#1Tools for analyzing network traffic and communication logs to investigate security incidents.
Kitploit recommended
wireshark/wiresharkWireshark's official code repository. You can keep the releases coming by donating at https://wiresharkfoundation.org/donate/.
ntop/ntopngWeb-based Traffic and Cybersecurity Network Traffic Monitoring
wireshark/wiresharkCapture and analyze network traffic with deep packet inspection, protocol decoding across hundreds of protocols, and capture-file support for…
dougburks/so-cratesSO-CRATES: Security Onion Containerized Rapid Analysis of Threats, Evil, and Sus!
arkime/arkimeArkime is an open source, large scale, full packet capturing, indexing, and database system.
hasamba/dfir-companionDFIR forensics companion server + capture extension
frankwxu/digital-forensics-labFree hands-on digital forensics labs for students and faculty
secdev/scapyPython-based interactive packet manipulation library for forging, decoding, sending, capturing, and analyzing network packets across a wide range of…
stamparm/maltrailReal-time malicious traffic detection system using public blacklists, static malware trails, and heuristic analysis to identify threats across DNS,…
seladb/pcapplusplusMultiplatform C++ library for high-performance network packet capture, parsing, crafting, and analysis. Supports libpcap, DPDK, AF_XDP, PF_RING, and…
sepinf-inc/ipedIPED Digital Forensic Tool. It is an open source software that can be used to process and analyze digital evidence, often seized at crime scenes by…
alzeaty1/security-writeupsCTF writeups and teaching scripts for web security, bug bounty techniques, and network forensics, with blank-value versions for active practice.
p1sec/qcsuperQCSuper is a tool communicating with Qualcomm-based phones and modems, allowing to capture raw 2G/3G/4G radio frames, among other things.
zeek/zeekZeek is a powerful network analysis framework that is much different from the typical IDS you may know.
google/grrRemote live forensics and incident response framework with Python agent for collecting forensic data from endpoints, including memory, disk, and…
prox0959/omnitriageZero-dependency, sub-second Windows live digital forensics & incident response (DFIR) triage engine for USB responders.
google/timesketchCollaborative forensic timeline analysis platform for ingesting, searching, and annotating event logs to support incident response and DFIR…
