
Die Hauptfunktionen von deepfence/packetstreamer sind: Network Forensics, Traffic Capture Frameworks.
Open-Source-Alternativen zu deepfence/packetstreamer sind unter anderem: oisf/suricata — Suricata is an open-source network intrusion detection and prevention engine that analyzes live network traffic in… probelabs/goreplay — Goreplay is an HTTP traffic mirroring tool designed to capture live network traffic from production environments and… buger/goreplay — GoReplay is a network traffic recording and replay tool used to capture live HTTP and binary protocol requests. It… arkime/arkime — Arkime is a distributed packet analysis platform and full packet capture system designed for recording raw network… google/gopacket — gopacket is a Go library for live packet capture and multi-layer protocol decoding. It provides a framework for… samratashok/nishang — Nishang is a PowerShell-based offensive security framework designed for red teaming and penetration testing on Windows…