A lightweight utility to generate malicious network traffic patterns for evaluating security controls and network visibility.
Network Flight Simulator (flightsim) is a command-line utility that generates simulated malicious network traffic to help security teams evaluate their security controls and monitoring tools. It creates traffic patterns mimicking real-world threats like DNS tunneling, DGA traffic, C2 communications, and SSH exfiltration, allowing teams to test detection capabilities in a safe environment.
Security engineers, SOC analysts, and red team members who need to validate network security controls, SIEM alerting, and threat detection pipelines.
It provides a lightweight, easy-to-use tool for proactive security validation without requiring complex setups or exposing networks to real threats, with a wide range of built-in modules covering common attack patterns.
A utility to safely generate malicious network traffic patterns and evaluate controls.
Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.
Includes 14+ built-in modules covering common threats like C2, DGA, SSH exfiltration, and cryptomining, as detailed in the README table, providing comprehensive testing options.
Offers intuitive commands like 'flightsim run c2' and clear help flags, demonstrated in usage examples, making it easy to execute simulations without complex setup.
Built in Go, available as a single binary for multiple OSes or via 'go install', ensuring quick deployment across different environments as per the installation guide.
Supports dry-run mode, fast execution, and interface selection with flags like '-dry' and '-iface', allowing precise simulations without unintended network impact.
Some modules, such as c2, require internet access to fetch data from AlphaSOC API, limiting usability in offline or restricted networks, as noted in the README.
Focused on predefined simulations; adding new attack patterns or custom traffic models isn't straightforward, which may not suit teams with unique threat profiles.
Output is terminal-based, requiring manual effort to parse and integrate with SIEMs or monitoring tools, with no built-in reporting or export features.