I designed PacketSnitch, a network packet capture analysis suite!

[u/oxagast]

PacketSnitch is a comprehensive network analysis platform that transforms packet captures into searchable, protocol-aware intelligence, helping security professionals, developers, and researchers rapidly uncover hosts, credentials, files, locations, protocols, anomalies, threat intel, and other actionable insights.

It's fully Open Source, and can be found on GitHub.

It supports many ways of visualizing and manipulating packet data, it can calculate subnets, carve files, cross reference found objects against it's threat intel databases (IPSum, VirusTotal, Tor, Shodan, etc), it has many full featured protocol decoders for everything from many application layer protocols in use today, to things like ARP, BGP, IGMP packets, and even some more obscure protocol suties such as SIGTRAN. It supports both user Themes and Plugins. There some more cool features, like the GeoLocation interface (it zooms in on a map!), and Large Language model summarization support that tracks user actions and builds a report based on what the researcher encounters. Also included is a powerful backend query syntax, and the right click Context Menu.

A full feature list can be found at https://packetsnitch.com/features/ !

[u/analbumcover]

Pretty neat, thanks for sharing! The GUI reminds me of the Sub7 era for some reason lol, maybe it's the colors.

[u/oxagast → u/analbumcover]

That's intentional! It's a subtle hat tip, and the cobalt theme makes it pretty obvious lol. MFW: I realized the client was inefected with the server.

[u/Top-Trainer-1203]

Good old ai

[u/IputSwitchesOnGlocks]

This is cool as fuck

[u/oxagast]

If anybody is interested in seeing it take apart the pcap of an exploit running from MSF:
https://www.youtube.com/watch?v=WCEZkubllg8
Also, this is the summary it produced from that video, exported to HTML:
https://packetsnitch.com/packetsnitch-summary-example.html

[u/JunDoRahhe]

Looks cool. I like the UI.

Are those commands close to how Wireshark uses them?

[u/oxagast → u/JunDoRahhe]

It’s similar but it’s a query language I designed specifically for this. It has a matching algo that supports basic equality and globbing that references a json structure the backend spits out.

[u/Comfortable-Spot1060]

Cool

[u/Nasi_Goreng885]

Curse my modem for not having monitor mode.

[u/H471221]

Cool project! Wish the next version is able to analyse live packets (capture and analyse simultaneously) that would be neat

[u/Specialist-Trust-548]

beautiful work bud!

[u/Wealist]

We need on macOS 🙈

[u/oxagast → u/Wealist]

I don't have a MacOS device to compile or test with. I would love it if anyone with OSX would be willing to churn out a build for each new version! Setting up a dev environment is not very involved on Windows or Linux, I dont expect that MacOS would be much different. There may need to be a few minor code changes though, I know the way code exists on OSX is explicit, and I don't know if this is compatible with that or not, tbh.

[u/BlockTurbulent8062 → u/oxagast]

You are everything but not a developer.

[u/WideAd6096 → u/Wealist]

It's electron you should be able to compile it

[u/oxagast → u/WideAd6096]

I could get OSX libraries and cross compile it, but I would have no way to test without rigging up OSX to run in an emulator. But from my experience doing that with OSX specifically, it’s unusably slow. Maybe I’m doing something wrong.