Skip to content

WireScope v1.0.0

Latest
Latest

Choose a tag to compare

View all tags
@yigitatmaca42 yigitatmaca42 released this 01 Oct 16:25
· 1 commit to main since this release
v1.0.0
f116b7a

Highlights

WireScope is a streaming PCAP/PCAPNG/CAP analysis toolkit for quick network-forensics triage: who talked to whom, what DNS/HTTP/TLS activity happened, which flows are worth a second look, and a clean JSON/CSV/HTML report to hand off. It is read-only, offline analysis: it never loads a capture wholesale into memory, never decrypts TLS, and never performs active network actions (no scanning, no injection).

This is the first public release: the initial feature set plus a dedicated hardening and code-review pass. No analysis features were added during hardening.

Features

  • Streaming capture engine (Scapy PcapReader), bounded memory on large captures
  • Capture summary, host/port analysis, normalized 5-tuple conversations
  • DNS (A/AAAA/CNAME/MX/TXT, NXDOMAIN), plaintext HTTP, TLS SNI metadata
  • ARP, ICMP and TCP-flag statistics
  • Hedged heuristic findings (INFO/LOW/MEDIUM/HIGH) - a triage aid, not an IDS
  • Flat-file IOC matching (IP and domain; domains match by suffix)
  • --ip / --port / --protocol filters, combinable
  • Typer + Rich CLI with clean errors and distinct exit codes (1 bad input, 2 internal error, 130 interrupted)

Security / Hardening

  • A single malformed packet no longer aborts analysis; skipped packets are counted and surfaced
  • CSV export neutralizes spreadsheet formula injection (=, +, -, @)
  • All capture-derived text in the HTML report is escaped (regression-tested)
  • Every collection (hosts, ports, ARP, DNS, HTTP, TLS, conversations) is bounded, with explicit truncation flags in the report
  • 95 tests, ruff and mypy clean, CI on Python 3.11 / 3.12 / 3.13

Reports

  • JSON export with a documented schema (docs/report-schema.md; schema version is independent of the package version)
  • Per-category CSV files
  • Single-file offline HTML report (no CDN, no JavaScript framework)

Known Limitations

  • IOC matching is IP/domain only (no hash or URL IOCs)
  • No X.509 certificate parsing, no JA3/JA4
  • No HTTP file extraction
  • No TUI/GUI
  • No PyShark/tshark backend
  • Heuristic thresholds are untuned starting points; expect false positives

Installation

git clone https://github.com/yigitatmaca42/WireScope.git
cd WireScope
python3 -m venv .venv && source .venv/bin/activate
pip install .
wirescope --help

See the README and CHANGELOG for details.

Assets 2
Loading