USArmyResearchLab/Dshell
Dshell
Dshell es un framework de análisis forense de red y procesador de tráfico diseñado para la inspección profunda de paquetes (DPI) de tráfico IPv4 e IPv6. Funciona como un sistema de plugins forenses extensible que captura, inspecciona y analiza datos de red para identificar anomalías de seguridad y reconstruir flujos de comunicación.
El sistema utiliza un motor de procesamiento basado en plugins que permite el desarrollo de plugins personalizados y el encadenamiento de los mismos. Esta arquitectura modular permite la creación de pipelines de análisis especializados donde los datos de red pasan a través de una secuencia de unidades de procesamiento para un análisis de múltiples pasos.
El framework cubre una amplia gama de capacidades forenses, incluyendo monitoreo de tráfico en tiempo real, reensamblado de flujos de red y mapeo de geolocalización IP mediante bases de datos de referencia externas. Para manejar grandes volúmenes de datos, el motor emplea procesamiento de datos en paralelo distribuyendo tareas a través de múltiples procesos del sistema. Los resultados del análisis procesado pueden exportarse a varios formatos de archivo estructurados mediante manejadores de salida especializados.
Features
- Packet Analysis Tools - Provides a utility for deep packet inspection and analysis of captured IPv4 and IPv6 traffic.
- Forensic Pipeline Extensions - Implements a modular framework for building and chaining custom forensic analysis plugins.
- Live Capture Libraries - Integrates directly with network interfaces to capture and process packets in real time.
- Multi-Stage Analysis Pipelines - Utilizes a sequence of modular processing stages to transform raw network packets into structural insights.
- Plugin Development Frameworks - Offers a structured framework for developing custom analysis modules to extend the processing engine.
- Stream Reassembly Processes - Provides the capability to reconstruct fragmented network traffic into coherent data streams for forensic examination.
- Live Traffic Analysis - Enables real-time processing of network packets by running analysis plugins directly on a network interface.
- Network Traffic Processors - Processes network traffic flows programmatically to reassemble streams and export forensic data.
- Packet Capture Analysis - Scans and processes stored packet capture files to identify security anomalies and patterns.
- TCP Stream Reassembly - Reconstructs fragmented network traffic into coherent bidirectional conversations by tracking sequence numbers.
- Forensic Frameworks - Provides a modular architecture designed for digital forensic analysis and network traffic ingestion.
- Pipeline Plugins - Implements a modular processing engine where network data is passed through a sequence of specialized pipeline plugins.
- Packet Inspection - Performs deep analysis of network packets and protocol headers using targeted inspection plugins.
- Network Traffic Monitors - Monitors live network traffic directly from an interface to detect security patterns as they occur.
- IP Geolocation - Maps IP addresses to physical locations and country codes to enrich traffic analysis metadata.
- Parallel Processing - Distributes packet capture and analysis tasks across multiple system processes to increase overall throughput.
- IP Geographic Mapping - Resolves network addresses to geographic locations by querying external IP mapping databases.
- Packet Processing Frameworks - Provides a programmable framework for building and chaining custom packet processing plugins.
- Concurrent Packet Processing - Handles high volumes of network data through concurrent processing across multiple system execution threads.
- Multi-Process Task Distribution - Distributes packet capture and analysis workloads across multiple system processes to increase throughput.
- Network Forensics - Network forensic analysis framework.
- Automation And Infrastructure - Extensible framework for rapid network forensic analysis and packet dissection.
- Network Security - Extensible framework for network forensic packet analysis.
- Protocol Analyzers - Framework for network forensic analysis.
