Awesome GitHub RepositoriesNetwork Traffic Export

Ecapture is a suite of specialized auditing tools designed to capture plaintext database queries, log executed shell commands, forward packet captures, and decrypt TLS traffic. The system extracts plaintext content from encrypted communications and TLS master secrets without requiring CA certificates. It further monitors data interactions by capturing SQL queries from database instances and recording commands from shell environments for host-level auditing. The toolset includes capabilities for network traffic analysis, exporting captured data to pcapng files, and forwarding events to extern

ntopng es una herramienta de monitoreo de tráfico de red basada en web y agregador de datos de flujo. Funciona como un monitor de seguridad de red, un sistema de gestión de red SNMP y un analizador de protocolos industriales para entornos OT y SCADA. El sistema proporciona una inspección especializada para protocolos industriales como Modbus, DNP3 e IEC 60870. Se distingue por la detección de amenazas conductuales, el análisis de tráfico cifrado mediante huellas digitales de enlace y la capacidad de identificar hardware y sistemas operativos utilizando patrones de DHCP y direcciones MAC. Sus capacidades más amplias incluyen el análisis de tráfico en tiempo real y la captura de paquetes, el mapeo de topología de red y la orquestación de jerarquías de colectores escalonados. La plataforma también gestiona el control de acceso a la red a través de portales cautivos, aplica cuotas de tráfico y exporta datos de flujo y alertas a bases de datos externas como ClickHouse, Elasticsearch y Kafka. El proyecto admite la ejecución de múltiples instancias de monitoreo independientes en un solo host utilizando configuraciones aisladas.

Moloch is a full packet capture system and network forensics platform designed for large scale network traffic recording and indexing. It functions as a distributed packet indexer that stores raw data in PCAP format for deep packet analysis and security investigations. The system distinguishes itself through a decentralized architecture that distributes capture and viewing components across multiple nodes to handle high volumes of network traffic. It utilizes a web-based management interface for browsing network sessions and provides a programmable API for exporting captured traffic and metad

This project is the core management framework for a security appliance, providing the primary infrastructure for firewall management, network intrusion prevention, and high-availability networking. It serves as the centralized system for controlling network security policies, filtering traffic, and administering a security appliance dashboard. The system is distinguished by its high-availability capabilities, which include synchronizing configurations and connection state tables across redundant nodes to enable automatic hardware failover. It also features a modular plugin architecture for ex

PCAPdroid is an Android network traffic analyzer and packet capture tool that operates without requiring root access. It functions as a VPN-based firewall and network controller, capable of recording traffic in PCAPng format and blocking connections to specific domains or malicious hosts. The project distinguishes itself through a proxy-based system for decrypting TLS traffic and routing device network traffic through SOCKS5 proxies or the Tor network. It further allows for the modification of live HTTP requests and responses via custom scripts. Its capabilities cover application connection