aol/moloch
Moloch
Moloch is a full packet capture system and network forensics platform designed for large scale network traffic recording and indexing. It functions as a distributed packet indexer that stores raw data in PCAP format for deep packet analysis and security investigations.
The system distinguishes itself through a decentralized architecture that distributes capture and viewing components across multiple nodes to handle high volumes of network traffic. It utilizes a web-based management interface for browsing network sessions and provides a programmable API for exporting captured traffic and metadata.
The platform covers several core capability areas, including network metadata indexing for rapid event retrieval, distributed network monitoring, and detailed network traffic forensics. Data access is protected through authentication proxies, API keys, passwords, and encrypted connections.
Features
- Packet Capture Storage - Provides large-scale capturing of network traffic to disk in PCAP format for long-term storage.
- Network - Extracts session-level information from packets and stores it in a searchable database.
- Network Session Indexing - Parses captured packets into a searchable database for rapid retrieval of network events.
- Search Engine Integrations - Uses Elasticsearch to index and query packet metadata for rapid forensic lookups.
- Distributed Capture Probes - Distributes traffic collection across multiple remote nodes to handle high volumes of network data.
- Network Traffic Analyzers - Provides tools for searching and exploring indexed network sessions to investigate security incidents.
- Packet Capture Engines - Operates as a full-scale system for intercepting raw network traffic and storing it for analysis.
- Packet Capture Utilities - Records raw network traffic to disk in PCAP format for detailed security analysis.
- Metadata Indexing - Implements a distributed indexer that extracts and stores session-level metadata for rapid retrieval of network events.
- Network Monitoring Systems - Provides a distributed platform for monitoring and indexing network traffic across multiple systems.
- Network Traffic Export - Exports captured network data in PCAP or JSON formats for external analysis.
- Network Management Interfaces - Provides a web-based interface for browsing network sessions and exporting captured traffic.
- Traffic Session Browsers - Provides a web interface to search and explore individual network sessions and packet details.
- Client-Server Architectures - Implements a structural separation between the data-processing backend and a browser-based visualization frontend.
- Traffic Data Export - Provides programmable interfaces to export captured network traffic and metadata for external analysis.
- Network Forensics - Large-scale IPv4 packet capture and indexing system.
- Hunting Tools - Large-scale packet capture and indexing system.
- Network Analysis - Indexes and stores large-scale IPv4 traffic.
- Network Security - Large-scale packet capture, indexing, and search system.
