scapy

Scapy Scapy 是一个基于 Python 的强大交互式数据包操作程序与库。 它能够伪造或解码大量协议的数据包，在网络上发送、捕获，使用 pcap 文件存储或读取，匹配请求与回复，以及更多功能。它设计为通过使用可工作的默认值来实现快速数据包原型开发。 它可以轻松处理大多数经典任务，例如扫描、路由追踪、探测、单元测试、攻击或网络发现（它可以替代 hping、85% 的 nmap、arpspoof、arp-sk、arping、tcpdump、wireshark、p0f 等）。它还在许多其他特定任务中表现出色，而这些任务大多数其他工具无法处理，例如发送无效帧、注入自定义的 802.11...

termshark

Termshark A terminal user-interface for tshark, inspired by Wireshark. V2.4 is out now with packet search and profiles for colors and columns! See theChangeLog. If you're debugging on a remote machine with a large pcap and no desire to scp it back to your desktop, termshark can help! Features Rea...

Malcolm

Malcolm Malcolm 是一个强大的网络流量分析工具套件，旨在实现以下目标： 易于使用 – Malcolm 接受全包捕获（PCAP）文件、Zeek 日志和 Suricata 警报形式的网络流量数据。这些工件可以通过简单的基于浏览器的界面上传，或使用轻量级转发器被动捕获并实时转发给 Malcolm。无论哪种方式，数据都会被自动标准化、丰富并关联以进行分析。 强大的流量分析 – 通过两个直观的界面提供网络通信的可见性：OpenSearch Dashboards（一种灵活的数据可视化插件，提供数十个预置仪表板，可一目了然地查看网络协议）和...

sniffles

Sniffles--Packet Capture Generator for IDS and Regular Expression Evaluation Sniffles is a tool for creating packet captures that will test IDS that use fixed patterns or regular expressions for detecting suspicious behavior. Sniffles works very simply. It takes a set of regular expressions or...

wireshark-forensics-plugin

wireshark-forensics-plugin Wireshark is the most widely used network traffic analyzer. It is an important tool for both live traffic analysis & forensic analysis for forensic/malware analysts. Even though Wireshark provides incredibly powerful functionalities for protocol parsing & filtering, it...

Baskerville

Baskerville Reads from files or interface and writes to files in specified directory with filename based on unixtime of first packet in each file. Certain protocols can be suppressed, in which case only the first N packets are recorded to disk. This reduces disk usage saving data which is of litt...

hassh

"HASSH" - a Profiling Method for SSH Clients and Servers. NOTE: This Corelight repository was created so that it can be actively maintained, as per a request from Salesforce whose original repository is not being maintained. "HASSH" is a network fingerprinting standard which can be used to identi...

wireshark: Buffer Over-read in Wireshark

A flaw was found in the RF4CE Profile dissector in Wireshark. This issue occurs when malformed packets are decoded from a pcap file or the network, causing a buffer over-read, resulting in a denial of service...

CVE-2026-6525

A flaw was found in the IEEE 802.11 dissector in Wireshark. This issue occurs when malformed packets are decoded from a pcap file or the network, causing a NULL pointer dereference, resulting in a denial of service. Mitigation If the IEEE 802.11 protocol dissector is not being used, it can be...

EUVD-2016-5941

Malware in sbrugna...

EUVD-2019-17771

Malware in sbrugna...

Appneta Tcpreplay 安全漏洞

Appneta Tcpreplay is an open source network message playback utility from Appneta. A security vulnerability exists in Appneta Tcpreplay version 4.5.1, which stems from the tcpliveplay utility incorrectly handling memory when processing specially crafted pcap files, which could result in a denial ...

SUSE-SU-2025:0590-1 Security update for netty, netty-tcnative

This update for netty, netty-tcnative fixes the following issues: - CVE-2025-24970: incorrect validation of packets by SslHandler can lead to a native crash. bsc1237037 - CVE-2025-25193: unsafe reading of environment files can lead to an application crash. bsc1237038 Update to netty version 4.1.1...

SUSE CVE-2024-2397

Due to a bug in packet data buffers management, the PPP printer in tcpdump can enter an infinite loop when reading a crafted DLTPPPSERIAL .pcap savefile. This problem does not affect any tcpdump release, but it affected the git master branch from 2023-06-05 to 2024-03-21...

wireshark: XRA dissector infinite loop

A flaw was found in the XRA dissector of Wireshark. This issue occurs when decoding malformed packets from a pcap file or from the network, causing an infinite loop, resulting in a denial of service...

NetworkAssessment - With Wireshark Or TCPdump, You Can Determine Whether There Is Harmful Activity On Your Network Traffic That You Have Recorded On The Network You Monitor

The Network Compromise Assessment Tool is designed to analyze pcap files to detect potential suspicious network traffic. This tool focuses on spotting abnormal activities in the network traffic and searching for suspicious keywords. DNS Tunneling Detection : Identifies potential covert...

TrafficWatch - TrafficWatch, A Packet Sniffer Tool, Allows You To Monitor And Analyze Network Traffic From PCAP Files

TrafficWatch, a packet sniffer tool, allows you to monitor and analyze network traffic from PCAP files. It provides insights into various network protocols and can help with network troubleshooting, security analysis, and more. Protocol-specific packet analysis for ARP, ICMP, TCP, UDP, DNS, DHCP,...

PT-2023-9850 · Tcpreplay +3 · Tcpreplay +3

Name of the Vulnerable Software and Affected Versions: TCPReplay version 4.4.3 Description: The issue allows a remote attacker to cause a denial of service via the read hexstring function. This is related to a pointer dereference issue in the tcprewrite editor of PCAP files in the Tcpreplay...

BruteShark - Network Analysis Tool

BruteShark is a Network Forensic Analysis Tool NFAT that performs deep processing and inspection of network traffic mainly PCAP files, but it also capable of directly live capturing from a network interface. It includes: password extracting, building a network map, reconstruct TCP sessions, extra...

tcpdump: Buffer over-read in rsvp_obj_print() function in print-rsvp.c

An out-of-bounds read vulnerability was discovered in tcpdump while printing RSVP packets captured in a pcap file or coming from the network. A remote attacker may abuse this flaw by sending specially crafted packets that, when printed, would trigger the flaw and crash the application...