google/stenographer

Health v2 · maintenance only

Flags: no_releases archived

Adoption not part of the score

1796 stars · 233 forks observed · 2026-08-28

What it is AI-extracted, prompt v1, taxonomy v1, 2026-08-30, confidence not recorded

Stenographer is a high-performance full-packet-capture utility that spools network packets to disk at up to ~10Gbps and manages disk usage by deleting the oldest files. It provides a simple BPF-like query language with time filters for quickly retrieving small subsets of captured packets.

Use cases

• capture all network traffic to disk for incident response
• buffer packets for intrusion detection analysis
• quickly retrieve specific packets from a large capture history
• query captured packets by IP, port, protocol, and time range
• retain as much packet history as disk allows with automatic rotation
• investigate a security incident after the fact with full packet data

When to choose

• you need full-packet capture at high throughput for forensics or IDS
• you only need to read back a small fraction (<1%) of captured packets
• you want automatic disk management with rolling deletion of old captures
• you prefer a simple BPF-subset query language with time filters

When to avoid

• you need complex packet processing like TCP stream reassembly
• you need to read back large portions of captured traffic
• you need real-time packet analysis or deep protocol inspection
• you need a tool that runs on non-Linux platforms

Facets

cli-tool · maturity maintenance

monitoring security search-engine cli security networking developer-tools go cli packet-capture full-packet-capture pcap network-forensics incident-response intrusion-detection bpf-query disk-buffering command-line linux

Member repositories

For agents

markdown · JSON · MCP: product_card(name="google/stenographer")