PCAP Hunter is an advanced, AI-enhanced threat hunting workbench designed to bridge the gap between manual packet analysis and automated security monitoring. It empowers SOC analysts and threat hunters to rapidly ingest, analyze, and extract actionable intelligence from raw PCAP files.
By combining industry-standard network analysis tools (Zeek, Tshark) with modern Large Language Models (LLMs) and OSINT APIs, PCAP Hunter automates the tedious parts of packet analysis—parsing, correlation, and enrichment—allowing analysts to focus on detection and response.
- Automated Reporting: Generates professional, SOC-ready reports summarizing key findings, suspicious indicators, and risk assessments.
- Local & Cloud LLM Support:
- Local Privacy: Fully compatible with local models via LM Studio (e.g., Llama 3, Mistral) for air-gapped or privacy-sensitive analysis.
- Cloud Power: Supports OpenAI-compatible APIs for leveraging larger models like GPT-4.
- Multi-Language Support: Generates reports in multiple languages (English, Traditional/Simplified Chinese, Japanese, Korean, Italian, Spanish, French, German) with region-specific terminology.
- Context-Aware: The AI is fed a structured summary of network flows, Zeek logs, and OSINT data, acting as an expert co-pilot.
- Multi-Engine Pipeline: Uses PyShark for granular packet inspection and Tshark for high-speed statistics.
- Protocol Parsing: Automatically extracts and visualizes metadata for major protocols:
- HTTP: Methods, URIs, User-Agents.
- DNS: Queries, responses, record types.
- TLS/SSL: Server names (SNI), certificate details.
- SMB: File shares and commands.
- Automated Lifecycle: Manages the execution of Zeek on uploaded PCAPs without requiring manual command-line intervention.
- Log Analysis: Parses and correlates core Zeek logs into interactive data tables:
conn.log: Connection summaries and state.dns.log: Name resolution activity.http.log: Web traffic details.ssl.log: Encrypted traffic metadata.
- DNS Analytics:
- DGA Detection: Uses Shannon Entropy to identify Domain Generation Algorithms.
- DNS Tunneling: Detects high-volume/anomalous DNS payloads.
- Fast Flux: Identifies domains resolving to rapidly changing IP addresses.
- TLS Fingerprinting:
- JA3/JA3S: Calculates and matches SSL/TLS fingerprints against known malware database.
- Certificate Analysis: Validates certificate chains and detects self-signed or expired certificates.
- Heuristic Analysis: Implements a statistical algorithm to detect Command & Control (C2) beaconing behavior.
- Scoring Engine: Ranks flows based on:
- Periodicity: Regularity of communication intervals (low variance).
- Jitter: Randomization attempts by C2 agents.
- Volume: Consistency of payload sizes.
- File Extraction: Uses
tsharkto carve HTTP file bodies from the traffic. - Artifact Hashing: Automatically calculates SHA256 hashes of extracted files for reputation checking.
- Safe Storage: Carved files are stored locally in a quarantined directory for manual analysis.
- Global Visibility: Visualizes traffic sources and destinations on a large, interactive world map.
- Traffic Volume: Line thickness varies based on connection volume, highlighting major data flows.
- Cross-Filtering:
- Unified Drill-Down: Selecting data in any chart (Map, Pie, or Timeline) filters the entire dashboard.
- Protocol Filter: Click a slice in the Protocol Pie Chart to isolate that protocol.
- Time Filter: Select a range on the Flow Timeline to focus on a specific time window.
- Reset Capability: Includes a "Clear All Filters" button to easily reset the dashboard view.
Integrates with leading threat intelligence providers to validate indicators of compromise (IOCs):
- VirusTotal: File hash and IP/Domain reputation.
- AbuseIPDB: Crowdsourced IP abuse reports.
- GreyNoise: Identification of internet background noise and scanners.
- OTX (AlienVault): Open Threat Exchange pulses and indicators.
- Shodan: Internet-facing device details and open ports.
- Smart Caching: SQLite-backed caching system to preserve API quotas and speed up repeated lookups.
- Python 3.10+
- Zeek:
brew install zeek(macOS) or via package manager (Linux). - Tshark:
brew install wireshark(macOS) orsudo apt install tshark(Linux). - LM Studio (Optional): For local LLM inference.
- Clone the repo:
git clone https://github.com/ninedter/pcap-hunter.git cd pcap-hunter - Install dependencies:
make install
- Run the application:
make run
- Upload: Drag and drop a
.pcapfile in the Upload tab. - Configure:
- Set your LLM endpoint (default:
http://localhost:1234/v1). - Add API keys for OSINT services (optional but recommended).
- Toggle specific analysis phases (e.g., enable/disable "OSINT Cache", "Carving").
- Re-run Report: If you change the language or model, click "Re-run Report" to regenerate just the LLM report without re-processing the PCAP.
- Clear Data: Use the "Clear All Data" button in the Config tab to completely wipe the workspace for a fresh start.
- Set your LLM endpoint (default:
- Analyze: Click Extract & Analyze.
- Monitor: Watch the Progress tab as the pipeline executes:
- Packet Counting -> Parsing -> Zeek -> DNS/JA3 -> Beaconing -> Carving -> OSINT -> Reporting.
- Review: Read the generated Threat Report and explore the raw data tables for deep dives.
Defaults are managed in app/config.py. Key settings include:
DATA_DIR: Location for storing analysis artifacts (default:./data).OSINT_CACHE_ENABLED: Toggle for SQLite caching (default: True).DEFAULT_PYSHARK_LIMIT: Max packets to parse deeply (default: 200,000).OSINT_TOP_IPS_DEFAULT: Number of top talkers to enrich (default: 50).
- Test:
make test - Lint:
make lint - Format:
make format - Clean:
make clean
MIT License. See LICENSE for details.