USArmyResearchLab/Dshell
Dshell
Dshell is a network forensic analysis framework and traffic processor designed for the deep packet inspection of IPv4 and IPv6 traffic. It functions as an extensible forensic plugin system that captures, inspects, and analyzes network data to identify security anomalies and reconstruct communication streams.
The system utilizes a plugin-based processing engine that allows for custom plugin development and plugin chaining. This modular architecture enables the creation of specialized analysis pipelines where network data is passed through a sequence of processing units for multi-step analysis.
The framework covers a broad range of forensic capabilities, including real-time traffic monitoring, network stream reassembly, and IP geolocation mapping via external reference databases. To handle high volumes of data, the engine employs parallel data processing by distributing tasks across multiple system processes. Processed analysis results can be exported into various structured file formats through specialized output handlers.
Features
- Packet Analysis Tools - Provides a utility for deep packet inspection and analysis of captured IPv4 and IPv6 traffic.
- Forensic Pipeline Extensions - Implements a modular framework for building and chaining custom forensic analysis plugins.
- Live Capture Libraries - Integrates directly with network interfaces to capture and process packets in real time.
- Multi-Stage Analysis Pipelines - Utilizes a sequence of modular processing stages to transform raw network packets into structural insights.
- Plugin Development Frameworks - Offers a structured framework for developing custom analysis modules to extend the processing engine.
- Stream Reassembly Processes - Provides the capability to reconstruct fragmented network traffic into coherent data streams for forensic examination.
- Live Traffic Analysis - Enables real-time processing of network packets by running analysis plugins directly on a network interface.
- Network Traffic Processors - Processes network traffic flows programmatically to reassemble streams and export forensic data.
- Packet Capture Analysis - Scans and processes stored packet capture files to identify security anomalies and patterns.
- TCP Stream Reassembly - Reconstructs fragmented network traffic into coherent bidirectional conversations by tracking sequence numbers.
- Forensic Frameworks - Provides a modular architecture designed for digital forensic analysis and network traffic ingestion.
- Pipeline Plugins - Implements a modular processing engine where network data is passed through a sequence of specialized pipeline plugins.
- Packet Inspection - Performs deep analysis of network packets and protocol headers using targeted inspection plugins.
- Network Traffic Monitors - Monitors live network traffic directly from an interface to detect security patterns as they occur.
- IP Geolocation - Maps IP addresses to physical locations and country codes to enrich traffic analysis metadata.
- Parallel Processing - Distributes packet capture and analysis tasks across multiple system processes to increase overall throughput.
- IP Geographic Mapping - Resolves network addresses to geographic locations by querying external IP mapping databases.
- Packet Processing Frameworks - Provides a programmable framework for building and chaining custom packet processing plugins.
- Concurrent Packet Processing - Handles high volumes of network data through concurrent processing across multiple system execution threads.
- Multi-Process Task Distribution - Distributes packet capture and analysis workloads across multiple system processes to increase throughput.
- Network Forensics - Network forensic analysis framework.
- Automation And Infrastructure - Extensible framework for rapid network forensic analysis and packet dissection.
- Network Security - Extensible framework for network forensic packet analysis.
- Protocol Analyzers - Framework for network forensic analysis.
