How this analysis was created: This summary and feature list are AI-generated from collected project material and can contain mistakes. Stars, license and language are imported from GitHub. Inclusion does not mean that we have tested or audited this project. Check the source documentation for any feature you depend on. Learn more on our About page.
nDPI is a deep packet inspection toolkit and network protocol classifier designed to identify protocols and detect security threats through packet payload inspection. It functions as a network security monitor and a traffic analysis framework used to determine the services originating network flows.
The main features of ntop/ndpi are: Packet Inspection, Network Security Monitoring, Flow Tracking Engines, Protocol Dissectors, Analysis Chains, Protocol Classifiers, Behavioral Threat Detection, Payload-Based Traffic Filtering.
Projects with overlapping indexed features include: ntop/ntopng — ntopng is a web-based network traffic monitoring tool and flow data aggregator. It functions as a network security… secdev/scapy — Scapy is a network packet manipulation tool and protocol analysis suite designed for crafting, sending, sniffing, and… soheilhy/cmux — cmux is a TCP connection multiplexer and layer four protocol dispatcher. It routes incoming network traffic to… stamparm/maltrail — Maltrail is a malicious traffic detection system used for network intrusion detection. It consists of a network… 3proxy/3proxy — 3proxy is a multi-protocol proxy server and network access control gateway. It functions as a network traffic… lgandx/pcredz — PCredz is a network credential extraction tool and traffic analyzer designed to intercept passwords, hashes, and…
ntopng is a web-based network traffic monitoring tool and flow data aggregator. It functions as a network security monitor, an SNMP network management system, and an industrial protocol analyzer for OT and SCADA environments. The system provides specialized inspection for industrial protocols such as Modbus, DNP3, and IEC 60870. It distinguishes itself through behavioral threat detection, encrypted traffic analysis via handshake fingerprinting, and the ability to identify hardware and operating systems using DHCP and MAC address patterns. Its broader capabilities include real-time traffic an
Scapy is a network packet manipulation tool and protocol analysis suite designed for crafting, sending, sniffing, and dissecting network traffic. It functions as a framework for building custom network tools that interact directly with low-level packet headers and payloads, enabling users to perform security research and network diagnostics. The system distinguishes itself through a layer-based construction model that allows users to define protocols as stacked objects, which automatically handle checksums and field offsets. It utilizes dynamic field reflection to map packet structures to bin
cmux is a TCP connection multiplexer and layer four protocol dispatcher. It routes incoming network traffic to different backend handlers by analyzing the initial bytes of the payload, allowing multiple network protocols to share a single IP address and port. The project identifies traffic using protocol signatures, byte-prefix matching, and header-value evaluation. It supports the detection of specific protocols including TLS, HTTP/1, and HTTP/2, and enables bidirectional handshaking where data can be sent back to a client during the matching phase. The routing system includes a first-match
Maltrail is a malicious traffic detection system used for network intrusion detection. It consists of a network intrusion sensor for monitoring interfaces, a threat intelligence aggregator for syncing blacklists, and a detection engine that identifies security threats through signature matching and heuristic attack patterns. The system distinguishes itself through a distributed sensor architecture that collects traffic data from multiple remote probes and forwards events to a central analysis server. It employs heuristic behavioral analysis to identify unknown threats, such as port scanning o