USArmyResearchLab/Dshell

Health v2 · maintenance only

Flags: no_license

Adoption not part of the score

5492 stars · 1135 forks observed · 2026-08-28

What it is AI-extracted, prompt v1, taxonomy v1, 2026-08-29, confidence not recorded

Dshell is an extensible network forensic analysis framework written in Python for dissecting network packet captures (pcap/pcapng). It supports plugin development, stream reassembly, IPv4/IPv6, chainable plugins, and parallel processing.

Use cases

• analyze pcap files for network forensics
• dissect network packet captures with custom plugins
• reassemble TCP streams from packet captures
• investigate suspicious network traffic during incident response
• extract TLS metadata like JA3 fingerprints from pcaps
• chain multiple analysis plugins over a capture
• geolocate IP addresses seen in network traffic

When to choose

• you need to perform deep packet analysis on pcap files
• you want an extensible framework to write custom network forensic plugins
• you need stream reassembly with IPv4 and IPv6 support
• you are doing incident response or network security investigations on Linux

When to avoid

• you need a real-time network intrusion detection system rather than offline pcap analysis
• you require a GUI-based packet analyzer like Wireshark
• you need live traffic capture and analysis rather than processing saved capture files
• you work primarily on Windows or macOS since it is developed for Linux

Facets

framework · maturity active

security networking parser plugin-system developer-tools security networking developer-tools python cli network-forensics pcap-analysis packet-capture stream-reassembly digital-forensics incident-response forensics linux

Member repositories

For agents

markdown · JSON · MCP: product_card(name="USArmyResearchLab/Dshell")