#1Tools for analyzing network traffic and communication logs to investigate security incidents.
Kitploit recommended
eciavatta/caronteA tool to analyze the network flow during attack/defence Capture the Flag competitions
proxymanapp/tcpviewerThe best-in-class macOS app to See every packet clearly on your Mac. Alternative to Wireshark
1ultimat3/pcapvizVisualize network topologies and collect graph statistics based on pcap files
orlikoski/skadiCollect, Process, and Hunt with host based data from MacOS, Windows, and Linux
tsale/awesome-dfir-skillsA curated collection of DFIR skills and workflows for InfoSec practitioners.
detuxsandbox/detuxThe Multiplatform Linux Sandbox
benjeems/packetstriderA network packet forensics tool for SSH
fox-it/dissect.cobaltstrikePython library for dissecting and parsing Cobalt Strike related data such as Beacon payloads and Malleable C2 Profiles
cyb3r-monk/rita-jImplementation of RITA (Real Intelligence Threat Analytics) in Jupyter Notebook with improved scoring algorithm.
vignesh07/babysharkFlows-first PCAP TUI (case files, gorgeous UX). Do do do do.
z4l4mi/ipgeoExtracts IP addresses from pcap/pcapng network traffic files and generates CSV reports with geolocation, ISP, and organizational details for each IP.
awakecoding/wireshark-rdpWireshark RDP resources
azizaltuntas/network-analysis-toolsPcap (capture file) Analysis Toolkit(v.1)
vikwin/pcapfex'Packet Capture Forensic Evidence eXtractor' is a tool that finds and extracts files from packet capture files
rjbhide/wireshark-forensics-pluginWireshark plugin that correlates network traffic with threat intelligence, asset tags, and vulnerability data to accelerate forensic analysis of PCAP…
anssi-fr/dfir4vspherePowershell module for VMWare vSphere forensics
mspicer/pcapinatorA tool for processing a lot of pcaps using tshark
nccgroup/pcap-burpPcap importer for Burp
