Wireshark
The world's foremost and widely-used network protocol analyzer, for deep packet inspection and troubleshooting.
Visit siteTools for Network Operators
19 battle-tested tools network operators rely on for packet analysis, discovery, bandwidth testing, monitoring and defense — from classic packet capture and port scanning to intrusion detection, wireless auditing and network source-of-truth tooling.
Nmap
("Network Mapper") a free and open source utility for network discovery and security auditing.
Visit siteInfection Monkey
An open-source breach and attack simulation (BAS) platform that helps validate controls and identify network security gaps.
Visit siteiPerf3
A tool for active measurements of the maximum achievable bandwidth on IP networks.
Visit sitefprobe
A libpcap-based tool that collects network traffic data and emits it as NetFlow flows towards a specified collector.
Visit siteCacti
Provides a robust and extensible operational monitoring and fault management framework for users around the world.
Visit siteSnort 3
A sweeping IDS/IPS upgrade featuring enhanced performance, faster processing, and improved scalability for your network.
Visit siteAircrack-ng
A complete suite of tools to assess WiFi network security — monitoring, attacking, testing, and cracking.
Visit siteOpenNMS Horizon
An open source solution that helps you visualize and monitor everything on your local and remote networks.
Visit siteSmokePing
A deluxe latency measurement tool. It can measure, store, and display latency, latency distribution, and packet loss.
Visit siteSenzing
An entity resolution engine — somewhat peripheral to networking and security, but useful enough in certain situations.
Visit sitetcpdump
The classic command-line packet analyzer, built on libpcap, for capturing and filtering network traffic on Unix-like systems.
Visit siteZeek
An open-source network security monitoring platform that turns traffic into rich, structured logs for analysis and threat hunting.
Visit siteSuricata
An open-source network threat detection engine providing intrusion detection and prevention, network security monitoring and packet capture.
Visit siteScapy
A powerful Python library and interactive tool for crafting, sending, sniffing and dissecting network packets.
Visit siteMasscan
A very fast TCP port scanner designed to scan large address ranges, with an interface similar to Nmap.
Visit siteKismet
A wireless network and device detector, sniffer and wireless intrusion detection framework for Wi-Fi, Bluetooth and other radios.
Visit siteNetBox
An open-source source of truth for network infrastructure, combining IP address management with data center infrastructure management.
Visit siteTermshark
A terminal user interface for tshark that brings Wireshark-style packet analysis to the command line.
Visit siteFrequently Asked Questions
What tools do network operators use for packet analysis?
Wireshark and tcpdump are the most widely used packet analyzers. Wireshark offers a graphical interface for deep inspection, while tcpdump and tshark-based tools such as Termshark are well suited to command-line capture on servers and remote devices.
What is the difference between an IDS and network security monitoring?
An intrusion detection system such as Snort or Suricata matches traffic against signatures and rules to raise alerts. Network security monitoring tools such as Zeek record detailed logs of network activity so analysts can investigate and hunt for threats after the fact.
Which tools measure network performance?
iPerf3 measures achievable bandwidth between two endpoints, SmokePing tracks latency and packet loss over time, and monitoring platforms such as Cacti and OpenNMS graph interface and device metrics. Together they help locate bottlenecks and intermittent problems.