High-performance network traffic analysis and threat detection platform for SOC analysts, DFIR specialists, and security researchers.
CapXray combines advanced packet analysis, machine learning-based anomaly detection, and real-time visualization to deliver unparalleled network forensics capabilities. From flow reconstruction to JA3 fingerprinting, CapXray provides the tools needed for modern threat hunting and incident response.
- ⚡ High-Performance Engine: Concurrent flow processing with Go worker pools
- 🔄 Smart Flow Reconstruction: 5-tuple session tracking (TCP/UDP/ICMP)
- 📊 Protocol Dissection: Deep inspection of DNS, HTTP, TLS, and more
- DNS: Entropy-based tunneling detection, long domain flagging, NXDOMAIN abuse tracking
- HTTP: Suspicious User-Agent identification, cleartext credential detection
- TLS: Full JA3 fingerprinting with malicious hash database (Trickbot, Dridex, Metasploit, Cobalt Strike)
- C2 Beaconing: Statistical analysis of traffic periodicity (coefficient of variation < 0.15)
- Data Exfiltration: High-volume upload pattern detection (>10MB sustained)
- Packet Anomalies: Identification of unusual packet sizes and distributions
- CLI Excellence: Colorized output, ASCII banners, structured tables
- 🌐 Real-Time Dashboard: Modern web UI with live updates (v1.1)
- 📈 Live Visualization: Protocol distribution, alerts, flow metrics
- JSON/CSV Export: SIEM-ready output for Splunk, ELK, QRadar
- YAML Rules: Flexible detection threshold configuration
- REST API: Programmatic access to all analysis data
- Go: 1.22 or higher
- libpcap: Development headers (
libpcap-devon Debian/Ubuntu)
# Clone repository
git clone https://github.com/ismailtsdln/CapXray.git
cd CapXray
# Build
go build -o capxray ./cmd/capxray
# Verify installation
./capxray --helpPerform comprehensive PCAP analysis with all detectors enabled.
capxray scan capture.pcapOutput:
[*] Scanning capture.pcap...
[+] Scan complete. Total flows: 1234, Alerts: 5
View protocol distribution and traffic metrics.
capxray stats capture.pcapDisplay reconstructed network sessions.
capxray flows capture.pcapRun all detection engines with custom rules.
capxray detect capture.pcap --rules rules/custom.yamlAlert Types:
DNS-Long-Domain- Potential DNS tunnelingDNS-High-Entropy- Encoded data in DNS queriesSuspicious-User-Agent- Known malicious toolsSuspicious-JA3- Malware TLS fingerprintML-Beaconing- C2 communication patternML-Data-Exfiltration- Large data transfer
Export analysis results for further processing.
capxray export capture.pcap --format json > report.jsonStart real-time visualization server.
capxray server capture.pcap --port 8080Then navigate to http://localhost:8080 in your browser.
Dashboard Features:
- 📊 Real-time statistics cards
- 🚨 Live alert feed with severity indicators
- 📈 Protocol distribution charts
- 🌊 Network flow table
- ⚡ Auto-refresh (3-second intervals)
CapXray uses YAML-based rules for fine-tuning detection sensitivity.
dns:
max_domain_length: 60# Flag domains exceeding this lengthentropy_threshold: 4.5# Shannon entropy for tunneling detectionbeaconing:
min_hits: 10# Minimum packets for beaconing detectionmax_jitter: 5s# Maximum timing variancehttp:
suspicious_uas:
- "nmap"
- "sqlmap"
- "gobuster"
- "dirb"Create your own detection profile:
cp rules/default.yaml rules/custom.yaml
# Edit rules/custom.yaml
capxray detect traffic.pcap --rules rules/custom.yamlgraph TB
A[PCAP File] --> B[Loader]
B --> C[Packet Parser]
C --> D[Flow Reconstructor]
D --> E[Analysis Engine]
E --> F[DNS Analyzer]
E --> G[HTTP Analyzer]
E --> H[TLS/JA3 Analyzer]
E --> I[ML Anomaly Detector]
F --> J[Alert Aggregator]
G --> J
H --> J
I --> J
J --> K[CLI Output]
J --> L[Web Dashboard]
J --> M[JSON Export]
style E fill:#4A90E2,stroke:#2E5C8A,color:#fff
style J fill:#E74C3C,stroke:#C0392B,color:#fff
| Component | Responsibility |
|---|---|
| PCAP Loader | Reads offline captures using gopacket |
| Flow Reconstructor | Builds 5-tuple sessions from packets |
| Analysis Engine | Orchestrates analyzers with worker pools |
| Protocol Analyzers | DNS, HTTP, TLS deep inspection |
| ML Detector | Statistical anomaly identification |
| API Server | REST endpoints for web dashboard |
- Real-time threat hunting in captured traffic
- Malware C2 communication detection
- DNS tunneling and exfiltration identification
- Post-incident network traffic analysis
- JA3 fingerprint correlation with threat intelligence
- Timeline reconstruction from flow data
- Malware traffic behavior analysis
- Protocol anomaly discovery
- Detection rule development and tuning
- Red team tool detection (Metasploit, Cobalt Strike)
- Blue team capability validation
- Detection gap identification
Type Severity Source Destination Description
ML-Beaconing High 192.168.1.100 203.0.113.45 Regular interval traffic pattern detected
Suspicious-JA3 High 10.0.0.50 1.2.3.4 JA3: ada70206e40642a3e4461f35503241d5 (Cobalt Strike)
DNS-High-Entropy Medium 192.168.1.45 8.8.8.8 High entropy: aGVsbG8ud29ybGQ.example.com
{
"summary": {
"total_flows": 1234,
"total_alerts": 5,
"analyzer_count": 7
},
"alerts": [
{
"type": "Suspicious-JA3",
"severity": "High",
"flow_id": "192.168.1.50:49152->1.2.3.4:443[TCP]",
"description": "Suspicious JA3 fingerprint detected",
"indicators": ["ada70206e40642a3e4461f35503241d5"]
}
],
"flows": [...]
}# Format code
go fmt ./...
# Run linter
go vet ./...
# Build for production
go build -ldflags="-s -w" -o capxray ./cmd/capxrayContributions are welcome! Please follow these guidelines:
- Fork the repository
- Create a feature branch (
git checkout -b feature/AmazingFeature) - Commit your changes (
git commit -m 'Add AmazingFeature') - Push to the branch (
git push origin feature/AmazingFeature) - Open a Pull Request
git clone https://github.com/ismailtsdln/CapXray.git
cd CapXray
go mod download
go build ./cmd/capxrayThis project is licensed under the MIT License - see the LICENSE file for details.
Ismail Tasdelen
🔗 GitHub: @ismailtsdln
📧 Email: Contact via GitHub
🌐 Project: CapXray
- gopacket - Google's packet processing library
- cobra - CLI framework by spf13
- open-ch/ja3 - JA3 fingerprinting implementation
- Community - Security researchers and contributors
- Wireshark - Network protocol analyzer
- Zeek - Network security monitor
- Suricata - IDS/IPS engine
- Moloch - Large scale packet capture
Made with ❤️ for the security community