Pcap Python Packages

scapy

Scapy: the Python-based interactive packet manipulation program & library.

pypcap

pypcap - python libpcap module, forked from code.google.com/p/pypcap

pypcapkit

Python-based Comprehensive Network Packet Analysis Library

scapy-python3

Network packet and pcap file crafting/sniffing/manipulation/visualization security tool. Originally forked from scapy in 2015 and providing python3 compatibility since then.

nfstream

NFStream: a Flexible Network Data Analysis Framework.

python-libpcap

Cython libpcap

tenzir

Tenzir is the data pipeline engine for security teams.

ntpstats

Open-source toolkit for NTP and PTP: Allan deviation, TDEV, MTIE and time error from chrony, ntpd, ntpd-rs and linuxptp logs and packet captures

cypcap

A Cython based Python binding for modern libpcap

pyvast

Tenzir is the data pipeline engine for security teams.

dissect-cobaltstrike

Python library for dissecting and parsing Cobalt Strike related data such as Beacon payloads and Malleable C2 Profiles

oida-ics

Scan, fuzz, and assess OT protocols from one CLI.

wireshark-mcp

Wireshark-MCP，Give your AI assistant a packet analyzer. Drop a .pcap file, ask questions in plain English — get answers backed by real tshark data.

pywhat

🐸 Identify anything. pyWhat easily lets you identify emails, IP addresses, and more. Feed it a .pcap file or some text and it'll tell you what it is! 🧙‍♀️

mcpcap

Network analysis for the AI age

netforensicai

Local-first, open-source DFIR investigation platform. Correlates pcap, JSON/CSV and Windows EVTX/Sysmon evidence into one traceable timeline, entity graph and evidence-cited findings - with offline detection rules, MITRE ATT&CK mapping, a local web UI, live capture, and an optional AI assistant that cannot fabricate citations.

mcp-server-malcolm

Ask an AI agent about your Malcolm network traffic. MCP server for Zeek, Suricata, Arkime and NetBox data, read-only until you opt in to writes.

zkg

A package manager for Zeek

drift-evidence

Does a device's real network traffic match what it's declared to be allowed to contact? Checked against a real packet capture.

network-sandbox-engine

A deterministic network sandbox for testing nftables rules. It uses ephemeral Linux network namespaces (netns) and Scapy to validate firewall logic safely.

pcaptoparquet

A package for converting PCAP files to parquet format.

telcoladder

Turn telecom signalling captures into explained call-flow ladders — 5G core, 4G EPC, IMS

omcipcap

GPON/XGS-PON OMCI Semantic Analysis Framework for ITU-T G.988 protocols (ONT Management and Control Interface).

scapydhcpserver

scapy-dhclient scapy-dhcpd scapy-pppoe-client scapy-pppoe-server