Open-source alternatives to CapTipper

A Swiss army knife for your daily Linux network plumbing.

A multi-threading tool to sniff TCP flow statistics and embedded HTTP headers from PCAP file. Each TCP flow carrying HTTP is exported to text file in json format.

A simple, cross-platform utility to classify packets into flows using only the essential 4-tuple.

analyze a web-based network traffic 🕶 to detect central command and control servers

Potiron - Normalize, Index and Visualize Network Capture

A package for capturing and analyzing network flow data and intraflow data, for network research, forensics, and security monitoring.

Packet monster (っ‘-’)╮=͟͟͞͞◒ ヽ( '-'ヽ) TUI tool for sending packets of arbitrary input and monitoring packets on any network interfaces (default: eth0). Windows/macOS/Linux

Moved to https://codeberg.org/DNS-OARC/PacketQ

Ettercap is a network utility tool used for ARP spoofing, packet filtering, traffic interception, passive scanning, and DHCP hijacking. It functions as a network traffic interceptor and man-in-the-middle packet filter to monitor and manipulate live TCP/UDP connections on a local area network. The project provides specialized capabilities for traffic redirection via ARP cache poisoning, DHCP server spoofing, ICMP redirects, and switch port stealing. It also enables the emulation of rogue services and the decryption of SSH1 session streams by substituting public keys. Additional capabilities i

FakeNet-NG - Next Generation Dynamic Network Analysis Tool

integrating bro into yara

Malcolm is a powerful, easily deployable network traffic analysis tool suite for full packet capture artifacts (PCAP files), Zeek logs and Suricata alerts.

Replay HTTP and HTTPS requests from a PCAP based on TLS Master Secrets.

ngrep is like GNU grep applied to the network layer. It's a PCAP-based tool that allows you to specify an extended regular or hexadecimal expression to match against data payloads of packets. It understands many kinds of protocols, including IPv4/6, TCP, UDP, ICMPv4/6, IGMP and Raw, across a wide variety of interface types, and understands BPF filter logic in the same fashion as more common packet sniffing tools, such as tcpdump and snoop.

Process HTTP Pcaps With YARA

Ipsumdump and other programs for command-line network trace manipulation.

A portable framework for low-level network packet construction

Laika BOSS: Object Scanning System

Visualize network topologies and collect graph statistics based on pcap files

Yara is awesome, but sometimes you need to manipulate the data streams you're scanning in different ways.

NFStream: a Flexible Network Data Analysis Framework.

A package for converting PCAP files to parquet format.

Network Analysis Tool

A high level C++ network packet sniffing and crafting library

Netflow processing tools