packetsnitch 1.5.602 → 1.5.604
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/.webpack/x64/renderer/main_window/index.js +1 -1
- package/LICENSE.md +636 -0
- package/README.md +178 -0
- package/package.json +1 -1
package/README.md
ADDED
|
@@ -0,0 +1,178 @@
|
|
|
1
|
+
# PacketSnitch
|
|
2
|
+
|
|
3
|
+
<p align="center">
|
|
4
|
+
<img src="https://github.com/oxasploits/PacketSnitch/blob/main/Logo/packet-snitch-tag-transp-whitetext.png" alt="PacketSnitch" width="400">
|
|
5
|
+
</p>
|
|
6
|
+
|
|
7
|
+
<p align="center">
|
|
8
|
+
<a href="https://github.com/oxasploits/PacketSnitch/releases">
|
|
9
|
+
<img src="https://img.shields.io/github/v/release/oxasploits/PacketSnitch?include_prereleases&label=Release" alt="Release">
|
|
10
|
+
</a>
|
|
11
|
+
<a href="https://www.gnu.org/licenses/gpl-3.0">
|
|
12
|
+
<img src="https://img.shields.io/github/license/oxasploits/PacketSnitch?label=License" alt="License">
|
|
13
|
+
</a>
|
|
14
|
+
<a href="https://github.com/oxasploits/PacketSnitch/releases">
|
|
15
|
+
<img src="https://img.shields.io/badge/platform-Windows%20%7C%20Linux-blue" alt="Platform">
|
|
16
|
+
</a>
|
|
17
|
+
</p>
|
|
18
|
+
|
|
19
|
+
---
|
|
20
|
+
|
|
21
|
+
## What is PacketSnitch?
|
|
22
|
+
|
|
23
|
+
PacketSnitch is a **network packet analysis tool** that combines a Python backend with an Electron frontend to help you explore and filter captured network traffic — no command line required after initial setup.
|
|
24
|
+
|
|
25
|
+
| Component | Description |
|
|
26
|
+
| --------- | ----------- |
|
|
27
|
+
| **Backend** | Python script (`snitch.py`) that parses `.pcap` files and extracts rich per-packet metadata into JSON |
|
|
28
|
+
| **Frontend** | Electron-based desktop application for loading, browsing, filtering, and visualizing traffic |
|
|
29
|
+
|
|
30
|
+
### Key Features
|
|
31
|
+
|
|
32
|
+
- 📂 **Load PCAP files** — Point the backend at a capture, then explore interactively in the desktop app
|
|
33
|
+
- 🔍 **Powerful filtering** — Filter by port, country, entropy, MIME type, and more using dot-notation expressions
|
|
34
|
+
- 🌍 **GeoIP integration** — See source/destination locations with country, city, and timezone
|
|
35
|
+
- 📊 **Payload analysis** — Shannon entropy visualization, MIME type detection, hex dump with ASCII view
|
|
36
|
+
- 🤖 **LLM summaries** — Generate AI-powered analysis reports using Ollama
|
|
37
|
+
- 📑 **Protocol decoding** — DNS, HTTP, SSL/TLS, DHCP, NTP, SIP, and more
|
|
38
|
+
|
|
39
|
+
---
|
|
40
|
+
|
|
41
|
+
## Quick Start
|
|
42
|
+
|
|
43
|
+
### Installation
|
|
44
|
+
|
|
45
|
+
Download a pre-built release from the [releases](https://github.com/oxasploits/PacketSnitch/releases) page:
|
|
46
|
+
|
|
47
|
+
- **Windows:** `.exe` installer
|
|
48
|
+
- **Linux:** `.deb` or `.rpm` packages
|
|
49
|
+
|
|
50
|
+
Launch the app with `packetsnitch` or click the desktop icon.
|
|
51
|
+
|
|
52
|
+
### Basic Workflow
|
|
53
|
+
|
|
54
|
+
1. **Load PCAP** — Click **Load PCAP** to run the backend on a `.pcap` file
|
|
55
|
+
2. **Browse packets** — Use **Prev / Next** buttons or select a host from the dropdown
|
|
56
|
+
3. **Filter** — Type expressions like `tcp.dst.port:443` and press **Enter**
|
|
57
|
+
4. **Summarize** — Click **Summary** for LLM-generated analysis (requires Ollama)
|
|
58
|
+
|
|
59
|
+
---
|
|
60
|
+
|
|
61
|
+
## The Interface
|
|
62
|
+
|
|
63
|
+
<p align="center">
|
|
64
|
+
<img src="https://raw.githubusercontent.com/oxasploits/PacketSnitch/refs/heads/main/Documentation/screenshots/ps-views.gif" alt="PacketSnitch main view" width="950">
|
|
65
|
+
</p>
|
|
66
|
+
|
|
67
|
+
### Left Sidebar
|
|
68
|
+
|
|
69
|
+
| Element | Description |
|
|
70
|
+
| ------- | ----------- |
|
|
71
|
+
| **Target Host** | Select which IP stream to inspect |
|
|
72
|
+
| **Bookmarks** | Save and jump to specific packets |
|
|
73
|
+
| **Save JSON** | Export current dataset |
|
|
74
|
+
| **PCAP size** | File size of the capture |
|
|
75
|
+
| **Load time** | Time to parse and load data |
|
|
76
|
+
| **Total Packets** | Total packets in dataset |
|
|
77
|
+
| **Filtered Packets** | Packets matching active filter |
|
|
78
|
+
| **Timestamp** | Current packet's capture time |
|
|
79
|
+
|
|
80
|
+
### Toolbar
|
|
81
|
+
|
|
82
|
+
| Control | Description |
|
|
83
|
+
| ------- | ----------- |
|
|
84
|
+
| **Summary** | Switch to LLM analysis view |
|
|
85
|
+
| **Data** | Return to packet data view |
|
|
86
|
+
| **Prev / Next** | Step through packet list |
|
|
87
|
+
| **Filter bar** | Enter filter expressions |
|
|
88
|
+
| **Load JSON** | Load previously generated `hosts.json` |
|
|
89
|
+
| **Load PCAP** | Run backend on a `.pcap` file |
|
|
90
|
+
| **Use LLM** | Toggle Ollama-powered summaries |
|
|
91
|
+
|
|
92
|
+
### Packet Info Pane
|
|
93
|
+
|
|
94
|
+
- **IP Routing** — Source → destination addresses
|
|
95
|
+
- **Network Info** — Ports with ICANN service names
|
|
96
|
+
- **Data Type** — MIME type, charset, encoding, magic file type
|
|
97
|
+
- **Active Recon** — SSL/TLS details, server banners, DNS hostnames, web page titles (with `-a` flag)
|
|
98
|
+
|
|
99
|
+
### Packet Payload Pane
|
|
100
|
+
|
|
101
|
+
- **ASCII View** — Printable character runs from payload
|
|
102
|
+
- **Hex Grid** — Interactive hex dump; click to highlight bytes and see ASCII
|
|
103
|
+
|
|
104
|
+
### Right Sidebar
|
|
105
|
+
|
|
106
|
+
| Panel | Description |
|
|
107
|
+
| ----- | ----------- |
|
|
108
|
+
| **Datagram Frame** | Protocol fields (checksums, DNS, HTTP, DHCP, etc.) |
|
|
109
|
+
| **Location** | GeoIP: country, city, postal code, timezone |
|
|
110
|
+
| **Payload Entropy** | Shannon entropy as number + visual indicator |
|
|
111
|
+
|
|
112
|
+
---
|
|
113
|
+
|
|
114
|
+
## Filtering
|
|
115
|
+
|
|
116
|
+
Filter expressions use dot-notation keys, comparison operators, and boolean combinators:
|
|
117
|
+
|
|
118
|
+
```bash
|
|
119
|
+
# HTTPS traffic only
|
|
120
|
+
tcp.dst.port:443
|
|
121
|
+
|
|
122
|
+
# Traffic from China
|
|
123
|
+
loc.src.country:China
|
|
124
|
+
|
|
125
|
+
# High-entropy payloads (encrypted/compressed)
|
|
126
|
+
payload.entropy:>=7.0
|
|
127
|
+
|
|
128
|
+
# HTTP POST with JSON
|
|
129
|
+
http.method:POST && payload.mime:application/json
|
|
130
|
+
|
|
131
|
+
# Large encrypted payloads from external IPs
|
|
132
|
+
tcp.dst.port:443 && payload.len:>500 && payload.entropy:>=7.0 && ip.src.class:!=Localnet
|
|
133
|
+
```
|
|
134
|
+
|
|
135
|
+
- String comparisons are **case-insensitive**
|
|
136
|
+
- Press **Enter** to apply, clear and press **Enter** again to reset
|
|
137
|
+
|
|
138
|
+
See the [Filter Reference](Documentation/Filters.md) for the complete list of keys and syntax.
|
|
139
|
+
|
|
140
|
+
---
|
|
141
|
+
|
|
142
|
+
## Documentation
|
|
143
|
+
|
|
144
|
+
- 📖 [Frontend Docs](Documentation/Frontend.md) — UI reference, installation, developer setup
|
|
145
|
+
- ⚙️ [Backend Docs](Documentation/Backend.md) — `snitch.py` usage, arguments, output structure
|
|
146
|
+
- 🔎 [Filter Reference](Documentation/Filters.md) — Complete filter keys, operators, examples
|
|
147
|
+
|
|
148
|
+
---
|
|
149
|
+
|
|
150
|
+
## License
|
|
151
|
+
|
|
152
|
+
**GNU GPLv3** — See [LICENSE.md](LICENSE.md) for details.
|
|
153
|
+
|
|
154
|
+
---
|
|
155
|
+
|
|
156
|
+
## Author
|
|
157
|
+
|
|
158
|
+
**Marshall Whittaker**
|
|
159
|
+
|
|
160
|
+
---
|
|
161
|
+
|
|
162
|
+
## Support the Project
|
|
163
|
+
|
|
164
|
+
If you find PacketSnitch useful, please consider supporting its development:
|
|
165
|
+
|
|
166
|
+
<p align="center">
|
|
167
|
+
<a href="https://thanks.dev/oxasploits">
|
|
168
|
+
<img src="https://img.shields.io/badge/Thanks.dev-Donate-orange" alt="Thanks.dev">
|
|
169
|
+
</a>
|
|
170
|
+
</p>
|
|
171
|
+
|
|
172
|
+
<p align="center">
|
|
173
|
+
<img src="https://raw.githubusercontent.com/oxasploits/PacketSnitch/refs/heads/main/Documentation/bitcoin-qr.png" width="120" alt="Bitcoin">
|
|
174
|
+
|
|
175
|
+
<img src="https://raw.githubusercontent.com/oxasploits/PacketSnitch/refs/heads/main/Documentation/paypal-qr.png" width="120" alt="PayPal">
|
|
176
|
+
|
|
177
|
+
<img src="https://raw.githubusercontent.com/oxasploits/PacketSnitch/refs/heads/main/Documentation/venmo-qr.png" width="120" alt="Venmo">
|
|
178
|
+
</p>
|
package/package.json
CHANGED