#1Tools for analyzing network traffic and communication logs to investigate security incidents.
Kitploit recommended
kiminewt/pysharkPython wrapper for tshark, allowing python packet parsing using wireshark dissectors
0x4d31/fattFATT /fingerprintAllTheThings - a pyshark based script for extracting network metadata and fingerprints from pcap files and live network traffic
gosecure/pyrdpRDP monster-in-the-middle (mitm) and library for Python with the ability to watch connections live or after the fact
zeek/zeekZeek is a powerful network analysis framework that is much different from the typical IDS you may know.
trinitor/netstat2neo4jcreate cypher create statements for neo4j out of netstat files from multiple machines
mspicer/pcapinatorA tool for processing a lot of pcaps using tshark
microsoft/etl2pcapngUtility that converts an .etl file containing a Windows network packet capture into .pcapng format.
agent-hellboy/ltmltm is a machine-history debugger for Linux. It records process, file, network, memory, and block-I/O metadata via eBPF, then lets you query the…
insane-forensics/drovorub-huntA tool to assist with network-based hunting for GRU's Drovorub malware c2
srixivas/pcapxray❄️ PcapXray - A Network Forensics Tool - To visualize a Packet Capture offline as a Network Diagram including device identification, highlight…
benjeems/packetstriderA network packet forensics tool for SSH
eciavatta/caronteA tool to analyze the network flow during attack/defence Capture the Flag competitions
bee-san/pywhat🐸 Identify anything. pyWhat easily lets you identify emails, IP addresses, and more. Feed it a .pcap file or some text and it'll tell you what it…
packetsifter/packetsiftertoolPacketSifter is a tool/script that is designed to aid analysts in sifting through a packet capture (pcap) to find noteworthy traffic. Packetsifter…
misp/misp-wiresharkLua plugin to extract data from Wireshark and convert it into MISP format
cyb3rmx/qu1cksc0peAll-in-One malware analysis tool.
z4l4mi/ipgeoExtracts IP addresses from pcap/pcapng network traffic files and generates CSV reports with geolocation, ISP, and organizational details for each IP.
