# deepfence/PacketStreamer

:star: :star: Distributed tcpdump for cloud native environments :star: :star:

Repository: https://github.com/deepfence/PacketStreamer
Canonical: https://ross.abutalabs.com/products/packetstreamer
Language: Go
License: Apache-2.0
License Family: permissive
Topics: soc, network-analysis, tcpdump-like, packet-capture, packet-sniffer, observability, security-tools, snort, zeek, suricata, pcap, traffic-monitoring, infosectools, secops, forensics-tools, hacktoberfest
Archived: true
Last push: 2024-07-01T09:09:55+00:00

## Health v2 (maintenance only)
Score: 10/100 (v2, computed 2026-09-02T17:46:02.011165+00:00)
- activity 0, release rhythm 8, longevity 100
- inputs: {"age_days": 1622, "days_push": 793, "days_rel": null, "gap_med": null, "n_releases_24m": 0}
- flags: archived
- formula: round(0.45*activity + 0.35*rhythm + 0.20*longevity); archived -> min(score, 10)

## Adoption (not part of the score)
Stars 1929, forks 244 (observed 2026-08-28T04:05:55.981029+00:00)

## What it is
PacketStreamer is a distributed, high-performance remote packet capture tool that runs lightweight sensors on target hosts to stream filtered network traffic to a central receiver. The receiver aggregates streams from multiple sensors into pcap files that can be fed to tools like Zeek, Wireshark, or Suricata for analysis.

## Use cases
- capture packets from multiple remote servers into a central pcap file
- collect network traffic from Kubernetes nodes for forensic analysis
- stream live network traffic to Zeek, Suricata, or Wireshark
- run lightweight tcpdump-like capture across cloud workloads
- gather raw packets on demand from VMs and AWS Fargate tasks
- apply BPF filters and stream filtered traffic with TLS encryption
- centralize packet capture for security monitoring and incident response

## When to choose
- you need distributed packet capture across many hosts with a central collection point
- you want minimal performance overhead on the machines being monitored
- you need to feed raw traffic into existing analysis tools like Zeek or Suricata
- you are running cloud native workloads on Kubernetes, Docker, or Fargate
- you need encrypted or compressed traffic streams from remote sensors

## When to avoid
- you only need packet capture on a single local machine
- you want built-in protocol analysis or alerting rather than raw capture
- you need deep packet inspection or IDS functionality out of the box
- your environment is not Linux or Windows based

## Facets
- artifact type: cli-tool
- maturity: active
- function: networking, monitoring, security, tracing, analytics
- domain: security, networking, cloud-computing, self-hosted, developer-tools
- platform: windows, cloud, self-hosted, go, cli
- tags: packet-capture, tcpdump, pcap, distributed-tracing, network-forensics, traffic-streaming, bpf-filters, tls-encryption, suricata, zeek, wireshark, snort, sensor-receiver-architecture, kubernetes, aws-fargate, forensics, soc, observability, packet-sniffer, remote-capture, devops, containers, linux, docker

## Member repositories
- deepfence/PacketStreamer (main) score 10

## Provenance
- Observed fields: from GitHub, fetched 2026-08-28T04:05:55.981029+00:00.
- Health v2: computed from the inputs above; adoption is never an input.
- Inferred fields (summary, facets, guidance): AI-extracted, prompt v1, taxonomy v1, on 2026-08-30T03:09:01.978710+00:00, confidence not recorded.
  - readme: https://github.com/deepfence/PacketStreamer (fetched 2026-08-28T04:05:55.981029+00:00, sha b84af50b7fd0)
- Data as of 2026-08-30T08:39:29.467469+00:00.