Wireshark is a world-class network protocol analyzer application. It captures live traffic or reads saved capture files (pcap, pcapng, etc.) and dissects them into a structured, hierarchical view of hundreds of network protocols. The application is built on a modular architecture: `libwsutil` (utilities), `libwiretap` (capture file I/O), and `libwireshark` (dissection engine). It provides a rich Qt-based graphical user interface (Wireshark) and a powerful command-line interface (TShark). Key features include a custom domain-specific language for display filtering (with its own compiler and virtual machine), a Lua scripting API for extensibility, a plugin system for protocol dissectors, and support for decrypting various protocols (TLS, IPsec, 802.11). The codebase is exceptionally well-engineered, with clean abstractions and highly reusable components like its scope-based memory manager (`wmem`) and its file format abstraction layer (`wiretap`). It is under very active maintenance and is the de-facto standard tool for network analysis.
Maltrail is a production-grade malicious traffic detection system that monitors network traffic in real-time, matching against a dynamic set of threat indicators (trails) and applying behavioral heuristics. It consists of two main components: a high-performance Rust sensor for packet capture and analysis, and a Python server for event intake, web dashboard, and API. The sensor uses libpcap for live capture or offline pcap replay, parses protocols (DNS, HTTP, TLS, QUIC), and performs trail matching and heuristic detection (port scanning, beaconing, DNS tunneling/exhaustion). Events are sent to the server via UDP or stored locally. The server provides a web UI for visualization, search, and management, supports remote logging to SIEMs (syslog, CEF, Logstash), and exposes a REST API for integration. The architecture is modular: the sensor is a multi-threaded Rust binary with lock-free metrics, memory-mapped trail stores, and fuzz-tested protocol parsers. The Python server handles configuration, trail updates from 40+ threat feeds, event logging, and the web interface. The system is designed for scalability with multi-worker capture, bounded memory heuristics, and efficient data structures (LRU caches, interned strings, hash tables). External dependencies include libpcap, SQLite, and various threat feed sources. The codebase demonstrates high craftsmanship with extensive testing (unit, integration, fuzz, parity tests between Rust and Python), CI/CD pipelines, and Docker/systemd deployment support.
RustNet is a cross-platform, real-time network monitoring terminal UI application. It captures packets via libpcap (or platform-specific backends like PKTAP on macOS, ETW on Windows), performs deep packet inspection (DPI) for protocols including HTTP, HTTPS, DNS, SSH, QUIC, BitTorrent, and many others, and attributes each connection to the owning OS process using eBPF (Linux), lsof (macOS), IP Helper (Windows), or sockstat (FreeBSD). The architecture is a multi-crate Rust workspace: `rustnet-core` provides connection tracking, DPI analyzers, GeoIP/OUI lookup, and rate/RTT tracking; `rustnet-capture` wraps libpcap; `rustnet-host` implements process lookup via a unified `ProcessLookup` trait; `rustnet-sandbox` handles privilege dropping and sandboxing (Landlock, Seatbelt, Windows job objects). The main binary (`rustnet-monitor`) orchestrates capture, enrichment, and a ratatui-based TUI with tabs for Overview, Details, Activity, Graph, and Host. It supports PCAP/PCAPNG export with process metadata, JSONL event logging, Kubernetes pod attribution, and a rich theme system with multiple presets. The codebase is well-structured, extensively tested, and actively maintained with CI/CD for multiple platforms and packaging (DEB, RPM, DMG, MSI, Homebrew, Chocolatey).
Homer is a production-grade, all-in-one HEP (Homer Encapsulation Protocol) capture and API server for SIP, RTP, RTCP, OTLP, and log data. It powers Homer 11.x data lake with DuckDB, Parquet, and Apache Arrow. The system ingests packets over UDP, TCP, TLS, HTTP, and WebSocket, decodes them using a custom zero-copy SIP parser, and stores them in a columnar DuckLake (DuckDB-backed) storage with SQLite catalog, supporting S3 and Azure backends. It provides a REST API (Echo) for search, dashboards, alerts, and configuration, an Arrow FlightSQL server for Grafana integration, and a React/TypeScript dashboard with drag-and-drop widgets, call flow visualization, and even browser-based games (chess, Doom). Architecture is modular with four main components: Ingest (transport servers), Storage (DuckLake manager with sharded writers, compactor, tiered mover), Node (FlightSQL server, catalog metadata), and Coordinator (REST API, auth, Lua correlation engine, LLM integration). Data flows from HEP/OTLP/Line Protocol receivers through decoders into DuckLake, then served via FlightSQL or REST. External dependencies include DuckDB, S3/Azure SDKs, Lua (golua), OTLP protobuf, and InfluxDB Line Protocol parser. The codebase demonstrates strong engineering practices: object pools for hot-path allocations, idempotent stop patterns, retry with backoff for catalog operations, and a Lua sandbox for scripting. However, it also carries some feature creep (games, LLM) and technical debt (dual SIP parsers, SQL injection risks via string interpolation in some services, and a few commented-out tests). Overall, it is a well-maintained, high-quality observability platform for VoIP and telemetry data.
Sniffnet is a cross-platform desktop GUI application for real-time network traffic monitoring and analysis, written in Rust using the Iced framework. It captures packets via pcap (live or from PCAP files) and also supports IPFIX flow collection over UDP. The application parses Ethernet, IP, TCP/UDP, ICMP, IGMP, ARP, and VLAN headers using a dedicated packet-parser library. It enriches captured traffic with geolocation (MaxMind GeoLite2 and IPinfo MMDB databases), ASN lookups, service identification (from a port-to-service map derived from nmap-services), and local process identification (via the listeners crate). The GUI provides multiple pages: an overview with live traffic charts and donut charts, an inspect page with a filterable and sortable connection table, a notifications page for alerts (thresholds, favorites, IP blacklists), and settings pages for themes, filters, and export. The application supports 25 languages, custom themes, and thumbnail mode for minimal monitoring. It is packaged for Linux (deb, rpm, AppImage), macOS (dmg), and Windows (msi), with CI/CD pipelines for cross-compilation and code signing.
Netis Cloud Probe is a production-grade network packet capture and forwarding system designed to monitor traffic without requiring dedicated TAP or SPAN hardware. It consists of a high-performance C capture engine (cpworker), a Go daemon (cpdaemon) that manages worker processes and communicates with a central policy manager (CPM), and a Go CLI (cpctl) for manual control. The system supports multiple capture sources (libpcap, DPDK, pcap files) and output sinks (GRE, VXLAN, ZMQ, rotating files) with a configurable execution model (real-time or pipelined using a lock-free SPSC ring buffer). Configuration reload is handled via a state-machine protocol, enabling hot-swapping of tasks without packet loss. The codebase is multi-language (C, Go) with CMake and Mage build systems, comprehensive unit and integration tests, and bilingual documentation (English, Chinese). It is actively maintained with a recent commit and continuous integration.