network-forensics 开源项目推荐（297 个）

seladb /PcapPlusPlus

PCapPlusPlus是一个多平台C++库，用于捕获、解析和制作网络数据包。它的设计目的是高效、强大且易于使用。它为libpcap、Npcap、WinPcap、DPDK、AF_XDP和PF_RING等最流行的数据包处理引擎提供C++包装器。

FoxIO-LLC /ja4

JA4+ is a suite of network fingerprinting standards

MISP /misp-warninglists

Warning lists to inform users of MISP about potential false-positives or other information in indicators

fkie-cad /friTap

Simplifying encrypted traffic analysis for researchers by making protocol decryption effortless.

medbenali /CyberScan

CyberScan: Network's Forensics ToolKit

faucetsdn /poseidon

Poseidon is a python-based application that leverages software defined networks (SDN) to acquire and then feed network traffic to a number of machine learning techniques. The machine learning algorithms classify and predict the type of device.

stamparm /blackbook

Blackbook of malware domains

asiamina /A-Course-on-Digital-Forensics

A course on "Digital Forensics" designed and offered in the Computer Science Department at Texas Tech University

ninedter /pcap-hunter

PCAP Hunter 是一个人工智能威胁狩猎工作台。它使用Zeek和Tshark分析经过OSINT增强的PCAPs。功能包括世界地图、JA3取证和C2检测。它通过本地或云大型语言模型生成多语言安全报告，优先考虑隐私和速度。

lyscf /FlowSage

一款专为 CTF 竞赛设计的智能流量分析工具，支持多协议解析与自动化 Flag 提取，助力快速解题。

Sakura-sx /Aroma

Every TCP Proxy Is Detectable With RTT Fingerprinting

nipunjaswal /networkforensics

Hands-On Network Forensics by Nipun Jaswal

NotYuSheng /TracePcap

Self-hosted PCAP analysis platform with LLM-powered incident triage, signature-based threat detection, and AI-generated incident narratives. Features network change monitoring across captures, deep packet inspection via nDPI, and automated Wireshark filter generation. Runs fully offline with local LLMs (Ollama, LM Studio).

fkie-cad /pcapFS

A FUSE module to mount captured network data

hannes-wan /pcap-surgery-official

Free Community Edition PCAP analyzer and PCAP editor for local packet detail, bounded rewrite previews, checksum repair, and privacy evidence.

cdpxe /nefias

Network Forensic & Anomaly Detection System; tailored for covert channel/network steganography detection

Manas-5461X /DPI_Engine

Deep Packet Inspection (DPI) is a technology used to examine the contents of network packets as they pass through a checkpoint. Unlike simple firewalls that only look at packet headers (source/destination IP), DPI looks inside the packet payload.

cdpxe /NetworkCovertChannels

Collection of my network covert channel tools.

fkie-cad /TLExport

The goal of this project is to help researchers/investigaters to export the decrypted TLS content into a PCAP

CyberHorizon-be /sleuthline

Windows DFIR pipeline: from a KAPE collection, a memory image and network captures to an evidence-backed incident response report, with an LLM agent.