Malcolm

Malcolm Malcolm ist eine leistungsstarke Suite von Netzwerkverkehrsanalyse-Tools, die mit den folgenden Zielen entwickelt wurde: Einfach zu bedienen – Malcolm akzeptiert Netzwerkverkehrsdaten in Form von vollständigen Paketaufzeichnungen PCAP-Dateien, Zeek-Protokollen und Suricata-Warnungen. Dies...

scapy

Scapy Scapy ist ein leistungsstarkes, auf Python basierendes interaktives Paketmanipulationsprogramm und eine Bibliothek. Es kann Pakete einer Vielzahl von Protokollen erstellen oder decodieren, sie auf das Netzwerk senden, erfassen, in pcap-Dateien speichern oder daraus lesen, Anfragen und...

sniffles

Sniffles--Packet Capture Generator for IDS and Regular Expression Evaluation Sniffles is a tool for creating packet captures that will test IDS that use fixed patterns or regular expressions for detecting suspicious behavior. Sniffles works very simply. It takes a set of regular expressions or...

termshark

Termshark A terminal user-interface for tshark, inspired by Wireshark. V2.4 is out now with packet search and profiles for colors and columns! See theChangeLog. If you're debugging on a remote machine with a large pcap and no desire to scp it back to your desktop, termshark can help! Features Rea...

hassh

"HASSH" - a Profiling Method for SSH Clients and Servers. "HASSH" is a network fingerprinting standard which can be used to identify specific Client and Server SSH implementations. The fingerprints can be easily stored, searched and shared in the form of an MD5 fingerprint. HASSH was invented at...

wireshark-forensics-plugin

wireshark-forensics-plugin Wireshark is the most widely used network traffic analyzer. It is an important tool for both live traffic analysis & forensic analysis for forensic/malware analysts. Even though Wireshark provides incredibly powerful functionalities for protocol parsing & filtering, it...

Baskerville

Baskerville Legge da file o interfacce e scrive su file nella directory specificata con nome file basato su unixtime del primo pacchetto in ogni file. Alcuni protocolli possono essere soppressi, nel qual caso solo i primi N pacchetti vengono registrati su disco. Ciò riduce l'uso del disco salvand...

wireshark: Buffer Over-read in Wireshark

A flaw was found in the RF4CE Profile dissector in Wireshark. This issue occurs when malformed packets are decoded from a pcap file or the network, causing a buffer over-read, resulting in a denial of service...

CVE-2026-6525

A flaw was found in the IEEE 802.11 dissector in Wireshark. This issue occurs when malformed packets are decoded from a pcap file or the network, causing a NULL pointer dereference, resulting in a denial of service. Mitigation If the IEEE 802.11 protocol dissector is not being used, it can be...

EUVD-2019-17771

Malware in sbrugna...

EUVD-2016-5941

Malware in sbrugna...

Appneta Tcpreplay 安全漏洞

Appneta Tcpreplay is an open source network message playback utility from Appneta. A security vulnerability exists in Appneta Tcpreplay version 4.5.1, which stems from the tcpliveplay utility incorrectly handling memory when processing specially crafted pcap files, which could result in a denial ...

SUSE-SU-2025:0590-1 Security update for netty, netty-tcnative

This update for netty, netty-tcnative fixes the following issues: - CVE-2025-24970: incorrect validation of packets by SslHandler can lead to a native crash. bsc1237037 - CVE-2025-25193: unsafe reading of environment files can lead to an application crash. bsc1237038 Update to netty version 4.1.1...

SUSE CVE-2024-2397

Due to a bug in packet data buffers management, the PPP printer in tcpdump can enter an infinite loop when reading a crafted DLTPPPSERIAL .pcap savefile. This problem does not affect any tcpdump release, but it affected the git master branch from 2023-06-05 to 2024-03-21...

wireshark: XRA dissector infinite loop

A flaw was found in the XRA dissector of Wireshark. This issue occurs when decoding malformed packets from a pcap file or from the network, causing an infinite loop, resulting in a denial of service...

NetworkAssessment - With Wireshark Or TCPdump, You Can Determine Whether There Is Harmful Activity On Your Network Traffic That You Have Recorded On The Network You Monitor

The Network Compromise Assessment Tool is designed to analyze pcap files to detect potential suspicious network traffic. This tool focuses on spotting abnormal activities in the network traffic and searching for suspicious keywords. DNS Tunneling Detection : Identifies potential covert...

TrafficWatch - TrafficWatch, A Packet Sniffer Tool, Allows You To Monitor And Analyze Network Traffic From PCAP Files

TrafficWatch, a packet sniffer tool, allows you to monitor and analyze network traffic from PCAP files. It provides insights into various network protocols and can help with network troubleshooting, security analysis, and more. Protocol-specific packet analysis for ARP, ICMP, TCP, UDP, DNS, DHCP,...

PT-2023-9850 · Tcpreplay +3 · Tcpreplay +3

Name of the Vulnerable Software and Affected Versions: TCPReplay version 4.4.3 Description: The issue allows a remote attacker to cause a denial of service via the read hexstring function. This is related to a pointer dereference issue in the tcprewrite editor of PCAP files in the Tcpreplay...

BruteShark - Network Analysis Tool

BruteShark is a Network Forensic Analysis Tool NFAT that performs deep processing and inspection of network traffic mainly PCAP files, but it also capable of directly live capturing from a network interface. It includes: password extracting, building a network map, reconstruct TCP sessions, extra...

tcpdump: Buffer over-read in rsvp_obj_print() function in print-rsvp.c

An out-of-bounds read vulnerability was discovered in tcpdump while printing RSVP packets captured in a pcap file or coming from the network. A remote attacker may abuse this flaw by sending specially crafted packets that, when printed, would trigger the flaw and crash the application...