Xplico aims to extract internet traffic and capture the information contained within application data.
For example, Xplico can extract email content (via POP, IMAP, SMTP protocols), all HTTP content, every VoIP call (SIP), FTP, TFTP, and more from a pcap file. However, Xplico is not a network protocol analyzer. It is an open-source Network Forensic Analysis Tool (NFAT).
Open-Source Network Forensics Tool Xplico
Features:
Protocol Support: HTTP, SIP, IMAP, POP, SMTP, TCP, UDP, IPv6, … ;
Port Independent Protocol Identification (PIPI) for each application protocol;
Multithreading;
Supports data and information output using SQLite databases, MySQL databases, or even files;
All data is reassembled by Xplico and correlated to an XML file that uniquely identifies the traffic flow. The pcap contains the reassembled data;
Supports real-time detail queries (actual feasibility depends on traffic volume, protocol type, and computer performance – RAM, CPU, HDD access time, etc.);
TCP reassembly using ACK confirmation for any packet and soft ACK verification;
Reverse DNS lookups are performed on DNS packets contained within the input file (pcap), not by querying external DNS servers;
No limits on the size of input data or the number of input files (only limited by HDD size);
Supports IPv4 and IPv6;
Modularity. Every Xplico component is a module. Input interfaces, protocol decoders, and output interfaces are all modularized;
Easily create any dispatch