Skip to content

Tools network forensics

Network forensics tooling for capturing, analyzing, and reconstructing network traffic. The tools below are grouped according to the categories of analysis described in Network forensics.

Warning: The tools listed below are not necessarily forensic tooling in the sense of Forensic tooling.

Deep Analysis - Full Packet Capture (FPC) and Deep Packet Inspection (DPI)

Cost effective full line rate 10G packet capture to disk appliance. Featuring a slim 1U solution with 4 hot swap drives and 16TB of raw disk space, generating nanosecond PCAP files that can be downloaded for further processing at 10Gbit speed. This is a commercial appliance by a small independent vendor.

NetWitness Corporation - Freeware/Commercial, Enterprise-Wide, Real-Time Network Forensics.

OmniPeek is a network forensic tool used to capture, store, and analyze historical network traffic.

  • PacketMotion

Full Packet Capture and Deep Packet Inspection appliance (acquired by VMware).

  • snoop - captures packets from the network and displays their contents (solaris)

  • SplitCap

SplitCap is a free open source pcap file splitter.

Graphical packet capture and protocol dissection (analysis) tool.

Network Forensic Analysis Tool (NFAT) that extracts application-layer data (emails, web content, files) from pcaps using Deep Packet Inspection; see also pcap2wav.

Session reconstruction

See also Session reconstruction.

Takes tcpdump/snoop capture files and fetches the application data (tcp sessions, HTTP transfers, FTP files, SMTP emails), producing an HTML index that links to each reconstructed session.

  • E-Detective

Web and email forensic tool for reconstructing web pages and email content.

Expert Team 3i System provides real-time data traffic reconstruction which allows raw data packet stream to be decoded, reassemble and reconstruct back to the original content view receive/compose/sent by the target users. Supported layer 7 protocols and applications include HTTP (Web URL and Content, Web Video, Web File Upload and Download, Email - POP3, IMAP, SMTP, Webmail, Social Networking Sites, FTP File Upload and Download, Instant Messaging, VoIP etc....

Network Forensic Analysis Tool (NFAT) for passive sniffing and PCAP analysis that recovers sessions, hostnames, open ports, and reassembles transmitted files and certificates.

VoIP/RTP decoder. pcap2wav is part (a sub-project) of Xplico and it supports and decodes the following audio codecs: G711ulaw, G711alaw, G722, G729, G723, G726 and MSRTA (x-msrta: Real Time Audio).

Captures data transmitted as part of TCP connections (flows) and stores each flow in its own file for protocol analysis and debugging; can also process stored 'tcpdump' packet flows.

Recovers files from network traffic based on content signatures (inspired by foremost).

Flow-based analysis

See also Flow-based analysis.

Flow-based network monitor that records network transactions (5-tuple flows with byte and packet counts) for later analysis and replay.

Open Source web visual tool for information security specialists, system administrators and everyone who needs to analyze large amounts of captured network traffic.

CapAnalysis performs indexing of data set of PCAP files and presents their contents in many forms, starting from a list of TCP, UDP or ESP streams/flows, passing to the geo-graphical representation of the connections.

MNIS is a comprehensive and scalable network intelligence platform for network forensics and various other applications. It is built on high speed Deep Packet Inspection and metadata alerting. It can be used to understand network events before and after an event. It scales from LAN environments to 20 Gbps service provider networks.

MNIS Collector is an IPFIX collector which also supports legacy Netflow. It was designed to be used with the MNIS Exporter, which is a Deep Packet Inspection probe that can be used to decode 300+ protocols on up to 20 Gbps and report the information in IPFIX.

Net/FSE (Network Forensic Search Engine): capture, indexing and search service for high-volume IP-based network log data (firewalls, intrusion detection systems, routers and other network devices).

libpcap-based network traffic probe that shows per-host network usage, similar to the top Unix command.

Analyze packet latency between 2 PCAPs or between 2 MAC addresses or any packets with the same payloads.

Toolkit for collecting, storing and analyzing flow records (Compact NetFlow-style traffic metadata) at scale.

Intrusion and anomaly detection

See also Intrusion detection.

Checks a local system for signs of rootkit intrusion (tampered kernel, hidden processes, suspicious open ports).

Open source host-based intrusion detection system (HIDS) with log monitoring and compliance features.

Rootkit Hunter - scans a local system for rootkits, tampered binaries and hidden backdoors.

Web-based dashboard for collecting and correlating IDS alerts and host logs.

Open source network intrusion prevention and detection system (IDS/IPS).

Data leakage analysis

Network data loss prevention (DLP) tool that inspects network traffic for leaking of sensitive information.

DNS analysis

Name Server Lookup command line tool used to find IP address from domain name.

Wireless and Radio Frequency (RF) analysis

See also Wireless forensics.

Free, open source 802.11 sniffer and security tool (passive scanning and monitor mode), for Mac OS X.

802.11 layer2 wireless network detector, sniffer, and intrusion detection system.

TLS/SSL analysis

See also SSL forensics.

Captures and analyzes SSL/TLS sessions: handshake records, certificate metadata and - when session keys are available - the cleartext payload.

Geolocation and path analysis

See also IP geolocation.

IP geolocation services and data provider for offline geotagging. Free GeoLite country database. Programmable APIs.

Web service and command line tool to look up registry information for internet domain.

Timeline correlation

See also Timeline analysis and Logfile analysis.

logstash is a tool for managing events and logs. You can use it to collect logs, parse them, and store them for later use (like, for searching). Speaking of searching, logstash comes with a web interface for searching and drilling into all of your logs.

Generic tooling

Computer forensic tool that scans disk images (and other data sources) recovering artifacts - strings, files, emails and more - in a single pass.

Network stream utility with encryption support (Twofish, base64, SSL/TLS), similar to netcat.

  • Mera Systems NetBeholder

  • netcat

Reads and writes data over network connections (TCP/UDP); used for ad-hoc transfers and port testing.

Shows the network connections, listening ports, and routing information of a machine.

Applies grep-style pattern matching to live or captured network traffic (TCP and UDP).

  • nmap - utility for network exploration and security auditing

See Also