Awesome GitHub RepositoriesNetwork Forensics

Moloch is a full packet capture system and network forensics platform designed for large scale network traffic recording and indexing. It functions as a distributed packet indexer that stores raw data in PCAP format for deep packet analysis and security investigations. The system distinguishes itself through a decentralized architecture that distributes capture and viewing components across multiple nodes to handle high volumes of network traffic. It utilizes a web-based management interface for browsing network sessions and provides a programmable API for exporting captured traffic and metad

Arkime is a distributed packet analysis platform and full packet capture system designed for recording raw network traffic, indexing metadata, and performing network forensics. It functions as a network traffic indexer and security tool that enables the monitoring, querying, and browsing of large-scale network traffic across multi-cluster architectures. The platform distinguishes itself through its ability to manage distributed capture clusters from a centralized administrative dashboard. It integrates external data feeds with internal traffic logs to identify known threats and provides a pro

gopacket is a Go library for live packet capture and multi-layer protocol decoding. It provides a framework for parsing raw network bytes into structured protocol layers, enabling inspection and analysis of network traffic directly from interfaces or packet capture files. The library distinguishes itself through a layered protocol stack that organizes decoders as independent, composable layers, and an interface-based decoder registry that supports extensible custom protocol development. It offers zero-copy packet decoding for high-throughput parsing, stream-based TCP reassembly to reconstruct

Dshell 是一个网络取证分析框架和流量处理器，专为 IPv4 和 IPv6 流量的深度包检测而设计。它作为一个可扩展的取证插件系统，能够捕获、检查和分析网络数据，以识别安全异常并重构通信流。 该系统采用基于插件的处理引擎，支持自定义插件开发和插件链式调用。这种模块化架构使得创建专门的分析流水线成为可能，网络数据可按顺序通过一系列处理单元进行多步分析。 该框架涵盖了广泛的取证功能，包括实时流量监控、网络流重组以及通过外部参考数据库进行 IP 地理位置映射。为处理海量数据，引擎采用并行数据处理，将任务分配到多个系统进程中。处理后的分析结果可通过专门的输出处理器导出为多种结构化文件格式。

:star: :star: Distributed tcpdump for cloud native environments :star: :star:

Stenographer is a packet capture solution which aims to quickly spool all packets to disk, then provide simple, fast access to subsets of those packets. Discussion/announcements at stenographer@googlegroups.com

TCP/IP packet demultiplexer. Download from: