pcapdigger
Point it at a pcap and get three reports from one pass — network-engineering detail, security findings, and an executive summary.
A single-pass analyser for .pcap and .pcapng files that writes for three different readers at once instead of one dump everybody has to interpret themselves: a network engineering report, a security architect report, and an executive summary. The security pass runs a broad battery of heuristics — port and host scans, ARP spoofing, cleartext credentials, weak or legacy TLS, DNS tunnelling and NXDOMAIN floods, exfiltration and beaconing patterns, stealth-scan flag combinations, exposed or backdoor ports, and IOC matching — enriched with offline GeoIP/ASN lookups and WHOIS, and can decrypt TLS traffic given a keylog, RSA key or PSK. Findings come with SVG flow diagrams of the conversations involved, and everything exports as JSON, CSV or Markdown. Pure Go, no libpcap or cgo, one static binary. MIT licensed, Linux amd64/arm64/i386/armhf.