libpcap

Masscanrobertdavidgraham/masscan

An Internet-scale TCP port scanner that can scan the entire Internet in under 5 minutes using asynchronous SYN packets.

Wiresharkwireshark/wireshark

A network protocol analyzer that captures and interactively browses traffic running on a computer network.

rustnetdomcyrus/rustnet

A cross-platform terminal UI network monitor providing real-time connection tracking, deep packet inspection, and process attribution.

Packet, where are you?cilium/pwru

eBPF-based Linux kernel networking debugger for tracing and filtering network packets with fine-grained introspection.

nethogsraboof/nethogs

A Linux 'net top' tool that groups network bandwidth usage by process instead of protocol or subnet.

BruteSharkodedshimon/BruteShark

A Network Forensic Analysis Tool (NFAT) for deep inspection of PCAP files and live traffic, extracting credentials, building network maps, and reconstructing sessions.

EttercapEttercap/ettercap

A comprehensive suite for man-in-the-middle attacks, featuring live connection sniffing, content filtering, and protocol dissection.

Deepfence PacketStreamerdeepfence/PacketStreamer

Distributed tcpdump for cloud native environments, capturing and streaming network packets from multiple hosts to a central receiver.

tcpflowsimsong/tcpflow

A TCP/IP packet demultiplexer that captures and reconstructs TCP connections into separate files for protocol analysis and forensics.

SharpPcapchmorgan/sharppcap

A fully managed, cross-platform .NET library for capturing network packets from live devices and files.

sharppcapdotpcap/sharppcap

A fully managed, cross-platform .NET library for capturing network packets from live devices and files.

Joycisco/joy

A libpcap-based package for extracting and analyzing network flow data in JSON format for security research and monitoring.

sniffgluekpcyrd/sniffglue

A secure, multithreaded network packet sniffer written in Rust, designed for safe operation on untrusted networks.

pcap4jkaitoy/pcap4j

A Java library for capturing, crafting, and sending network packets via native pcap libraries.

pmacctpmacct/pmacct

A lightweight suite of passive network monitoring tools supporting NetFlow, sFlow, IPFIX, libpcap, and BGP telemetry.

sngrepirontec/sngrep

A terminal-based SIP message flow viewer with ncurses interface for real-time VoIP debugging.

ngrepjpr5/ngrep

A PCAP-based network packet analyzer that applies grep-like pattern matching to packet payloads across multiple protocols.

Netis Packet AgentNetis/packet-agent

A software probe for capturing and forwarding network packets in cloud, Kubernetes, and virtualized environments.

VectorscanVectorCamp/vectorscan

A portable fork of Intel's Hyperscan, enabling high-performance regex matching on ARM, Power, and other non-x86 platforms.

ssh-honeypotdroberson/ssh-honeypot

A low-interaction SSH honeypot that logs attacker IPs, usernames, and passwords for security intelligence.

PFQpfq/PFQ

A functional network framework for Linux enabling high-performance packet capture, transmission, and in-kernel processing optimized for multi-core systems.

dnsmonstermosajjal/dnsmonster

A high-performance passive DNS monitoring framework that captures, indexes, and analyzes DNS traffic for security and network insights.

libcrafterpellegre/libcrafter

A high-level C++ library for crafting, decoding, and sniffing network packets with a Scapy-like interface.

CPqDCPqD/ofsoftswitch13

An OpenFlow 1.3 compatible user-space software switch implementation for SDN research and experimentation.

udpreplayrigtorp/udpreplay

A lightweight tool for replaying UDP unicast and multicast streams from pcap files.

HttpSniffercaesar0301/http-sniffer

A multi-threading tool to sniff TCP flow statistics and extract HTTP headers from live traffic or PCAP files.

sipgrepsipcapture/sipgrep

A command-line tool to sniff, capture, display, and troubleshoot SIP signaling over IP networks using regex matching.

pkt2flowcaesar0301/pkt2flow

A cross-platform utility that classifies network packets into flows using the essential 4-tuple (src_ip, dst_ip, src_port, dst_port).

clj-net-pcapruedigergad/clj-net-pcap

A Clojure wrapper for jNetPcap that simplifies packet capturing and network traffic analysis.

WiFi RID capturesxjack/unix_rid_capture

Captures ASTM F3411 / ASD-STAN 4709-002 UAV direct remote identification signals over WiFi and Bluetooth.

Tapirxvirtalabs/tapirx

A cross-platform tool that passively discovers and identifies networked medical devices by inspecting HL7 and DICOM network traffic.

Ipsumdumpkohler/ipsumdump

A command-line tool for summarizing and manipulating network packet traces from libpcap or tcpdump files.

rtpbreakNaishy/rtpsplit

Detects, reconstructs, and analyzes RTP sessions from network traffic or pcap files, independent of signaling protocols.

dashbutton2mqtthobbyquaker/dashbutton2mqtt

Publishes Amazon Dash button presses as MQTT messages for home automation integration.

Tcpsplitpmcgleenon/tcpsplit

A command-line utility that splits large packet capture (pcap) files into smaller traces along TCP connection boundaries.