#1Tools for analyzing network traffic and communication logs to investigate security incidents.
Kitploit recommended
stamparm/maltrailReal-time malicious traffic detection system using public blacklists, static malware trails, and heuristic analysis to identify threats across DNS,…
zeek/zeekZeek is a powerful network analysis framework that is much different from the typical IDS you may know.
oisf/suricataOpen-source network IDS/IPS/NSM engine for real-time traffic inspection, intrusion detection and prevention, protocol analysis, and rule-based threat…
security-onion-solutions/securityonionOpen-source security monitoring platform for threat hunting, intrusion detection, log management, incident response, and endpoint visibility with…
usarmyresearchlab/dshellDshell is a network forensic analysis framework.
bert-janp/incident-response-powershellPowerShell-based incident response toolkit that collects 25+ forensic artifacts (processes, network connections, registry, browser history) and…
wireshark/wiresharkCapture and analyze network traffic with deep packet inspection, protocol decoding across hundreds of protocols, and capture-file support for…
microsoft/etl2pcapngUtility that converts an .etl file containing a Windows network packet capture into .pcapng format.
neo23x0/lokiIOC and YARA-based scanner for detecting indicators of compromise via file name regex, YARA signatures, hash matching, and C2 back-connect checks on…
google/grrRemote live forensics and incident response framework with Python agent for collecting forensic data from endpoints, including memory, disk, and…
gamelinux/passivednsA network sniffer that logs all DNS server replies for use in a passive DNS setup
dougburks/so-cratesSO-CRATES: Security Onion Containerized Rapid Analysis of Threats, Evil, and Sus!
gcla/termsharkA terminal UI for tshark, inspired by Wireshark
the-tcpdump-group/tcpdumpthe TCPdump network dissector
seladb/pcapplusplusMultiplatform C++ library for high-performance network packet capture, parsing, crafting, and analysis. Supports libpcap, DPDK, AF_XDP, PF_RING, and…
netsniff-ng/netsniff-ngA Swiss army knife for your daily Linux network plumbing.
1ultimat3/pcapvizVisualize network topologies and collect graph statistics based on pcap files
