Xplico – Network Forensic Analysis Tool

Network artifact collection is extremely important when you are looking to investigate a security intrusion reported by external entity such as ISP, CERT or CSIRT. Network evidence may include network logs, network pcap files and the source IP these are the key elements that an incident responder should focus on. If you are looking to perform and Incident response on the network side you can check Xplico.

 Xplico extract from internet traffic capture the applications data contained. For example, from a pcap file Xplico extracts each email (POP, IMAP, and SMTP protocols), all HTTP contents, each VoIP call (SIP), FTP, TFTP, and so on. Xplico isn’t a network protocol analyzer. Xplico is an open source Network Forensic Analysis Tool (NFAT).

Xplico – Network Forensic Analysis Tool

Some of the features with Xplico:

  • Protocols supported: HTTP, SIP, IMAP, POP, SMTP, TCP, UDP, IPv6, …;
  • Port Independent Protocol Identification (PIPI) for each application protocol;
  • Multithreading;
  • Output data and information in SQLite database or Mysql database and/or files;
  • Realtime elaboration (depends on the number of flows, the types of protocols and by the performance of computer -RAM, CPU, HD access time, …-);
  • TCP reassembly with ACK verification for any packet or soft ACK verification;
  • Reverse DNS lookup from DNS packages contained in the inputs files (pcap), not from external DNS server;
  • No size limit on data entry or the number of files entrance (the only limit is HD size);
  • IPv4 and IPv6 support;
  • Modularity. Each Xplico component is modular. The input interface, the protocol decoder (Dissector) and the output interface (dispatcher) are all modules;
  • The ability to easily create any kind of dispatcher with which to organize the data extracted in the most appropriate and useful to you;

If you are looking to analyze packet capture collected by an IDS or a third party entity you can use this framework to identify the connection to suspicious or malicious IP/URL also you can just run it on span port to start the live capture.

You can read more and download this tool over here: https://www.xplico.org/