netcap

**Netcap** (NETwork CAPture) converts network packets into structured, type-safe Protocol Buffer audit records — designed for security monitoring, forensic analysis, and machine learning. A single Go binary with 83 packet decoders, 40+ stream decoders, and 141+ audit record types, backed by a concurrent architecture and a built-in web UI.

Protocol hierarchy visualization in the Netcap web UI — more screenshots

## Features ### Protocol Analysis - **83 packet-layer decoders** — Ethernet, IPv4/6, TCP, UDP, DNS, DHCP, ARP, TLS ClientHello/ServerHello, ICMP, NTP, SIP, OSPF, BGP, MPLS, GRE, VXLAN, 802.11, and many more - **40+ stream decoders** — TLS, SSH, HTTP/2, QUIC, SMB, FTP, SMTP, POP3, IMAP, IRC, Kerberos, DCERPC, and more - **Industrial protocols** — Modbus, S7Comm, DNP3, OPC-UA, PROFINET, BACnet, CIP, IEC 62351 - **Full TCP/UDP stream reassembly** with configurable limits ### Web UI Built-in React (Vite + TypeScript) dashboard in service mode with interactive visualizations: - Sankey diagrams, treemaps, 3D scatter plots, geo maps, host communication graphs - Record browsing with JSON/UI views and field-level filtering - Protocol statistics, connection analysis, host profiling, alert management See the [Gallery](docs/GALLERY.md) for screenshots. ### Security Analysis - **JA4 fingerprinting** — JA4, JA4S, JA4H, JA4SSH, JA4X for TLS, HTTP, SSH, and X.509 classification - **YARA rules** — file scanning with compiled yara-x rules for malware detection - **Magika AI** — Google's AI-based file type classification on extracted files - **Credential harvesting** — configurable protocol-aware credential capture - **File extraction** — extract files from HTTP, FTP, SMTP, POP3, IMAP, SMB, IRC with hashing (MD5, SHA1, SHA256) and MIME detection - **Detection rules** — 30+ YAML rule categories covering reconnaissance, exfiltration, web attacks, industrial ports, and more. The expression engine supports source→distinct-destination cardinality (fan-out) detection, an approved-workstation allowlist (`IsApprovedWorkstation`), and time-of-day helpers (`IsBusinessHours`, `HourOfDay`) - **OT/ICS threat hunting** — function-code level Siemens S7comm detection (write / logic download / logic theft / PLC stop / CPU restart) mapped to [CISA AA26-231A](docs/s7-threat-hunt-AA26-231A.md); ships `rules/examples/s7comm_hunt.yml` ### Output Formats - **Protocol Buffers** (default) — compact binary, accessible from any language - **CSV** — configurable separators for data analysis pipelines - **JSON** — human-readable structured output - **Elasticsearch** — direct bulk indexing for ELK stack analysis ### Enrichment - DNS reverse resolution - GeoIP geolocation (MaxMind) - MAC vendor lookup - Deep Packet Inspection (optional, via nDPI/libprotoident) - **Hyperscan / Vectorscan** acceleration (optional) — multi-pattern regex prefilter for nmap service probes (~2.2× faster), CMS/web framework detection (~1.4×) and rule-engine `MatchesPattern` (up to ~6× on miss-heavy detection traffic), see [docs/hyperscan.md](docs/hyperscan.md) ### Integrations - **Prometheus + Grafana** — real-time metrics and dashboards - **Elasticsearch + Kibana** — full-text search and visualization - **Maltego** — 45+ OSINT entity types and transforms ### Distributed Capture Agent/collector architecture for multi-sensor deployments with encrypted communication and configurable collection servers. ## Quick Start Pre-built binaries are available on the [Releases](https://github.com/dreadl0ck/netcap/releases) page. To build from source: ``` … ``` ## Subcommands | Command | Description | |---------|-------------| | `capture` | Capture audit records from live interfaces or PCAP files; `--service` enables the web UI | | `dump` | Read and display audit record files in CSV, JSON, or table format | | `label` | Apply attack labels to audit records using Suricata or CSV mappings | | `collect` | Collection server for receiving data from distributed agents | | `agent` | Sensor agent for distributed capture on remote hosts | | `proxy` | HTTP/HTTPS reverse proxy with MITM traffic inspection | | `export` | Export audit records with Prometheus metrics exposure | | `transform` | Maltego OSINT transform plugin | | `util` | Utilities: timestamp conversion, interface listing, database generation, search indexing | | `inject` | Inline packet manipulation via NFQueue (Linux) | | `split` | Split audit record files | ## Docker Pre-built images are available for multiple configurations: | Image | Description | |-------|-------------| | Alpine | Minimal image with full DPI support | | Alpine (nodpi) | Lightweight, no DPI dependencies | | Ubuntu | Full-featured Ubuntu-based image | | Service | Web UI service mode image | See the [`docker/`](docker/) directory for all Dockerfiles and build variants. ## Documentation - [Documentation](https://docs.netcap.io) — full usage guide - [Homepage](https://netcap.io) — project homepage - [DeepWiki](https://deepwiki.com/dreadl0ck/netcap) — AI-powered codebase exploration - [Thesis](https://github.com/dreadl0ck/netcap/blob/master/mied18.pdf) — original research paper ## Contributing Contributions welcome — from protocol decoder additions to core framework improvements. **Development Setup:** - [macOS Development Setup Guide](docs/macos-development-setup.md) - [Installation Guide](docs/installation.md) Please use the [bug report template](https://github.com/dreadl0ck/netcap/blob/master/docs/bugreport.md) for issue reports. ## License Netcap is licensed under the GNU General Public License v3, which is a very permissive open source license, that allows others to do almost anything they want with the project, except to distribute closed source versions. This license type was chosen with Netcap's research purpose in mind, and in the hope that it leads to further improvements and new capabilities contributed by other researchers on the long term.