An open-source big data security analytics tool that analyzes network packet capture (pcap) files using Apache Pig.
Packetpig is an open-source big data security analytics tool that analyzes network packet capture (pcap) files using Apache Pig. It processes raw network traffic data to extract security insights, such as intrusion alerts, conversation patterns, and operating system fingerprints, enabling scalable analysis of large datasets. The tool transforms complex packet data into structured formats suitable for further analysis and visualization.
Security analysts, network researchers, and data engineers who need to analyze large volumes of network packet data for threat detection, forensic investigations, or traffic analysis.
Developers choose Packetpig because it integrates seamlessly with Hadoop ecosystems, provides pre-built loaders for tools like Snort and p0f, and offers rich visualizations for exploring security data. Its open-source nature and support for both local and cluster deployments make it a flexible alternative to proprietary security analytics platforms.
Packetpig - Open Source Big Data Security Analytics
Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.
Directly incorporates Snort for intrusion detection and p0f for OS fingerprinting, allowing complex correlation in Pig scripts as shown in the p0f.pig example.
Built on Apache Pig with support for Hadoop and Amazon EMR via run_emr script, enabling analysis of massive pcap files across clusters.
Includes WebGL globes, trigram cubes, and choropleth maps for intuitive exploration of security data patterns, though each requires separate setup.
Offers ready-to-use Pig scripts for tasks like bandwidth analysis and n-gram generation, speeding up common workflows without reinventing the wheel.
Requires Hadoop/HDFS setup or EMR for cluster use, and external tools like p0f and Snort must be configured separately, adding to deployment complexity.
Each visualization requires specific servers or tools, such as Ubigraph for DNS graphs and Python web servers for HTML files, creating additional overhead.
Focused on static pcap files with no support for real-time packet analysis, limiting use in live monitoring scenarios as indicated by the file-based inputs.