network-forensics

PcapPlusPlus is a multiplatform C++ library for capturing, parsing and crafting of network packets. It is designed to be efficient, powerful and easy to use. It provides C++ wrappers for the most popular packet processing engines such as libpcap, Npcap, WinPcap, DPDK, AF_XDP, WinDivert and PF_RING.

JA4+ is a suite of network fingerprinting standards

Warning lists to inform users of MISP about potential false-positives or other information in indicators

Simplifying encrypted traffic analysis for researchers by making protocol decryption effortless.

CyberScan: Network's Forensics ToolKit

Poseidon is a python-based application that leverages software defined networks (SDN) to acquire and then feed network traffic to a number of machine learning techniques. The machine learning algorithms classify and predict the type of device.

Blackbook of malware domains

A course on "Digital Forensics" designed and offered in the Computer Science Department at Texas Tech University

🔍 AI-assisted threat-hunting workbench for SOC and DFIR analysts — turns raw PCAPs into actionable intel with a Zeek + tshark pipeline, C2/beacon detection, JA3 fingerprinting, MITRE ATT&CK mapping, OSINT enrichment, and multilingual reports from local or cloud LLMs.

一款专为 CTF 竞赛设计的智能流量分析工具，支持多协议解析与自动化 Flag 提取，助力快速解题。

Every TCP Proxy Is Detectable With RTT Fingerprinting

Hands-On Network Forensics by Nipun Jaswal

Self-hosted PCAP analysis platform with LLM-powered incident triage, signature-based threat detection, and AI-generated incident narratives. Features network change monitoring across captures, deep packet inspection via nDPI, and automated Wireshark filter generation. Runs fully offline with local LLMs (Ollama, LM Studio).

A FUSE module to mount captured network data

Free Community Edition PCAP analyzer and PCAP editor for local packet detail, bounded rewrite previews, checksum repair, and privacy evidence.

Network Forensic & Anomaly Detection System; tailored for covert channel/network steganography detection

Deep Packet Inspection (DPI) is a technology used to examine the contents of network packets as they pass through a checkpoint. Unlike simple firewalls that only look at packet headers (source/destination IP), DPI looks inside the packet payload.

Collection of my network covert channel tools.

The goal of this project is to help researchers/investigaters to export the decrypted TLS content into a PCAP

Windows DFIR pipeline: from a KAPE collection, a memory image and network captures to an evidence-backed incident response report, with an LLM agent.