netsniff-ng

////////////////////////////////////////////////////////////////////////////// netsniff-ng - the packet sniffing beast \\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\ . . netsniff-ng is a free, performant / Linux network analyzer and .' '. networking toolkit. If you...

pypacker

Información general Este es Pypacker: la biblioteca de manipulación de paquetes de bajo nivel más rápida y simple para Python. Vea los ejemplos a continuación para ver qué puede hacer con ella. Si desea apoyar este proyecto puede a través de PayPal. Qué puedes hacer con Pypacker Crear paquetes...

Malcolm

Malcolm Malcolm 是一套强大的网络流量分析工具套件，其设计目标如下： 易于使用 – Malcolm 接受全流量数据包捕获（PCAP）文件、Zeek 日志和 Suricata 告警等形式的数据。这些内容可通过简单的浏览器界面上传，或使用轻量级转发器进行被动实时捕获并转发至 Malcolm。无论采用哪种方式，数据都会被自动归一化、丰富化并关联以进行分析。 强大的流量分析能力 – 通过两个直观界面提供网络通信可见性：OpenSearch Dashboards（一个灵活的数据可视化插件，内置数十个预建仪表板，可概览网络协议）和...

tcpreplay

Tcpreplay Tcpreplay is a suite of GPLv3 licensed utilities for UNIX and Windows under Cygwin for editing and replaying network traffic previously captured by tools like tcpdump and Wireshark. It classifies traffic as client or server, rewrites Layer 2/3/4 headers, and replays it back onto the...

pacmap

pacmap PacMap is a graph-first network traffic visualizer for live capture and PCAP replay that helps you see what changed, what's noisy, and what to inspect next. Think of it as Git for network behavior: snapshot, diff, and replay network state visually. Input Modes PacMap supports two workflows...

packetsifterTool

PacketSifter What is PacketSifter? PacketSifter is a tool to perform batch processing of PCAP data to uncover potential IOCs. Simply initializePacketSifter with your desired integrations VirusTotal, AbuseIPDB and pass PacketSifter a pcap and the desired switches and PacketSifter will sift through...

PcapViz

PcapViz PcapViz draws networks as device topologies and as information flows using the packet information in pcap files captured from a network device using tcpcap or other capture software. It filters and optionally displays the captured packets at any one of 3 "layers". These are: device level...

doublepulsar-c2-traffic-decryptor

Autor: Luke Jennings [email protected] - @jukelennings Empresa: Countercept @countercept Sitio web: https://countercept.com Un script de python2 para descifrar el tráfico C2 utilizado por el implante SMB DOUBLEPULSAR desde un archivo PCAP. El cifrado usado es un simple XOR de 4 bytes, que a...

babyshark

babyshark Wireshark made easy in your terminal. Babyshark is a PCAP TUI that helps you answer: What’s using the network? What looks broken/weird? What should I select next? Status: v0.3.0 alpha. Offline .pcap / .pcapng viewing works without Wireshark Live capture requires tshark Wireshark CLI...

etl-parser

etl-parser Event Trace Log file reader in pure Python etl-parser is a pure Python 3 parser library for ETL Windows log files. ETL is the default format for ETW as well as the default format for the Kernel logger. etl-parser has no system dependencies, and will work well on both Windows and Linux...

pcapan

pcapan Un asistente de análisis de capturas pcap Uso: $ git clone https://github.com/synacktiv/pcapan $ cd pcapan $ cargo run -- --pcap /tmp/capture.pcap --google -w whitelist.yaml Finished dev unoptimized + debuginfo targets in 0.04s Running target/debug/pcapan --pcap /tmp/log.tcpdump --google -...

CapTipper

CapTipper v0.3 CapTipper v0.3: http://www.omriher.com/2015/08/captipper-v03-is-out.html CapTipper v0.2: http://www.omriher.com/2015/03/captipper-02-released.html CapTipper v0.1: http://www.omriher.com/2015/01/captipper-malicious-http-traffic.html CapTipper is a python tool to analyze, explore and...

Network_Assessment

Network Assessment With Wireshark or TCPdump, you can determine whether there is harmful activity on your network traffic that you have recorded on the network you monitor. This Python script analyzes network traffic in a given .pcap file and attempts to detect the following suspicious network...

arkime

Arkime Arkime 是一个大规模的开源网络分析与数据包捕获系统。 Arkime 增强了您现有的安全基础设施，以标准的 PCAP 格式存储和索引网络流量，提供快速、索引化的访问。它提供了一个直观且简单的 Web 界面，用于 PCAP 的浏览、搜索和导出。Arkime 公开了 API，允许直接下载和使用 PCAP 数据以及 JSON 格式的会话数据。Arkime 以标准的 PCAP 格式存储和导出所有数据包，使您也可以在分析工作流程中使用您喜爱的 PCAP 摄取工具，如 Wireshark。 Arkime 设计为可跨多系统部署，并能扩展到处理数十 Gbps 的流量。PCAP...

NetworkAssessment

NetworkAssessment: Network Compromise Assessment Tool The Network Compromise Assessment Tool is designed to analyze pcap files to detect potential suspicious network traffic. This tool focuses on spotting abnormal activities in the network traffic and searching for suspicious keywords. Features D...

TrafficWatch

TrafficWatch TrafficWatch, a packet sniffer tool, allows you to monitor and analyze network traffic from PCAP files. It provides insights into various network protocols and can help with network troubleshooting, security analysis, and more. Features Protocol-specific packet analysis for ARP, ICMP...

wireshark-forensics-plugin

wireshark-forensics-plugin Wireshark 是使用最广泛的网络流量分析器。对于取证/恶意软件分析人员来说，它既是实时流量分析的重要工具，也是取证分析的重要工具。尽管 Wireshark 在协议解析和过滤方面提供了极其强大的功能，但它并未提供任何有关网络端点的上下文信息。对于需要梳理数 GB 的 PCAP 文件以识别恶意活动的典型分析师来说，这就像大海捞针。 Wireshark 取证工具包是一个跨平台的 Wireshark 插件，它将网络流量数据与威胁情报、资产分类和漏洞数据关联起来，以加速网络取证分析。它通过扩展 Wireshark...

wireshark-forensics-plugin

wireshark-forensics-plugin Wireshark is the most widely used network traffic analyzer. It is an important tool for both live traffic analysis & forensic analysis for forensic/malware analysts. Even though Wireshark provides incredibly powerful functionalities for protocol parsing & filtering, it...

so-crates

SO-CRATES Security Onion Containerized Rapid Analysis of Threats, Evil, and Sus A standalone web application for analyzing pcap files, log files, email messages, and binary files. Features include Suricata network analysis, YARA binary scanning, Sigma rule detection for logs, email...

Woeful

Woeful A high performance Wisp server that has packet analysis. Features Wisp V1 Support Pcap network capture Blacklisting & Whitelisting ports and domains Is it fast? It's faster then WispServerCpp. The other benchmarks are more nuanced. Dependencies Big thanks to all of these projects:...