1.wireshark / wireshark
Read-only mirror of Wireshark's Git repository at https://gitlab.com/wireshark/wireshark. You're welcome to submit pull requests there.
- wireshark
- packet-capture
- tshark
- stratoshark
+922 stars
from 9,225 · score 6.83
Trending repositories
Ranked by Attention Score: stars gained over the last 180 complete days
20 repositories by Attention Score · May 9, 2026 – Nov 4, 2026 (UTC)
2.gojue / ecapture
Capture SSL/TLS plaintext with eBPF—no MITM proxy or custom CA installation. Supports Linux and Android on x86_64\arm64 and loong64.
+454 stars
from 15,077 · score 6.12
3.arkime / arkime
Arkime is an open source, large scale, full packet capturing, indexing, and database system.
- network-monitoring
- pcap
- packet-capture
- nsm
- javascript
- c
- +2 more
+231 stars
from 7,329 · score 5.45
4.basil00 / WinDivert
WinDivert: Windows Packet Divert
- windivert
- packet-capture
- packet-sniffer
- firewall
- divert-sockets
- network-programming
- +1 more
+196 stars
from 3,144 · score 5.28
5.linux-can / can-utils
Linux-CAN / SocketCAN user space applications
+122 stars
from 2,831 · score 4.81
6.cilium / pwru
Packet, where are you? -- eBPF-based Linux kernel networking debugger
+113 stars
from 3,734 · score 4.74
+110 stars
from 2,700 · score 4.71
8.the-tcpdump-group / libpcap
the LIBpcap interface to various kernel packet capture mechanism
- pcap
- pcapng
- packet-capture
- sniffer
- libpcap
- bpf
- +2 more
+104 stars
from 3,081 · score 4.65
9.hengyoush / kyanos
Kyanos is a networking analysis tool using eBPF. It can visualize the time packets spend in the kernel, capture requests/responses, makes troubleshooting more efficient.
- command-line-tool
- ebpf
- network
- bpf
- capture
- sniffer
- +4 more
+90 stars
from 4,988 · score 4.51
10.mozillazg / ptcpdump
Process-aware, eBPF-based tcpdump
- ebpf
- ebpf-tc
- tcpdump
- tcpdump-like
- ebpf-go
- network-capture
- +9 more
+73 stars
from 1,226 · score 4.30
+73 stars
from 1,083 · score 4.30
12.ntop / PF_RING
High-speed packet processing framework
- pf-ring
- capture-packets
- high-speed
- 100gbit
- 10gbit
- 40gbit
+71 stars
from 2,919 · score 4.28
13.pmacct / pmacct
pmacct is a small set of multi-purpose passive network monitoring tools [NetFlow IPFIX sFlow libpcap BGP BMP RPKI IGP Streaming Telemetry].
- netflow
- ipfix
- sflow
- bgp
- bmp
- kafka
- +14 more
+56 stars
from 1,201 · score 4.04
14.irontec / sngrep
Ncurses SIP Messages flow viewer
+50 stars
from 1,165 · score 3.93
15.appneta / tcpreplay
Edit and replay captured network traffic at arbitrary speeds — a suite of pcap tools for *NIX and Windows.
- tcpreplay
- pcap
- netmap
- c
- replays-pcap-files
- flow
- +5 more
+41 stars
from 1,312 · score 3.74
16.jpr5 / ngrep
ngrep is like GNU grep applied to the network layer. It's a PCAP-based tool that allows you to specify an extended regular or hexadecimal expression to match against data payloads of packets. It understands many kinds of protocols, including IPv4/6, TCP, UDP, ICMPv4/6, IGMP and Raw, across a wide variety of interface types, and understands BPF filter logic in the same fashion as more common packet sniffing tools, such as tcpdump and snoop.
- sniffer
- grepping
+29 stars
from 997 · score 3.40
+28 stars
from 897 · score 3.37
18.cisco / joyArchived
A package for capturing and analyzing network flow data and intraflow data, for network research, forensics, and security monitoring.
+13 stars
from 1,353 · score 2.64
19.gamelinux / passivedns
A network sniffer that logs all DNS server replies for use in a passive DNS setup
+7 stars
from 1,730 · score 2.08
20.Netis / cloud-probe
A Software Probe for network packet capturing and forwarding in Cloud/Kubernetes and Virtualized environment.
+7 stars
from 956 · score 2.08