How this analysis was created: This summary and feature list were written by an AI model that read the project's README and public documentation pages. Each feature links to the documentation it came from; stars, license and language come straight from the GitHub API. The model does not read the source code, and the analysis is refreshed when the project is re-analysed. Learn more on our About page.
ntopng is a web-based network traffic monitoring tool and flow data aggregator. It functions as a network security monitor, an SNMP network management system, and an industrial protocol analyzer for OT and SCADA environments. The system provides specialized inspection for industrial protocols such as Modbus, DNP3, and IEC 60870. It distinguishes itself through behavioral threat detection, encrypted traffic analysis via handshake fingerprinting, and the ability to identify hardware and operating systems using DHCP and MAC address patterns. Its broader capabilities include real-time traffic an
Scapy is a network packet manipulation tool and protocol analysis suite designed for crafting, sending, sniffing, and dissecting network traffic. It functions as a framework for building custom network tools that interact directly with low-level packet headers and payloads, enabling users to perform security research and network diagnostics. The system distinguishes itself through a layer-based construction model that allows users to define protocols as stacked objects, which automatically handle checksums and field offsets. It utilizes dynamic field reflection to map packet structures to bin
cmux is a TCP connection multiplexer and layer four protocol dispatcher. It routes incoming network traffic to different backend handlers by analyzing the initial bytes of the payload, allowing multiple network protocols to share a single IP address and port. The project identifies traffic using protocol signatures, byte-prefix matching, and header-value evaluation. It supports the detection of specific protocols including TLS, HTTP/1, and HTTP/2, and enables bidirectional handshaking where data can be sent back to a client during the matching phase. The routing system includes a first-match
Maltrail is a malicious traffic detection system used for network intrusion detection. It consists of a network intrusion sensor for monitoring interfaces, a threat intelligence aggregator for syncing blacklists, and a detection engine that identifies security threats through signature matching and heuristic attack patterns. The system distinguishes itself through a distributed sensor architecture that collects traffic data from multiple remote probes and forwards events to a central analysis server. It employs heuristic behavioral analysis to identify unknown threats, such as port scanning o
nDPI is a deep packet inspection toolkit and network protocol classifier designed to identify protocols and detect security threats through packet payload inspection. It functions as a network security monitor and a traffic analysis framework used to determine the services originating network flows.
The main features of ntop/ndpi are: Packet Inspection, Network Security Monitoring, Flow Tracking Engines, Protocol Dissectors, Analysis Chains, Protocol Classifiers, Behavioral Threat Detection, Payload-Based Traffic Filtering.
Open-source alternatives to ntop/ndpi include: ntop/ntopng — ntopng is a web-based network traffic monitoring tool and flow data aggregator. It functions as a network security… secdev/scapy — Scapy is a network packet manipulation tool and protocol analysis suite designed for crafting, sending, sniffing, and… soheilhy/cmux — cmux is a TCP connection multiplexer and layer four protocol dispatcher. It routes incoming network traffic to… stamparm/maltrail — Maltrail is a malicious traffic detection system used for network intrusion detection. It consists of a network… 3proxy/3proxy — 3proxy is a multi-protocol proxy server and network access control gateway. It functions as a network traffic… lgandx/pcredz — PCredz is a network credential extraction tool and traffic analyzer designed to intercept passwords, hashes, and…