Junkie is a real-time packet sniffer and analyzer. It is modular enough to accomplish many different tasks. It can be a helpful companion to the modern network administrator and analyst. Compared to previously available tools, junkie lies in between tcpdump and wireshark. Unlike tcpdump, its purpose is to parse protocols of any depth; unlike wireshark, though, it is designed to analyze traffic in real-time and so cannot parse traffic as exhaustively as wireshark does. In addition, its design encompasses extendability and speed. It has a plug-in system and high-level extension language that eases the development and combination of new functionalities; threaded packet capture and analysis for handling of high bandwidth networks; and a modular architecture to ease the addition of any protocol layer. It is based on libpcap for portability, and well-tested on professional settings.
|Tags||Network Guile Sniffer Packet inspection Packet Capturing Network Analysis|
|Licenses||Affero GPL v3 or more recent|
|Operating Systems||Linux BSD|
|Implementation||C Scheme libpcap|
Release Notes: This release fixes several file descriptors leaks and a segfault in openssl when decoding unknown cipher suites.
Release Notes: This release fixes handling of the Session Tickets TLS extension and TLS decryption of CAMELIA cypher suite.
Release Notes: This release fixes various bugs.
Release Notes: A new Delayogram plugin to visualize ack delays. A new -f option to set the next capture filters from the command line. Support for Eth QinQ(inQ...), DHCP protocol. Autodiscovery of IRC, jabber, VNC, CIFS, PCanywhere, citrix, telnet, BGP, IMAP, POP, and NTP.
Release Notes: This release adds a new parser for TLS (with optional decryption a la ssldump) and SKINNY protocols, reordering of all TCP traffic by default, and a new interactive plugin, NetTop, to display a top of current flows.