Changelog xplico v1.2.0:
* Migration from PHP5 to PHP7.
* CakePHP 2.8.
* IMAP bug fix.
* Bugfix: reported on Security Onion.
* Counters bug fiexed on live capturing.
* Default path for GeoLiteCity DB Changed.
* Bug fixed during the insert the data in SQLite Db.
Xplico is a Network Forensic Analisys Tool NFAT, for Unix and Unix-like operating systems. It uses libpcap, a packet capture and filtering library.
+ Protocols supported: HTTP, SIP, IMAP, POP, SMTP, TCP, UDP, IPv6, …;
+ Port Independent Protocol Identification (PIPI) for each application protocol;
+ Output data and information in SQLite database or Mysql database and/or files;
+ At each data reassembled by Xplico is associated a XML file that uniquely identifies the flows and the pcap containing the data reassembled;
+ Realtime elaboration (depends on the number of flows, the types of protocols and by the performance of computer -RAM, CPU, HD access time, …-);
+ TCP reassembly with ACK verification for any packet or soft ACK verification;
+ Reverse DNS lookup from DNS packages contained in the inputs files (pcap), not from external DNS server;
+ No size limit on data entry or the number of files entrance (the only limit is HD size);
+ IPv4 and IPv6 support;
+ Modularity. Each Xplico component is modular. The input interface, the protocol decoder (Dissector) and the output interface (dispatcher) are all modules;
+ The ability to easily create any kind of dispatcher with which to organize the data extracted in the most appropriate and useful to you;
Install from source:
1. Install nDPI library.
git clone https://github.com/ntop/nDPI.git
2. Install GeoIP library.
download source code: https://github.com/maxmind/geoip-api-c/releases/download/v1.6.9/GeoIP-1.6.9.tar.gz
3. Install json-c.
git clone https://github.com/json-c/json-c.git
sudo apt-get install libmysqlclient-dev
git clone https://github.com/xplico/xplico && cd xplico