PcapPlusPlus is a multiplatform C++ library for capturing, parsing and crafting of network packets. It is designed to be efficient, powerful and easy to use. It provides C++ wrappers for the most popular packet processing engines such as libpcap, Npcap, WinPcap, DPDK, AF_XDP, WinDivert and PF_RING.

windows linux pcap networking cpp dpdk network-forensics pf-ring packet-parsing mac-osx network-tools winpcap pcap-files packet-processing libpcap multiplatform ebpf packet-crafting tcp-reassembly pcapplusplus

• Updated Nov 12, 2026
• C++

JA4+ is a suite of network fingerprinting standards

network-forensics cybersecurity network-analysis ja3 jarm ja3-fingerprint ja4 ja4x ja4-fingerprint ja4h

• Updated Oct 6, 2026
• Rust

Warning lists to inform users of MISP about potential false-positives or other information in indicators

network-forensics dfir misp threat-intelligence false-positive misp-warninglists

• Updated Oct 29, 2026
• Python

Simplifying encrypted traffic analysis for researchers by making protocol decryption effortless.

android linux tls ssl security security-audit https network-forensics mtproto binary-analysis frida network-analysis tcpdump network-capture hooking ssldump android-https-capture

• Updated Nov 8, 2026
• Python

CyberScan: Network's Forensics ToolKit

opensource service-discovery network-forensics geolocation network-visualization network-analysis network-security information-gathering portscanner pcap-analyzer

• Updated Apr 23, 2026
• Python

Poseidon is a python-based application that leverages software defined networks (SDN) to acquire and then feed network traffic to a number of machine learning techniques. The machine learning algorithms classify and predict the type of device.

docker security machine-learning automation pcap networking network-forensics sdn network-monitoring network-traffic-capture pcap-files sdn-controller network-analysis hacktoberfest software-defined-network network-traffic faucet pcap-analyzer network-traffic-classification

• Updated Jan 6, 2026
• Python

Blackbook of malware domains

security network-forensics domains intrusion-detection network-monitoring threats malware-detection

• Updated Jun 12, 2025

A course on "Digital Forensics" designed and offered in the Computer Science Department at Texas Tech University

network-forensics reverse-engineering courses digital-forensics memory-forensics mobile-forensics disk-forensics

• Updated Oct 5, 2023
• Rich Text Format

🔍 AI-assisted threat-hunting workbench for SOC and DFIR analysts — turns raw PCAPs into actionable intel with a Zeek + tshark pipeline, C2/beacon detection, JA3 fingerprinting, MITRE ATT&CK mapping, OSINT enrichment, and multilingual reports from local or cloud LLMs.

python pcap network-forensics incident-response dfir cybersecurity wireshark threat-hunting yara tshark network-security zeek security-tools threat-intelligence pcap-analyzer packet-analysis blue-team mitre-attack streamlit llm

• Updated Oct 31, 2026
• Python

一款专为 CTF 竞赛设计的智能流量分析工具，支持多协议解析与自动化 Flag 提取，助力快速解题。

golang network-forensics traffic-analysis ctf

• Updated Jul 27, 2026

Every TCP Proxy Is Detectable With RTT Fingerprinting

security privacy networking tcp cdn network proxy network-forensics varnish cybersecurity fingerprinting network-security

• Updated Jan 11, 2026
• VCL

Hands-On Network Forensics by Nipun Jaswal

network-forensics forensics malware-analysis pcap-analyzer forensics-investigations

• Updated Jun 26, 2023
• Python

Self-hosted PCAP analysis platform with LLM-powered incident triage, signature-based threat detection, and AI-generated incident narratives. Features network change monitoring across captures, deep packet inspection via nDPI, and automated Wireshark filter generation. Runs fully offline with local LLMs (Ollama, LM Studio).

pcap ai network-forensics incident-response dfir cybersecurity network-monitoring wireshark threat-hunting soc triage tshark ndpi pcap-analyzer packet-analysis blue-team cyber-defense protocol-analysis llm ollama

• Updated Nov 11, 2026
• Java

A FUSE module to mount captured network data

fuse pcap network-forensics forensics pcapng pcap-files

• Updated Nov 11, 2026
• C++

Free Community Edition PCAP analyzer and PCAP editor for local packet detail, bounded rewrite previews, checksum repair, and privacy evidence.

desktop-app windows linux network-forensics pcapng community-edition pcap-analyzer packet-analysis free-download support-handoff pcap-editor packet-rewrite pcap-transformation pcap-repair

• Updated Jul 27, 2026

Network Forensic & Anomaly Detection System; tailored for covert channel/network steganography detection

linux shell bash security network network-forensics distributed-computing steganography network-monitoring infosec networks scientific-computations shell-scripts information-security information-hiding anomaly-detection scientific-research network-steganography covert-channels network-covert-channels

• Updated May 13, 2024
• Shell

Deep Packet Inspection (DPI) is a technology used to examine the contents of network packets as they pass through a checkpoint. Unlike simple firewalls that only look at packet headers (source/destination IP), DPI looks inside the packet payload.

open-source pcap networking network-forensics traffic-analysis dpi cybersecurity intrusion-detection network-monitoring wireshark information-security tcp-ip ethical-hacking network-security network-analyzer deep-packet-inspection packet-analysis protocol-analysis cybersecurity-education

• Updated Oct 28, 2026
• Python

Collection of my network covert channel tools.

compression network-forensics network-science steganography infosec secret-sharing warden network-analysis information-security covert-channel information-hiding compression-algorithm network-security scientific-software network-steganography network-traffic-generator protocol-channels protocol-hopping protocol-switching-covert-channels protocol-hopping-covert-channels

• Updated Nov 5, 2026
• C

The goal of this project is to help researchers/investigaters to export the decrypted TLS content into a PCAP

pcap network-forensics pcapng network-analysis

• Updated Jul 20, 2026
• Python

Windows DFIR pipeline: from a KAPE collection, a memory image and network captures to an evidence-backed incident response report, with an LLM agent.

pcap network-forensics incident-response forensics dfir suricata threat-hunting volatility memory-forensics kape duckdb windows-forensics llm

• Updated Oct 27, 2026
• Python