Open-source alternatives to Stenographer

Moloch is a full packet capture system and network forensics platform designed for large scale network traffic recording and indexing. It functions as a distributed packet indexer that stores raw data in PCAP format for deep packet analysis and security investigations. The system distinguishes itself through a decentralized architecture that distributes capture and viewing components across multiple nodes to handle high volumes of network traffic. It utilizes a web-based management interface for browsing network sessions and provides a programmable API for exporting captured traffic and metad

SSLyze is an SSL/TLS security scanner and network encryption analyzer designed to identify vulnerabilities and misconfigurations in encryption settings. It functions as both a standalone tool for analyzing server certificates and cipher suites and a programmable Python security library for embedding automated scanning logic into larger applications. The tool distinguishes itself by supporting encryption analysis for both HTTP and non-HTTP network services, including mail, directory, and database protocols. It includes a security compliance validator that compares server configurations against

ethr is a command line network diagnostic tool and performance analyzer designed to measure throughput, latency, and packet loss across TCP, UDP, and ICMP protocols. It functions as a multi-threaded network throughput tester and a diagnostic utility for analyzing connection health between client and server endpoints. The project differentiates itself through specialized diagnostics such as TCP retransmission monitoring and bidirectional path analysis to identify asymmetric performance differences. It provides the ability to evaluate the overhead of encrypted HTTPS connections and enforce spec

SSH server auditing (banner, key exchange, encryption, mac, compression, compatibility, security, etc)

A high-performance DNS stub resolver for bulk lookups and reconnaissance (subdomain enumeration)

Dshell is a network forensic analysis framework and traffic processor designed for the deep packet inspection of IPv4 and IPv6 traffic. It functions as an extensible forensic plugin system that captures, inspects, and analyzes network data to identify security anomalies and reconstruct communication streams. The system utilizes a plugin-based processing engine that allows for custom plugin development and plugin chaining. This modular architecture enables the creation of specialized analysis pipelines where network data is passed through a sequence of processing units for multi-step analysis.

ZMap is a fast single packet network scanner designed for Internet-wide network surveys.

PacketFu, a mid-level packet manipulation library for Ruby

Security Onion is a security information and event management platform and network security monitoring suite. It functions as an intrusion detection system and a network traffic analysis tool designed to identify malicious activity and network intrusions through signature-based detection and host-based monitoring. The platform integrates a security case management system to organize investigations by tracking detections and grouping related security events. It provides capabilities for full packet capture, network metadata extraction, and the collection and indexing of security logs from dive

Hyperfine is a command-line benchmarking tool used to measure the execution time of shell commands through multiple runs and statistical analysis. It functions as a comparative benchmarking utility and a shell performance analyzer, allowing for the evaluation of multiple commands against a reference baseline to determine relative speed. The tool distinguishes itself by isolating actual command performance through shell overhead correction and the ability to bypass the shell entirely using system calls. It supports parameterized execution, enabling benchmarks to run across a range of varying i

nDPI is a deep packet inspection toolkit and network protocol classifier designed to identify protocols and detect security threats through packet payload inspection. It functions as a network security monitor and a traffic analysis framework used to determine the services originating network flows. The system utilizes a modular dissector architecture and a sequence-based dissector chain to interpret network traffic. It supports custom protocol definition and protocol dissector extensions, allowing for the identification of proprietary or new network protocols. The toolkit provides capabilit

Endlessh is an SSH tarpit and network honeypot designed to mitigate automated SSH brute force attacks. It acts as a defensive layer that protects servers by diverting malicious connection attempts into a slow-motion trap. The project implements a tarpit by sending endless, throttled banners to clients, which keeps connections open indefinitely to occupy attacker resources and slow down network scans. The service includes connection rate limiting to prevent system resource exhaustion and provides monitoring through connection activity and diagnostic data logging to system logs. Process manage

gopacket is a Go library for live packet capture and multi-layer protocol decoding. It provides a framework for parsing raw network bytes into structured protocol layers, enabling inspection and analysis of network traffic directly from interfaces or packet capture files. The library distinguishes itself through a layered protocol stack that organizes decoders as independent, composable layers, and an interface-based decoder registry that supports extensible custom protocol development. It offers zero-copy packet decoding for high-throughput parsing, stream-based TCP reassembly to reconstruct

kubectl-aliases is a Kubernetes CLI alias generator that programmatically creates shorthand shell commands for common cluster operations and resource management. It functions as a workflow optimizer designed to reduce typing and increase the speed of interactions with the Kubernetes API. The tool operates as a shell command permutator, combining verbs, resources, and flags to automate the creation of a comprehensive library of CLI shortcuts. It utilizes combinatorial mapping and template-driven scripting to generate these shorthand definitions. The project covers several operational areas, i

Generates Conventional Commit messages with AI. Supports OpenAI, Ollama, and Gemini.

simple but convenient CLI-based Nostr client app for following users and sending DMs

Kong is a declarative command line interface framework and parser for Go. It maps flags and positional arguments directly into typed Go structures using struct tags, allowing developers to define terminal interfaces through data models rather than manual parsing logic. The project functions as a configuration mapper that populates Go structures from a combination of command-line arguments, environment variables, and JSON files. It distinguishes itself by providing a dependency injection container to pass external services into command handlers and a plugin architecture for dynamic command reg

Declarative framework for interactive CLI applications

OpenHands is an autonomous AI software engineer and coding assistant designed to execute software engineering tasks by interacting directly with codebases and development environments. It functions as a platform for running AI agents that can write code and manage files to automate complex development workflows. The system distinguishes itself through a container-based execution environment that isolates agent actions within a sandboxed Linux environment. It employs an autonomous agent loop of observation, planning, and action, supported by a standardized communication protocol that allows it

Awesome deno terminal spinners :art:

A pure Swift replacement for readline

The easy way to switch between your projects on ZSH

Sync data from one Postgres database to another

⚡ Modern Python CLI for Nostr protocol interactions - secure key management, event creation, and relay operations