Wireshark is a world-class network protocol analyzer application. It captures live traffic or reads saved capture files (pcap, pcapng, etc.) and dissects them into a structured, hierarchical view of hundreds of network protocols. The application is built on a modular architecture: `libwsutil` (utilities), `libwiretap` (capture file I/O), and `libwireshark` (dissection engine). It provides a rich Qt-based graphical user interface (Wireshark) and a powerful command-line interface (TShark). Key features include a custom domain-specific language for display filtering (with its own compiler and virtual machine), a Lua scripting API for extensibility, a plugin system for protocol dissectors, and support for decrypting various protocols (TLS, IPsec, 802.11). The codebase is exceptionally well-engineered, with clean abstractions and highly reusable components like its scope-based memory manager (`wmem`) and its file format abstraction layer (`wiretap`). It is under very active maintenance and is the de-facto standard tool for network analysis.
AngryOxide is a production-grade 802.11 WiFi security auditing tool written in Rust. It captures and analyzes wireless frames in real time via raw AF_PACKET sockets, performs deauthentication, disassociation, PMKID, rogue M2, and other attacks, and outputs handshake data in hashcat-compatible hc22000 format, PCAPNG files with GPS metadata, and KismetDB SQLite databases. The application features a full terminal user interface built on ratatui with custom widgets (AdvTable, TabbedBlock) for monitoring access points, stations, and handshakes, as well as a headless mode for scripting. It integrates GPSD for geotagging and geofencing, and includes a standalone pcap/pcapng parsing library with fuzz testing and benchmarks. The architecture is a single binary monolith with clear module separation, background worker threads for I/O, and a state-machine attack engine. It is actively maintained, well-documented, and demonstrates strong Rust engineering practices.
Homer is a production-grade, all-in-one HEP (Homer Encapsulation Protocol) capture and API server for SIP, RTP, RTCP, OTLP, and log data. It powers Homer 11.x data lake with DuckDB, Parquet, and Apache Arrow. The system ingests packets over UDP, TCP, TLS, HTTP, and WebSocket, decodes them using a custom zero-copy SIP parser, and stores them in a columnar DuckLake (DuckDB-backed) storage with SQLite catalog, supporting S3 and Azure backends. It provides a REST API (Echo) for search, dashboards, alerts, and configuration, an Arrow FlightSQL server for Grafana integration, and a React/TypeScript dashboard with drag-and-drop widgets, call flow visualization, and even browser-based games (chess, Doom). Architecture is modular with four main components: Ingest (transport servers), Storage (DuckLake manager with sharded writers, compactor, tiered mover), Node (FlightSQL server, catalog metadata), and Coordinator (REST API, auth, Lua correlation engine, LLM integration). Data flows from HEP/OTLP/Line Protocol receivers through decoders into DuckLake, then served via FlightSQL or REST. External dependencies include DuckDB, S3/Azure SDKs, Lua (golua), OTLP protobuf, and InfluxDB Line Protocol parser. The codebase demonstrates strong engineering practices: object pools for hot-path allocations, idempotent stop patterns, retry with backoff for catalog operations, and a Lua sandbox for scripting. However, it also carries some feature creep (games, LLM) and technical debt (dual SIP parsers, SQL injection risks via string interpolation in some services, and a few commented-out tests). Overall, it is a well-maintained, high-quality observability platform for VoIP and telemetry data.
Sniffnet is a cross-platform desktop GUI application for real-time network traffic monitoring and analysis, written in Rust using the Iced framework. It captures packets via pcap (live or from PCAP files) and also supports IPFIX flow collection over UDP. The application parses Ethernet, IP, TCP/UDP, ICMP, IGMP, ARP, and VLAN headers using a dedicated packet-parser library. It enriches captured traffic with geolocation (MaxMind GeoLite2 and IPinfo MMDB databases), ASN lookups, service identification (from a port-to-service map derived from nmap-services), and local process identification (via the listeners crate). The GUI provides multiple pages: an overview with live traffic charts and donut charts, an inspect page with a filterable and sortable connection table, a notifications page for alerts (thresholds, favorites, IP blacklists), and settings pages for themes, filters, and export. The application supports 25 languages, custom themes, and thumbnail mode for minimal monitoring. It is packaged for Linux (deb, rpm, AppImage), macOS (dmg), and Windows (msi), with CI/CD pipelines for cross-compilation and code signing.
Netis Cloud Probe is a production-grade network packet capture and forwarding system designed to monitor traffic without requiring dedicated TAP or SPAN hardware. It consists of a high-performance C capture engine (cpworker), a Go daemon (cpdaemon) that manages worker processes and communicates with a central policy manager (CPM), and a Go CLI (cpctl) for manual control. The system supports multiple capture sources (libpcap, DPDK, pcap files) and output sinks (GRE, VXLAN, ZMQ, rotating files) with a configurable execution model (real-time or pipelined using a lock-free SPSC ring buffer). Configuration reload is handled via a state-machine protocol, enabling hot-swapping of tasks without packet loss. The codebase is multi-language (C, Go) with CMake and Mage build systems, comprehensive unit and integration tests, and bilingual documentation (English, Chinese). It is actively maintained with a recent commit and continuous integration.