Chucker is a production-grade Android library for inspecting HTTP(S) traffic in-app. It acts as an OkHttp interceptor, capturing full request/response details (headers, bodies, timing, errors) and persisting them to a local Room database. The library provides a built-in Material Design UI for browsing, searching, filtering, and exporting transactions (HAR 1.2, plain text, curl commands). It is designed as a debug-only tool via a no-op variant for release builds. The architecture follows a clean separation: public API (ChuckerInterceptor, ChuckerCollector, BodyDecoder), internal data layer (Room entities, DAO, repository), support utilities (okio stream manipulation, JSON formatting, background services), and a full set of UI fragments/adapters. The codebase is well-tested (unit tests for interceptors, DAO, repository, utilities, ViewModels) and follows modern Android development practices (Kotlin, Coroutines, LiveData/Flow, ViewBinding, Compose sample). It handles edge cases like compressed bodies, large payloads, binary formats (protobuf), GraphQL, and SSL/TLS information. The project also includes CI/CD pipelines, automated dependency updates via Renovate, and migration guides for previous versions. While primarily an application library, it has a strong data storage component (Room database) and export functionality (HAR generation), making it useful for debugging network issues in any Android app.
Maltrail is a production-grade malicious traffic detection system that monitors network traffic in real-time, matching against a dynamic set of threat indicators (trails) and applying behavioral heuristics. It consists of two main components: a high-performance Rust sensor for packet capture and analysis, and a Python server for event intake, web dashboard, and API. The sensor uses libpcap for live capture or offline pcap replay, parses protocols (DNS, HTTP, TLS, QUIC), and performs trail matching and heuristic detection (port scanning, beaconing, DNS tunneling/exhaustion). Events are sent to the server via UDP or stored locally. The server provides a web UI for visualization, search, and management, supports remote logging to SIEMs (syslog, CEF, Logstash), and exposes a REST API for integration. The architecture is modular: the sensor is a multi-threaded Rust binary with lock-free metrics, memory-mapped trail stores, and fuzz-tested protocol parsers. The Python server handles configuration, trail updates from 40+ threat feeds, event logging, and the web interface. The system is designed for scalability with multi-worker capture, bounded memory heuristics, and efficient data structures (LRU caches, interned strings, hash tables). External dependencies include libpcap, SQLite, and various threat feed sources. The codebase demonstrates high craftsmanship with extensive testing (unit, integration, fuzz, parity tests between Rust and Python), CI/CD pipelines, and Docker/systemd deployment support.
RustNet is a cross-platform, real-time network monitoring terminal UI application. It captures packets via libpcap (or platform-specific backends like PKTAP on macOS, ETW on Windows), performs deep packet inspection (DPI) for protocols including HTTP, HTTPS, DNS, SSH, QUIC, BitTorrent, and many others, and attributes each connection to the owning OS process using eBPF (Linux), lsof (macOS), IP Helper (Windows), or sockstat (FreeBSD). The architecture is a multi-crate Rust workspace: `rustnet-core` provides connection tracking, DPI analyzers, GeoIP/OUI lookup, and rate/RTT tracking; `rustnet-capture` wraps libpcap; `rustnet-host` implements process lookup via a unified `ProcessLookup` trait; `rustnet-sandbox` handles privilege dropping and sandboxing (Landlock, Seatbelt, Windows job objects). The main binary (`rustnet-monitor`) orchestrates capture, enrichment, and a ratatui-based TUI with tabs for Overview, Details, Activity, Graph, and Host. It supports PCAP/PCAPNG export with process metadata, JSONL event logging, Kubernetes pod attribution, and a rich theme system with multiple presets. The codebase is well-structured, extensively tested, and actively maintained with CI/CD for multiple platforms and packaging (DEB, RPM, DMG, MSI, Homebrew, Chocolatey).
nettrace is a Linux network diagnostic tool based on eBPF that traces network packet lifecycle, performs fault diagnosis, and monitors network abnormalities. The architecture centers around a main CLI application (nettrace.c) that loads and attaches eBPF programs (primarily in src/progs/kprobe.c) to kernel functions and tracepoints. As packets traverse the network stack, eBPF programs capture event data sent to user space via perf buffers, where it's processed by analysis.c for diagnostic rule matching and formatted by output.c for display. Key features include basic packet tracing, diagnostic mode with automated problem identification, drop monitoring, socket tracking, and latency/RTT analysis. The tool relies on external dependencies like libbpf, libelf, and bpftool for eBPF program loading and compilation.
The TrafficMonitor repository is a Windows desktop application built with MFC that monitors network traffic, system resources (CPU, memory, GPU, disk), and hardware temperatures. It displays real-time statistics in a floating window or embedded in the taskbar, supports customizable skins, and features a plugin system for extensibility. The application includes historical traffic logging, auto-start capabilities, multi-language support, and automatic update checking. Architecturally, the application follows a modular design with distinct components for the main UI, taskbar integration, plugin management, skinning, and settings persistence. It employs multiple rendering backends (GDI, Direct2D, Direct2D+DComposition) for compatibility across Windows versions and hardware configurations. The plugin system uses versioned interfaces to ensure compatibility, while the skinning system supports both XML and INI-based themes with live preview functionality. Key reusable components include a well-designed plugin architecture with version negotiation, a flexible skinning system that abstracts UI theming, a centralized settings persistence layer using INI files, and a rendering abstraction layer that supports multiple graphics backends. These components demonstrate non-obvious craftsmanship in areas such as plugin callback handling, resource management for graphics devices, and lazy initialization patterns. Despite its strengths, the codebase exhibits some maintenance challenges due to its complexity, multiple rendering paths, and dependence on platform-specific Windows APIs. However, active maintenance is evidenced by recent commits and a large community of users and contributors. The application balances feature richness with engineering practices that allow for extension and customization, making it a solid example of a Windows utility application.
Sniffnet is a cross-platform desktop GUI application for real-time network traffic monitoring and analysis, written in Rust using the Iced framework. It captures packets via pcap (live or from PCAP files) and also supports IPFIX flow collection over UDP. The application parses Ethernet, IP, TCP/UDP, ICMP, IGMP, ARP, and VLAN headers using a dedicated packet-parser library. It enriches captured traffic with geolocation (MaxMind GeoLite2 and IPinfo MMDB databases), ASN lookups, service identification (from a port-to-service map derived from nmap-services), and local process identification (via the listeners crate). The GUI provides multiple pages: an overview with live traffic charts and donut charts, an inspect page with a filterable and sortable connection table, a notifications page for alerts (thresholds, favorites, IP blacklists), and settings pages for themes, filters, and export. The application supports 25 languages, custom themes, and thumbnail mode for minimal monitoring. It is packaged for Linux (deb, rpm, AppImage), macOS (dmg), and Windows (msi), with CI/CD pipelines for cross-compilation and code signing.
picosnitch is a Linux daemon for per-executable network bandwidth monitoring using eBPF (CO-RE) and fanotify. It tracks which executables make network connections, records bytes sent/received, timestamps, and metadata (SHA256 hashes, optional VirusTotal and GeoIP lookups). The system provides real-time and historical views via multiple interfaces: a curses TUI (both live top and historical browser), a web UI, and a UNIX socket live feed. The daemon uses a multiprocess architecture with privilege-separated subprocesses for monitoring, event processing, database writes, notifications, and external API queries. It supports local SQLite storage and optional remote SQL (MariaDB/MySQL/PostgreSQL) for tamper-evident logging. The repository also includes a comprehensive comparative benchmark suite (bench/) that tests picosnitch against nine other network monitors across 24 scenarios, with a reusable ToolAdapter framework for running controlled experiments.
Netis Cloud Probe is a production-grade network packet capture and forwarding system designed to monitor traffic without requiring dedicated TAP or SPAN hardware. It consists of a high-performance C capture engine (cpworker), a Go daemon (cpdaemon) that manages worker processes and communicates with a central policy manager (CPM), and a Go CLI (cpctl) for manual control. The system supports multiple capture sources (libpcap, DPDK, pcap files) and output sinks (GRE, VXLAN, ZMQ, rotating files) with a configurable execution model (real-time or pipelined using a lock-free SPSC ring buffer). Configuration reload is handled via a state-machine protocol, enabling hot-swapping of tasks without packet loss. The codebase is multi-language (C, Go) with CMake and Mage build systems, comprehensive unit and integration tests, and bilingual documentation (English, Chinese). It is actively maintained with a recent commit and continuous integration.
simplewall is a native Windows desktop application that functions as a personal firewall using the Windows Filtering Platform (WFP). It controls per-application network access via user-defined rules and blocklists, including built-in Microsoft spy/telemetry lists. The application provides a full GUI with tabs for applications, services, UWP packages, rules, network connections, and logs, along with a tray icon, notification popups, and a rule editor. It logs allowed/blocked connections to a CSV file and supports real-time network monitoring via TCP/UDP statistics (including ETW-based UDP accounting). Profiles are stored in XML format with optional compression and AES encryption, and filters can be installed permanently, temporarily, or at boot time. The architecture is a monolithic C/C++ Win32 application with a custom utility library ("routine") as a submodule. Key modules handle WFP filter lifecycle, WFP net event subscription, network connection enumeration, security descriptor management, and UI controls (listview, search bar, notifications). The code demonstrates deep Windows internals knowledge, including WFP version-specific callbacks, ETW session management, cryptographic hashing, and digital signature verification. While the application is actively maintained (latest beta v3.9.1 as of July 2026), it is tightly coupled to Windows APIs and contains workarounds for historical Microsoft bugs, leading to moderate technical drift risk. Strengths include comprehensive WFP integration, robust logging, and a well-organized codebase with reusable patterns for WFP security (ACL management) and ETW-based UDP monitoring. Weaknesses include reliance on a private library submodule, hardcoded service/port lookup tables, and Windows version-specific branches that may need adjustment for future releases. The project is suitable for developers seeking a reference implementation for WFP firewall development or a reliable Windows filtering tool.
SpyGuard is a network traffic analysis tool designed for detecting signs of compromise, particularly stalkerware and spyware, by monitoring WiFi traffic from connected devices. It consists of a frontend Vue.js 3 application for user interaction and capture initiation, and a backend Flask API for managing configuration, threat intelligence, and analysis. The core analysis engine processes PCAP files using Suricata, checks traffic against IOC databases and whitelists, performs heuristic and active checks (passive DNS, WHOIS, SSL validation), and generates JSON/PDF reports. External watchers periodically update threat intelligence feeds from sources like Cisco Umbrella and IP-to-ASN mappings. The architecture separates concerns: frontend handles capture UI and device management, backend provides authenticated APIs for system administration, and the analysis engine performs the detection logic. Key entry points include server/frontend/main.py (frontend service), server/backend/main.py (backend API), server/backend/watchers.py (threat intelligence updater), and analysis/analysis.py (analysis trigger).
SmokePing is a mature network latency monitoring and visualization application written in Perl. It measures round-trip time and packet loss to targets using a wide variety of pluggable probes (ICMP, TCP, HTTP, DNS, SSH, SNMP, etc.), stores the time-series data in RRD files, and presents interactive web-based graphs via a CGI/FastCGI interface. The architecture includes a daemon that runs probes on a schedule, a master/slave mode for distributed monitoring, and an alerting system that can trigger notifications based on configurable patterns or matcher plugins. While primarily an application, it also includes data analysis components such as matchers and sorters that compute statistics (median, loss, standard deviation) from stored data. The codebase is monolithic in parts (Smokeping.pm >3000 lines) and uses outdated JavaScript libraries, but offers well-designed extensibility through probe base classes and a self-contained SNMP stack (BER.pm, SNMP_Session.pm) that could be reused independently.
Honey Potion is a compiler framework that translates a subset of the Elixir programming language into eBPF (extended Berkeley Packet Filter) programs, targeting both tracepoints and XDP. The system works as an Elixir library (published on Hex as `honey`) where users write eBPF logic in Elixir using macros like `@sec`, `defmap`, and `fuel`. At compile time, `__before_compile__` triggers a pipeline: static analysis, optimization (constant propagation, dead code elimination, type propagation), AST-to-C translation, boilerplate generation, and C compilation via `make`/`clang`/`llc`/`bpftool`. The generated C code includes a custom runtime with heap, tuple pool, and string pool implemented using BPF maps to overcome eBPF's stack and memory constraints. The repository includes 20+ example programs (system monitors, packet filters, data structure demos) and a comprehensive benchmark suite comparing hand-written C eBPF programs to Honey-generated ones, supporting a published research paper. Although classified as an application (a compiler library), the project has strong research characteristics with reproducible artifact scripts, optimizer variants, and performance comparisons.
LinuxGun is a collection of Bash shell scripts for Linux security incident response and system hardening. The core scripts (`linuxGun.sh`, `linuxGunPro.sh`, `linuxcheck.sh`) perform comprehensive checks across system information, user accounts, network connections, processes, files, logs, backdoors, tunnels, webshells, malware, memory, hacker tools, kernel modules, Kubernetes, and baseline security configurations. The toolset is designed for emergency triage by system administrators and security analysts, with color-coded output and modular function organization. It includes auxiliary tools for IP blocking (`blockIP.sh`), network interface monitoring (`monitorInter.sh`), process-to-IP connection mapping (`monitorPs2Ip.sh`), and a file upload server (`uploadServer.py`) for transmitting results. The repository also contains AI skill definitions (in `AI-skills/old/`) that describe an automated incident response workflow via SSH, though these appear to be experimental or deprecated. The codebase is functional but shows signs of rapid iteration, hardcoded assumptions (CentOS 7, specific command availability), incomplete modules, and mixed-language comments (Chinese/English). It is not a polished library but a practical, field-tested toolkit for Linux forensics.