nfstream 0.3.0

A flexible and powerful network data analysis library

nfstream is a flexible and lightweight network data analysis library.

nfstream main features

• Performance: nfstream was designed to be fast, CPU savvy and small memory fingerprint.

• Layer-7 visibility: nfstream dissection is based on nDPI (~300 applications including Tor, Messenger, WhatsApp, etc.).

• Flexibility: add a flow metric in 2 lines of code using nfstream plugins method.

examples of use

• Dealing with a big pcap file and just want to see flow informations stored in as a csv file or pandas Dataframe? nfstream make this path easier in few lines.

{"ip_src": "192.168.43.18", "src_port": 52066, "ip_dst": "66.220.156.68", "dst_port": 443, "ip_protocol": 6, "src_to_dst_pkts": 9, "dst_to_src_pkts": 10, "src_to_dst_bytes": 1345, "dst_to_src_bytes": 4400, "application_name": "TLS.Facebook", "start_time": 1472393122365, "end_time": 1472393123665, "export_reason": 2}

• Didn’t find a specific flow feature? add it to Streamer as a plugin in few lines.

• More example and details are provided on the official Documentation.

Getting Started

Prerequisites

apt-get install python-dev libpcap-dev autogen

Installation

using pip

Binary installers for the latest released version are available:

pip3 install nfstream

from source

If you want to build nfstream on your local machine:

apt-get autogen
git clone https://github.com/aouinizied/nfstream.git
# move to nfstream directory and run
python3 setup.py install

Contributing

Please read Contributing for details on our code of conduct, and the process for submitting pull requests to us.

Authors

Zied Aouini (aouinizied) created nfstream and these fine people have contributed.

License

This project is licensed under the GPLv3 License - see the License file for details