Tsharky

Tsharky supports PCAP (libpcap/tcpdump/Wireshark), PCAPNG (next-generation packet capture), and CAP files. It handles Ethernet, Linux SLL (cooked captures from tcpdump -i any), SLL2, Raw IP and 802.1Q VLAN link types.

No. The C native engine uses dynamic memory allocation and can process multi-GB captures with no packet count limit. The server streams large JSON results to avoid memory exhaustion.

Over 40 security checks: port scans (SYN, XMAS, NULL), brute force (SSH, FTP, RDP, HTTP), C2 beaconing (periodic interval analysis), DNS tunneling (long queries, TXT abuse), data exfiltration (large outbound flows), ARP spoofing, cleartext credentials over Telnet/FTP/HTTP, suspicious ports (Metasploit 4444, IRC 6667, Tor 9001/9050, Back Orifice 31337), ICMP tunneling, Kerberoasting, LDAP enumeration, and lateral movement via RDP/VNC/SMB.

Select any IP address (public or private) and Tsharky replays all network activity chronologically. Animated comet connections fly between source and destination on the world map. Adjust playback speed (0.5x to 100x) and use the draggable time-window scrubber to focus on specific periods. Click any event for a full-screen modal with statistical charts, IP details and surrounding events.

Yes. Tsharky is self-hosted. Your PCAP files are processed locally on your own server. Uploaded files are deleted immediately after analysis. GeoIP resolution uses a local MaxMind GeoLite2 database with no external API calls.

DNS (A, AAAA, MX, CNAME, TXT, ANY, NXDOMAIN), HTTP (methods, URIs, headers, user agents, status codes), TLS/SSL (version, SNI, ciphers), TCP (SYN/ACK/RST flags, retransmissions, zero-window), UDP, ICMP (echo, redirect, tunneling), ARP (request, reply, spoofing), Kerberos (AS-REQ/TGS-REQ), LDAP, SMB, RDP, VNC, FTP, Telnet, and IRC.

Wireshark is a low-level packet inspector for examining individual frames and bytes. Tsharky is a traffic analysis and threat detection platform that automatically processes entire captures, detects security anomalies, geolocates all IPs on a world map, replays connection timelines, and generates forensic reports with involved IPs and statistical charts. Think of it as an automated SOC analyst for your packet captures.

Linux with GCC, libpcap-dev, libjson-c-dev, libmaxminddb-dev, and Node.js 16+. For GeoIP, download the free MaxMind GeoLite2 City and ASN databases. Memory scales with capture size: a 1GB PCAP typically requires about 2GB RAM during analysis.