A libpcap-based package for extracting and analyzing network flow data in JSON format for security research and monitoring.
Joy is a network analysis package that captures and analyzes network flow and intraflow data from live traffic or pcap files, outputting the results in JSON format. It is designed for security research, forensics, and monitoring to detect vulnerabilities and threats in network traffic. The tool extracts detailed features like TLS data, DNS queries, and HTTP headers to enable deep inspection of network behavior.
Network security researchers, administrators, penetration testers, and security operations teams who need to analyze network traffic for threats, vulnerabilities, or forensic investigations. It is also suitable for academics and developers working on network monitoring tools.
Joy provides an open-source, flow-oriented approach to network analysis with rich JSON output, making it easy to integrate with data analysis tools. Its ability to capture intraflow data and support TLS fingerprinting offers detailed insights for security research, distinguishing it from basic packet capture tools.
A package for capturing and analyzing network flow data and intraflow data, for network research, forensics, and security monitoring.
Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.
Captures rich events within flows, including packet lengths, TLS records, DNS queries, and HTTP headers, enabling deep inspection for security forensics and research.
Includes the largest open-source TLS fingerprint database with automated tools, building on previous research with enhanced annotations for threat detection, as highlighted in the documentation.
Outputs data in JSON format, making it easily consumable by data analysis tools and compressible for efficient storage, though it is somewhat verbose.
Offers libjoy, a thread-safe library with APIs for integration into custom applications, supporting multi-threaded flow processing as per release notes.
Explicitly labeled as alpha/beta software in the README, with a warning that it is not suitable for production use, limiting reliability in critical environments.
IPv6 support is limited in features like anonymization, subnet labeling, and some export protocols (e.g., IPFix and NFv9), as noted in release 4.3.0 notes.
JSON output is described as somewhat verbose, which, while compressible, can lead to larger file sizes and increased processing overhead for high-volume traffic analysis.