Wireshark is a world-class network protocol analyzer application. It captures live traffic or reads saved capture files (pcap, pcapng, etc.) and dissects them into a structured, hierarchical view of hundreds of network protocols. The application is built on a modular architecture: `libwsutil` (utilities), `libwiretap` (capture file I/O), and `libwireshark` (dissection engine). It provides a rich Qt-based graphical user interface (Wireshark) and a powerful command-line interface (TShark). Key features include a custom domain-specific language for display filtering (with its own compiler and virtual machine), a Lua scripting API for extensibility, a plugin system for protocol dissectors, and support for decrypting various protocols (TLS, IPsec, 802.11). The codebase is exceptionally well-engineered, with clean abstractions and highly reusable components like its scope-based memory manager (`wmem`) and its file format abstraction layer (`wiretap`). It is under very active maintenance and is the de-facto standard tool for network analysis.
Homer is a production-grade, all-in-one HEP (Homer Encapsulation Protocol) capture and API server for SIP, RTP, RTCP, OTLP, and log data. It powers Homer 11.x data lake with DuckDB, Parquet, and Apache Arrow. The system ingests packets over UDP, TCP, TLS, HTTP, and WebSocket, decodes them using a custom zero-copy SIP parser, and stores them in a columnar DuckLake (DuckDB-backed) storage with SQLite catalog, supporting S3 and Azure backends. It provides a REST API (Echo) for search, dashboards, alerts, and configuration, an Arrow FlightSQL server for Grafana integration, and a React/TypeScript dashboard with drag-and-drop widgets, call flow visualization, and even browser-based games (chess, Doom). Architecture is modular with four main components: Ingest (transport servers), Storage (DuckLake manager with sharded writers, compactor, tiered mover), Node (FlightSQL server, catalog metadata), and Coordinator (REST API, auth, Lua correlation engine, LLM integration). Data flows from HEP/OTLP/Line Protocol receivers through decoders into DuckLake, then served via FlightSQL or REST. External dependencies include DuckDB, S3/Azure SDKs, Lua (golua), OTLP protobuf, and InfluxDB Line Protocol parser. The codebase demonstrates strong engineering practices: object pools for hot-path allocations, idempotent stop patterns, retry with backoff for catalog operations, and a Lua sandbox for scripting. However, it also carries some feature creep (games, LLM) and technical debt (dual SIP parsers, SQL injection risks via string interpolation in some services, and a few commented-out tests). Overall, it is a well-maintained, high-quality observability platform for VoIP and telemetry data.
Sniffnet is a cross-platform desktop GUI application for real-time network traffic monitoring and analysis, written in Rust using the Iced framework. It captures packets via pcap (live or from PCAP files) and also supports IPFIX flow collection over UDP. The application parses Ethernet, IP, TCP/UDP, ICMP, IGMP, ARP, and VLAN headers using a dedicated packet-parser library. It enriches captured traffic with geolocation (MaxMind GeoLite2 and IPinfo MMDB databases), ASN lookups, service identification (from a port-to-service map derived from nmap-services), and local process identification (via the listeners crate). The GUI provides multiple pages: an overview with live traffic charts and donut charts, an inspect page with a filterable and sortable connection table, a notifications page for alerts (thresholds, favorites, IP blacklists), and settings pages for themes, filters, and export. The application supports 25 languages, custom themes, and thumbnail mode for minimal monitoring. It is packaged for Linux (deb, rpm, AppImage), macOS (dmg), and Windows (msi), with CI/CD pipelines for cross-compilation and code signing.