Open-source alternatives to Cisco Joy

A multi-threading tool to sniff TCP flow statistics and embedded HTTP headers from PCAP file. Each TCP flow carrying HTTP is exported to text file in json format.

A simple, cross-platform utility to classify packets into flows using only the essential 4-tuple.

Potiron - Normalize, Index and Visualize Network Capture

Packet monster (っ‘-’)╮=͟͟͞͞◒ ヽ( '-'ヽ) TUI tool for sending packets of arbitrary input and monitoring packets on any network interfaces (default: eth0). Windows/macOS/Linux

Moved to https://codeberg.org/DNS-OARC/PacketQ

A framework for secure and scalable network traffic analysis - https://netcap.io

Ettercap is a network utility tool used for ARP spoofing, packet filtering, traffic interception, passive scanning, and DHCP hijacking. It functions as a network traffic interceptor and man-in-the-middle packet filter to monitor and manipulate live TCP/UDP connections on a local area network. The project provides specialized capabilities for traffic redirection via ARP cache poisoning, DHCP server spoofing, ICMP redirects, and switch port stealing. It also enables the emulation of rogue services and the decryption of SSH1 session streams by substituting public keys. Additional capabilities i

Stenographer is a packet capture solution which aims to quickly spool all packets to disk, then provide simple, fast access to subsets of those packets. Discussion/announcements at stenographer@googlegroups.com

Process HTTP Pcaps With YARA

Ipsumdump and other programs for command-line network trace manipulation.

A portable framework for low-level network packet construction

Protocol Analysis/Decoder Framework

Yara is awesome, but sometimes you need to manipulate the data streams you're scanning in different ways.

NFStream: a Flexible Network Data Analysis Framework.

A package for converting PCAP files to parquet format.

ntopng is a web-based network traffic monitoring tool and flow data aggregator. It functions as a network security monitor, an SNMP network management system, and an industrial protocol analyzer for OT and SCADA environments. The system provides specialized inspection for industrial protocols such as Modbus, DNP3, and IEC 60870. It distinguishes itself through behavioral threat detection, encrypted traffic analysis via handshake fingerprinting, and the ability to identify hardware and operating systems using DHCP and MAC address patterns. Its broader capabilities include real-time traffic an

Network Analysis Tool

Malicious HTTP traffic explorer

A high level C++ network packet sniffing and crafting library

Netflow processing tools