What is PacketSnitch?

PacketSnitch is a network analysis platform that transforms packet captures into searchable, protocol-aware intelligence, helping security professionals, developers, and researchers rapidly uncover hosts, credentials, certificates, files, locations, protocols, anomalies, and other actionable insights.

| Component | Description | | --------- | ----------- | | Backend | Python script (snitch.py) that parses .pcap files and extracts rich per-packet metadata into JSON | | Frontend | Electron-based desktop application for loading, browsing, filtering, and visualizing traffic |

Key Features

• 📂 Load PCAP files — Point the backend at a capture, then explore interactively in the desktop app
• 🔍 Powerful filtering — Filter by port, country, entropy, MIME type, and more using dot-notation expressions
• 🌐 Full IPv6 support — Native IPv6 parsing, shared ip.* filter keys (with network.proto / ip.proto.num for family disambiguation), bracketed endpoint display, BigInt-backed subnet math, and IPv6 enrichment for GeoIP, WHOIS, Tor, Shodan, and VirusTotal
• 🌍 GeoIP integration — See source/destination locations with country, city, and timezone
• 📊 Payload analysis — Shannon entropy visualization, MIME type detection, hex dump with ASCII view
• 🤖 LLM summaries — Generate AI-powered analysis reports using Ollama
• 📑 Protocol decoding — DNS, HTTP, SSL/TLS, DHCP, NTP, SIP, IPv6, ICMPv6, DHCPv6, and more
• 🧩 Plugin engine — Install zip plugins, manage runtime safety thresholds, and extend UI workflows from the built-in Plugins manager

Quick Start

Installation

Download a pre-built release from the releases page:

• Windows: .exe installer
• Linux: .deb or .rpm packages

Basic Workflow

• Load PCAP — Click Load PCAP to run the backend on a .pcap file
• Browse packets — Use Prev / Next buttons or select a host from the dropdown
• Filter — Type expressions like tcp.dst.port:443 and press Enter
• Summarize — Click Summary for LLM-generated analysis (requires Ollama)

Documentation

• 🚀 Startup Docs — Quickstart Documentation
• 📖 Frontend Docs — UI reference, conversions, encryption, notes
• 🎨 Plugins + Themes Docs — Combined themes reference and complete plugin engine tutorial with hello-snitch sample code
• 🎯 Context Menu Reference — Right-click options for copying, converting, filtering, and exporting
• ⚙️ Backend Docs — snitch.py usage, arguments, output structure
• 🔎 Filter Reference — Complete filter keys, operators, examples

License

GNU GPLv3 — See LICENSE.md for details.

Author

Marshall Whittaker

Support the Project

If you find PacketSnitch useful, please consider supporting its development:

Sponsor on Github
Sponsor on Thanks.Dev
Sponsor on Buy me a Coffee