sniffles

Sniffles--Packet Capture Generator for IDS and Regular Expression Evaluation Sniffles is a tool for creating packet captures that will test IDS that use fixed patterns or regular expressions for detecting suspicious behavior. Sniffles works very simply. It takes a set of regular expressions or...

scapy

Scapy Scapyは、強力なPythonベースの対話型パケット操作プログラムおよびライブラリです。 幅広いプロトコルのパケットを偽造またはデコードし、ネットワーク上に送信し、キャプチャし、pcapファイルを使用して保存または読み取り、リクエストと応答を照合するなど、多くの機能を備えています。動作するデフォルト値を使用することで、迅速なパケットプロトタイピングを可能にするように設計されています。...

termshark

Termshark A terminal user-interface for tshark, inspired by Wireshark. V2.4 is out now with packet search and profiles for colors and columns! See theChangeLog. If you're debugging on a remote machine with a large pcap and no desire to scp it back to your desktop, termshark can help! Features Rea...

hassh

"HASSH" - a Profiling Method for SSH Clients and Servers. NOTE: This Corelight repository was created so that it can be actively maintained, as per a request from Salesforce whose original repository is not being maintained. "HASSH" is a network fingerprinting standard which can be used to identi...

Malcolm

Malcolm Malcolm 是一个强大的网络流量分析工具套件，旨在实现以下目标： 易于使用 – Malcolm 接受全包捕获（PCAP）文件、Zeek 日志和 Suricata 警报形式的网络流量数据。这些工件可以通过简单的基于浏览器的界面上传，或使用轻量级转发器被动捕获并实时转发给 Malcolm。无论哪种方式，数据都会被自动标准化、丰富并关联以进行分析。 强大的流量分析 – 通过两个直观的界面提供网络通信的可见性：OpenSearch Dashboards（一种灵活的数据可视化插件，提供数十个预置仪表板，可一目了然地查看网络协议）和...

wireshark-forensics-plugin

wireshark-forensics-plugin Wireshark is the most widely used network traffic analyzer. It is an important tool for both live traffic analysis & forensic analysis for forensic/malware analysts. Even though Wireshark provides incredibly powerful functionalities for protocol parsing & filtering, it...

Baskerville

Baskerville 从文件或接口读取数据，并写入指定目录中的文件，文件名基于 每个文件中第一个数据包的 Unix 时间戳。 某些协议可以被抑制，在这种情况下 只有前 N 个数据包会被记录到磁盘。 这减少了磁盘占用，保存了 价值不大的数据，如 TLS 或 VPN。 依赖 libtrace libflowmanager libprotoident 这些都可以从 http://research.wand.net.nz/software/ 下载 建议调用方式 baskerville -d pcapfile:/data/pcap -f 100M -l 10 -s HTTPS,OpenVPN...

wireshark: Buffer Over-read in Wireshark

A flaw was found in the RF4CE Profile dissector in Wireshark. This issue occurs when malformed packets are decoded from a pcap file or the network, causing a buffer over-read, resulting in a denial of service...

CVE-2026-6525

A flaw was found in the IEEE 802.11 dissector in Wireshark. This issue occurs when malformed packets are decoded from a pcap file or the network, causing a NULL pointer dereference, resulting in a denial of service. Mitigation If the IEEE 802.11 protocol dissector is not being used, it can be...

EUVD-2019-17771

Malware in sbrugna...

EUVD-2016-5941

Malware in sbrugna...

Appneta Tcpreplay 安全漏洞

Appneta Tcpreplay is an open source network message playback utility from Appneta. A security vulnerability exists in Appneta Tcpreplay version 4.5.1, which stems from the tcpliveplay utility incorrectly handling memory when processing specially crafted pcap files, which could result in a denial ...

SUSE-SU-2025:0590-1 Security update for netty, netty-tcnative

This update for netty, netty-tcnative fixes the following issues: - CVE-2025-24970: incorrect validation of packets by SslHandler can lead to a native crash. bsc1237037 - CVE-2025-25193: unsafe reading of environment files can lead to an application crash. bsc1237038 Update to netty version 4.1.1...

SUSE CVE-2024-2397

Due to a bug in packet data buffers management, the PPP printer in tcpdump can enter an infinite loop when reading a crafted DLTPPPSERIAL .pcap savefile. This problem does not affect any tcpdump release, but it affected the git master branch from 2023-06-05 to 2024-03-21...

wireshark: XRA dissector infinite loop

A flaw was found in the XRA dissector of Wireshark. This issue occurs when decoding malformed packets from a pcap file or from the network, causing an infinite loop, resulting in a denial of service...

NetworkAssessment - With Wireshark Or TCPdump, You Can Determine Whether There Is Harmful Activity On Your Network Traffic That You Have Recorded On The Network You Monitor

The Network Compromise Assessment Tool is designed to analyze pcap files to detect potential suspicious network traffic. This tool focuses on spotting abnormal activities in the network traffic and searching for suspicious keywords. DNS Tunneling Detection : Identifies potential covert...

TrafficWatch - TrafficWatch, A Packet Sniffer Tool, Allows You To Monitor And Analyze Network Traffic From PCAP Files

TrafficWatch, a packet sniffer tool, allows you to monitor and analyze network traffic from PCAP files. It provides insights into various network protocols and can help with network troubleshooting, security analysis, and more. Protocol-specific packet analysis for ARP, ICMP, TCP, UDP, DNS, DHCP,...

PT-2023-9850 · Tcpreplay +3 · Tcpreplay +3

Name of the Vulnerable Software and Affected Versions: TCPReplay version 4.4.3 Description: The issue allows a remote attacker to cause a denial of service via the read hexstring function. This is related to a pointer dereference issue in the tcprewrite editor of PCAP files in the Tcpreplay...

BruteShark - Network Analysis Tool

BruteShark is a Network Forensic Analysis Tool NFAT that performs deep processing and inspection of network traffic mainly PCAP files, but it also capable of directly live capturing from a network interface. It includes: password extracting, building a network map, reconstruct TCP sessions, extra...

tcpdump: Buffer over-read in rsvp_obj_print() function in print-rsvp.c

An out-of-bounds read vulnerability was discovered in tcpdump while printing RSVP packets captured in a pcap file or coming from the network. A remote attacker may abuse this flaw by sending specially crafted packets that, when printed, would trigger the flaw and crash the application...