
Dshell
Dshell is a network forensic analysis framework.

Dshell is a network forensic analysis framework.

Multiplatform C++ library for high-performance network packet capture, parsing, crafting, and analysis. Supports libpcap, DPDK, AF_XDP, PF_RING, and…

A network sniffer that logs all DNS server replies for use in a passive DNS setup

Arkime is an open source, large scale, full packet capturing, indexing, and database system.


A tool to assist with network-based hunting for GRU's Drovorub malware c2

Offline-first network investigation and response platform for Windows. Turns a pcap or live capture into a full forensic verdict — attack story,…

It was developed to speed up the processes of SOC Analysts during analysis

This framework combines a set of existing open source tools into an integrated package that automates the forensics investigation process. It is able…

The best-in-class macOS app to See every packet clearly on your Mac. Alternative to Wireshark

Packet capture artifacts of plex2shell exploitation against Plex, including lab and in-the-wild traffic, for building and validating detection…

Selective protocol extractor from PCAPs or interfaces

A Zeek STUN protocol analyzer based on Spicy.

Collection of forensic tools

Public honeypot datasets and observation reports with HTTP/TLS fingerprint data (JA3/JA4), pseudonymized source IPs, and exploitation attempt…

Stenographer is a packet capture solution which aims to quickly spool all packets to disk, then provide simple, fast access to subsets of those…

PacketSifter is a tool/script that is designed to aid analysts in sifting through a packet capture (pcap) to find noteworthy traffic. Packetsifter…

A tool to analyze the network flow during attack/defence Capture the Flag competitions