
wireshark
Capture and analyze network traffic with deep packet inspection, protocol decoding across hundreds of protocols, and capture-file support for…

Capture and analyze network traffic with deep packet inspection, protocol decoding across hundreds of protocols, and capture-file support for…

Dshell is a network forensic analysis framework.

IOC and YARA-based scanner for detecting indicators of compromise via file name regex, YARA signatures, hash matching, and C2 back-connect checks on…

JA4+ is a suite of network fingerprinting standards

Breakdown of a c2-network of chinese beamers - SilentSDK-Analysis

Multiplatform C++ library for high-performance network packet capture, parsing, crafting, and analysis. Supports libpcap, DPDK, AF_XDP, PF_RING, and…

PowerShell script that monitors Windows DNS traffic via pktmon to detect poisoning, spoofing, rogue resolver responses, and gateway MAC changes,…

Python-based interactive packet manipulation library for forging, decoding, sending, capturing, and analyzing network packets across a wide range of…

Malware Configuration And Payload Extraction

A network sniffer that logs all DNS server replies for use in a passive DNS setup

A Swiss army knife for your daily Linux network plumbing.

SO-CRATES: Security Onion Containerized Rapid Analysis of Threats, Evil, and Sus!

A terminal UI for tshark, inspired by Wireshark

Hands-on DFIR challenges covering digital forensics, incident response, malware analysis, and threat hunting with CTF-style flags and real-world…


FATT /fingerprintAllTheThings - a pyshark based script for extracting network metadata and fingerprints from pcap files and live network traffic

Visualize network topologies and collect graph statistics based on pcap files

Arkime is an open source, large scale, full packet capturing, indexing, and database system.