A Perl tool that extracts and reassembles application sessions and files from network packet captures for analysis and replay.
Chaosreader is a Perl-based network analysis tool that processes packet capture files (e.g., from tcpdump or snoop) to reconstruct application-layer sessions and extract files transferred over the network. It solves the problem of analyzing unencrypted network traffic by providing detailed session reconstructions, file recovery, and real-time replay capabilities for protocols like HTTP, FTP, telnet, and VNC.
Security researchers, network forensic analysts, penetration testers, and system administrators who need to inspect, analyze, or demonstrate the risks of unencrypted network protocols from packet captures.
Developers choose Chaosreader for its comprehensive protocol support, ability to generate interactive HTML reports with session replays, and its standalone operation mode that simplifies packet capture and analysis in one tool, making it a versatile open-source alternative for network forensics.
An any-snarf program that processes application protocols (HTTP/FTP/...) from tcpdump or snoop files and stores session and file data
Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.
Supports extraction and reassembly from multiple unencrypted protocols like HTTP, FTP, SMTP, telnet, X11, and VNC, as listed in the README, enabling comprehensive session analysis.
Recovers transferred files such as HTML, images, and emails from network traffic, useful for forensic data extraction and evidence gathering.
Generates detailed HTML indexes with links to session details and real-time replay programs for telnet and IRC sessions, enhancing documentation and analysis.
Can automatically invoke tcpdump or snoop to capture and process packets in one step, simplifying the workflow for quick forensic tasks.
Focuses solely on unencrypted protocols, making it ineffective for modern networks where encryption like TLS is standard, as admitted in its security demonstration purpose.
Requires specific Perl modules, and the README notes that if modules are problematic, users must use older versions, complicating installation and maintenance.
As a Perl script performing TCP/IP reassembly, it may be slow or memory-intensive with very large packet capture files, limiting scalability for enterprise use.