dreadl0ck/netcap

Health v2 · maintenance only

Adoption not part of the score

1805 stars · 168 forks observed · 2026-08-28

What it is AI-extracted, prompt v1, taxonomy v1, 2026-08-30, confidence not recorded

Netcap is a Go framework that converts network packets into structured, type-safe Protocol Buffer audit records for security monitoring, forensics, and machine learning. It ships as a single binary with 83 packet decoders, 40+ stream decoders, 141+ audit record types, and a built-in web UI for visualization and analysis.

Use cases

• analyze pcap files and extract structured audit records
• monitor network traffic for security threats
• fingerprint TLS, HTTP, and SSH clients with JA4
• detect malware in transferred files with YARA rules
• reconstruct TCP and UDP streams from captures
• feed network features into machine learning models
• inspect industrial control system protocols like Modbus and S7Comm
• visualize protocol hierarchy and host communication

When to choose

• you need scalable, concurrent full-packet analysis on Linux, macOS, or Windows
• you want structured, machine-readable output instead of ad-hoc pcap parsing
• you need broad protocol coverage including industrial protocols
• you are building security monitoring, forensics, or ML pipelines on network data

When to avoid

• you only need simple packet capture without structured analysis
• you require a lightweight passive sniffer with minimal resource usage
• you need a GUI-first tool rather than a CLI/service framework
• your license requirements are incompatible with GPL-3.0

Facets

framework · maturity active

networking security monitoring analytics machine-learning data-science security networking monitoring analytics machine-learning windows cross-platform cli go network-traffic-analysis packet-capture audit-records protocol-buffers pcap forensics intrusion-detection ja4-fingerprinting yara stream-reassembly linux macos

Member repositories

For agents

markdown · JSON · MCP: product_card(name="dreadl0ck/netcap")