Sniffnet is a cross-platform desktop GUI application for real-time network traffic monitoring and analysis, written in Rust using the Iced framework. It captures packets via pcap (live or from PCAP files) and also supports IPFIX flow collection over UDP. The application parses Ethernet, IP, TCP/UDP, ICMP, IGMP, ARP, and VLAN headers using a dedicated packet-parser library. It enriches captured traffic with geolocation (MaxMind GeoLite2 and IPinfo MMDB databases), ASN lookups, service identification (from a port-to-service map derived from nmap-services), and local process identification (via the listeners crate). The GUI provides multiple pages: an overview with live traffic charts and donut charts, an inspect page with a filterable and sortable connection table, a notifications page for alerts (thresholds, favorites, IP blacklists), and settings pages for themes, filters, and export. The application supports 25 languages, custom themes, and thumbnail mode for minimal monitoring. It is packaged for Linux (deb, rpm, AppImage), macOS (dmg), and Windows (msi), with CI/CD pipelines for cross-compilation and code signing.
This is a comprehensive command-line tool and self-hosted web server for network reconnaissance, written entirely in Bash. It performs ASN lookups, BGP statistics, RPKI validation, IP geolocation, IP reputation checks (via StopForumSpam, IPQualityScore, GreyNoise), Shodan InternetDB scanning for open ports and vulnerabilities, AS path tracing with detailed hop information, and more. The architecture is a monolithic Bash script (~7000 lines) that integrates numerous public APIs (RIPEStat, Team Cymru, pWhois, PeeringDB, CAIDA, ipinfo.io, ip-api, Cloudflare Radar, etc.) and command-line tools (mtr, whois, jq, curl, ncat). It can run in interactive mode, JSON output mode (as an API), or as an HTTP server (using ncat) that generates HTML reports with clickable links and a bookmarklet for browser integration. The code is well-structured for a shell script, with extensive error handling, caching of API responses, and support for API tokens to enhance functionality. While it is not modular in a traditional sense (everything is in one file), it demonstrates high craftsmanship in Bash and is actively maintained.
This repository is a Laravel package that provides middleware for integrating with the IPinfo API to enrich HTTP requests with IP geolocation and related data. It supports multiple API tiers (Core, Plus, Lite, and Residential Proxy) and includes features like caching, IP selection strategies, bot filtering, and exception handling. The package follows Laravel conventions with service providers, facades, and configurable middleware. It is actively maintained with recent commits and supports Laravel versions up to 13. The codebase is well-structured, with clear separation of concerns and reusable components like the caching mechanism and IP selector interface.
This repository provides a high-precision IP geolocation HTTP API focused on mainland China, capable of resolving IP addresses to province/city/district level using a custom GeoCN database. The server is written in Go, uses MaxMind GeoLite2 databases for ASN and city-level data, and supplements with a custom MMDB for Chinese administrative divisions. It is deployed as a single binary via Docker, with a CI pipeline that weekly rebuilds the image with updated databases. The codebase is monolithic but well-organized, with environment variable configuration, proper error handling, and clean JSON responses. It is primarily an application, not a data research project, though it ships supporting data files for division codes and ASN metadata.