GitHub stars · StarDay

1secdev / scapyScapy: the Python-based interactive packet manipulation program & library.PythonGPL-2.0 · Share derivative source12,676

2kubeshark / kubesharkeBPF-powered network observability for Kubernetes. Indexes L4/L7 traffic with full K8s context, decrypts TLS without keys. Queryable by AI agents via MCP and humans via dashboard.GoApache-2.0 · Permissive12,131

3wader / fqfq - jq for binary formats. Tool, language and decoders for working with binary formats.GoLicense not declared10,627

4gcla / termsharkA terminal UI for tshark, inspired by WiresharkGoMIT · Permissive10,059

5zeek / zeekZeek is a powerful network analysis framework that is much different from the typical IDS you may know.C++License not declared8,180

6arkime / arkimeArkime is an open source, large scale, full packet capturing, indexing, and database system.CApache-2.0 · Permissive7,563

7bee-san / pyWhat🐸 Identify anything. pyWhat easily lets you identify emails, IP addresses, and more. Feed it a .pcap file or some text and it'll tell you what it is! 🧙‍♀️PythonMIT · Permissive7,342

8emanuele-f / PCAPdroidNo-root network monitor, firewall and PCAP dumper for AndroidJavaGPL-3.0 · Share derivative source5,102

9pavel-odintsov / fastnetmonVery fast DDoS sensor with sFlow/Netflow/IPFIX/SPAN supportC++GPL-2.0 · Share derivative source3,725

10odedshimon / BruteSharkNetwork Analysis ToolC#GPL-3.0 · Share derivative source3,417

11cisagov / MalcolmMalcolm is a powerful, easily deployable network traffic analysis tool suite for full packet capture artifacts (PCAP files), Zeek logs and Suricata alerts.PythonLicense not declared2,589

12nfstream / nfstreamNFStream: a Flexible Network Data Analysis Framework.PythonLGPL-3.0 · Share derivative source1,225

13stratosphereips / StratosphereLinuxIPSSlips, a free software behavioral Python intrusion prevention system (IDS/IPS) that uses machine learning to detect malicious behaviors in the network traffic. Stratosphere Laboratory, AIC, FEL, CVUT in Prague.PythonGPL-2.0 · Share derivative source903

14tenzir / tenzirTenzir is the data pipeline engine for security teams.C++BSD-3-Clause · Permissive770

15bx33661 / Wireshark-MCPWireshark-MCP,Give your AI assistant a packet analyzer. Drop a .pcap file, ask questions in plain English — get answers backed by real tshark data.PythonMIT · Permissive371

16JarryShaw / PyPCAPKitPython-based Comprehensive Network Packet Analysis LibraryPythonBSD-3-Clause · Permissive274