> For the complete documentation index, see [llms.txt](https://malfav.gitbook.io/home/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://malfav.gitbook.io/home/malware-analysis-toolkit/windows-malware-analysis-toolkit/network-analysis-tool.md).

# Network Analysis Tool

* **Wireshark**: The most widely used network protocol analyzer that captures and interacts with network traffic in real-time. It provides detailed packet analysis and supports various protocols.
* **tcpdump**: A command-line packet analyzer that captures and displays network packets. It's powerful for real-time traffic analysis and can be used in conjunction with Wireshark for deeper inspection.
* **Suricata**: An open-source network threat detection engine that performs real-time intrusion detection (IDS), inline intrusion prevention (IPS), and network security monitoring (NSM).
* **Zeek (formerly Bro)**: A powerful network analysis framework that focuses on network monitoring and forensics. It generates detailed logs of network activity and can be customized for specific analysis needs.
* **Snort**: An open-source network intrusion detection system (NIDS) that performs real-time traffic analysis and packet logging to detect and prevent intrusions.
* **NetFlow Analyzer**: A traffic analytics tool that uses flow data (NetFlow, sFlow, etc.) to provide insights into network traffic patterns and bandwidth usage.
* **Nmap**: A network scanning tool that discovers hosts and services on a network, providing information about network topology, open ports, and running services.
* **Netwitness Investigator**: A network forensics analysis tool that captures and analyzes full network packet data, helping to investigate security incidents and understand network activity.
* **Fiddler**: A web debugging proxy tool that captures HTTP and HTTPS traffic between your computer and the internet, useful for analyzing web application interactions and network communications.
* **NetworkMiner**: A network forensics analysis tool that captures and parses network traffic to extract files, credentials, and other artifacts for forensic investigation.