An analyzer for parsing GQUIC traffic in Zeek, supporting versions Q039 to Q046, with a fingerprinting method named 'CYU' for detecting anomalous GQUIC traffic.
httpry is a specialized packet sniffer designed for displaying and logging HTTP traffic. It is not intended to perform analysis itself, but to capture, parse, and log the traffic for later analysis. It can be run in real-time displaying the traffic as it is parsed, or as a daemon process that logs to an output file. It is written to be as lightweight and flexible as possible, so that it can be easily adaptable to different applications. What can you do with it? - See what users on your network are requesting online - Check for proper server configuration (or improper, as the case may be) - Research patterns in HTTP usage - Watch for dangerous downloaded files - Verify the enforcement of HTTP policy on your network - Extract HTTP statistics out of saved capture files - It's just plain fun to watch in realtime Here's an example of the log file output using the default output format string: # httpry version 0.1.8 # Fields: timestamp,source-ip,dest-ip,direction,method,host,request-uri,http-version,status-code,reason-phrase 2009-01-12 15:02:31 192.168.0.16 209.85.171.103 > GET www.google.com / HTTP/1.1 - - 2009-01-12 15:02:31 192.168.0.16 209.85.171.103 > GET www.google.com / HTTP/1.1 - - 2009-01-12 15:02:32 192.168.0.16 209.85.171.103 > GET www.google.com / HTTP/1.1 - - 2009-01-12 15:02:33 192.168.0.16 209.85.171.103 > GET www.google.com / HTTP/1.1 - - 2009-01-12 15:02:33 209.85.171.103 192.168.0.16
An analyzer for parsing GQUIC traffic in Zeek, supporting versions Q039 to Q046, with a fingerprinting method named 'CYU' for detecting anomalous GQUIC traffic.
Independent software vendor specializing in network security tools and network forensics.
A simple web crawler written in Go
Netcap efficiently converts network packets into structured audit records for machine learning algorithms, using Protocol Buffers for encoding.
Automated signature creation using honeypots for network intrusion detection systems.
Cilium is a networking, observability, and security solution with an eBPF-based dataplane.