Version 2.0.0  ·  Windows · Linux · macOS

THREATS DON'T
SLEEP.
NEITHER SHOULD
YOUR NETWORK.

Real-time packet analysis, DNS threat hunting, and device forensics — all from your terminal. No agents. No dashboards. No guesswork.

Start Monitoring Now View on GitHub
Scroll to explore
01 — What PacketPulse is

Five Modules.
One Menu.

PacketPulse is a terminal network monitoring and analysis console. An interactive menu runs five modules: a packet sniffer, a URL scanner, a DNS monitor, device forensics, and a pipeline that runs three of them together.

Every result it prints or writes comes from data it actually observed. Where something cannot be determined, it says UNKNOWN, NOT OBSERVED or UNAVAILABLE — with a reason. It does not fill the field with a guess.

It runs on Windows, Linux and macOS. Reputation lookups are optional and off by default, so out of the box the tool works entirely on your own machine.

5
Modules
3
Platforms
0
API keys required
packetpulse — interactive menu
$ sudo packetpulse
[1] Packet Sniffer    live capture · L2–L4 · DNS · HTTP
[2] URL Scanner      structure · TLS certificate · live mode
[3] DNS Monitor      plaintext DNS observation
[4] Device Forensics host · LAN · nmap · USB
[5] Full Pipeline    sniffer + URL scanner + DNS monitor
[6] Capabilities     what this host can and cannot do
Select a module ▸
▶
Illustration of the module menu — not captured output.
02 — The Modules

What Each One
Actually Does.

MODULE 01
Packet Sniffer
Live capture with full packet decode through layer 4 — MAC addresses, IPv4/IPv6, TTL, TCP flags and ports. Decodes DNS queries and answers, and parses request/response for plaintext HTTP. HTTPS is not decrypted. Packets are streamed to the PCAP as they arrive, so the capture file stays complete even when the display cannot keep up.
PCAP · NDJSON · HTML · PDF · JSON
MODULE 02
URL Scanner
Analyses URL structure and performs real TLS certificate validation. Reputation lookups and page-content analysis are optional additions. A live mode scans URLs seen in observed traffic.
TLS validation · reputation optional
MODULE 03
DNS Monitor
Observes plaintext DNS. Flags algorithmically-generated domain names, measures query frequency, and reports interval regularity when it is actually present — volume alone is not called periodic.
Plaintext DNS only
MODULE 04
Device Forensics
Builds a host profile from OS APIs and discovers LAN hosts by ARP sweep. An nmap port scan is optional, if nmap is installed. USB profiling requires Linux — on Windows and macOS the module reports UNAVAILABLE with the reason rather than showing an empty section.
USB profiling: Linux only
MODULE 05
Full Pipeline
Runs three modules together — Sniffer, URL Scanner and DNS Monitor — on one shared interface, duration and stop signal. One session, one set of reports.
Sniffer + URL Scanner + DNS Monitor
03 — How it reports

It Tells You What
It Doesn't Know.

There are no fixed confidence percentages. Every score is the sum of documented indicator weights, and the tool shows its working — so you can disagree with a line item instead of trusting a number.

Example finding indicator weights, printed with the verdict 
OBSERVED   Potential credential submission over cleartext HTTP
           signal=STRONG  score=65/100
  +15  HTTP service port — port 80 (cleartext) with public peer
  +15  Cleartext HTTP — request/response readable on the wire
  +30  Credential-bearing POST over cleartext — POST to path containing 'login'
  +5   External web request — Host header 'example.com' on a public peer
No placeholders
A value it cannot determine is shown as UNKNOWN, NOT OBSERVED or UNAVAILABLE — with a reason attached.
No guessed attribution
Process attribution requires an exact socket match. Anything less is reported as UNKNOWN rather than guessed.
Two different facts
Reports distinguish “no threats observed in captured data” from “analysis incomplete — capture failed”. A silent network and a broken capture are not the same result.
The session is on the record
Every report records measured duration versus requested, counters, errors, unavailable features and limitations — so you can tell how much of the run actually happened.
04 — Scope

What It Reports.
What It Won't.

Reported, from observed data
Layer 2–4 decode: MAC addresses, IPv4/IPv6, TTL, TCP flags and ports
DNS queries and answers, where DNS is sent in plaintext
HTTP request and response parsing for cleartext HTTP
Real TLS certificate validation for scanned URLs
LAN hosts found by ARP sweep, and a host profile from OS APIs
A session record: measured duration versus requested, counters and errors
Not claimed
HTTPS content — TLS is not decrypted, so paths, headers and bodies are not recovered
Malware identification — detections are structural and behavioural indicators
A confidence percentage — scores are sums of documented indicator weights
A location without a local GeoIP database — it reports UNAVAILABLE instead
A reputation verdict without your own API keys — it reports NOT CHECKED
Safety. A CLEAN verdict means no indicator fired, and nothing more
05 — Platform support

Windows. Linux.
macOS.

Windows needs Npcap; Linux and macOS need libpcap. Only USB forensics is Linux-only — every other module runs everywhere.

Capability Windows Linux macOS
Packet Sniffer Yes (Npcap) Yes Yes
DNS Monitor Yes Yes Yes
URL Scanner Yes Yes Yes
Full Pipeline Yes Yes Yes
Host profiling Yes Yes Yes
LAN discovery Yes Yes Yes
nmap scan If installed If installed If installed
USB forensics No (needs Linux) Yes No (needs Linux)
Capture needs Administrator on Windows, and root or CAP_NET_RAW on Linux.
06 — Limitations

Read This Before
You Rely On It.

These are not edge cases. They define what the tool can see at all.

HTTPS is not decrypted
For TLS traffic you get endpoint metadata and the SNI hostname. Paths, headers and content are not recovered.
Encrypted DNS is invisible
DNS-over-HTTPS and DNS-over-TLS are encrypted and cannot be read by the DNS monitor. If your resolver uses them, it will correctly report seeing nothing.
CLEAN is not a guarantee
A CLEAN verdict means no indicator fired. It is not a statement that the network is safe.
Indicators, not identification
Detections are structural and behavioural indicators. PacketPulse does not identify malware.
07 — Install

Three Steps.
No API Key.

PacketPulse needs Python 3.11+. The package declares requires-python = ">=3.11", so earlier versions cannot install it.

Windows Npcap required
  1. Install Npcap
    Download and install from npcap.com. This is what provides packet capture on Windows.
  2. Install PacketPulse
    py -m pip install packetpulse
  3. Run it
    packetpulse
    Run the terminal as Administrator for packet capture.
Linux Debian · Ubuntu · Kali
  1. Install libpcap
    sudo apt install libpcap0.8
  2. Install PacketPulse
    pip install packetpulse
  3. Run it
    sudo packetpulse
    Capture needs root or CAP_NET_RAW.
Run the Capabilities view first
Menu option 6 reports what works on your machine and why anything does not — before you spend a session finding out.
Optional
Reputation lookups and GeoIP

VirusTotal, Google Safe Browsing and PhishTank lookups are optional and off by default, and require your own API keys. Without them PacketPulse runs fully locally and reports NOT CHECKED — it does not imply a clean result for a lookup it never made.

GeoIP is optional too. It needs a local MaxMind database; without one it reports UNAVAILABLE rather than guessing a location.

08 — Why PacketPulse

Built for the
Command Line.

Local
No API key is required. With no keys configured, analysis happens on your own machine and nothing is sent to a third-party service.
Legible
Findings arrive with the indicators that produced them and the weight each one contributed. You can audit a verdict instead of accepting it.
Open
Open source on GitHub, published on PyPI. CLI-first and scriptable, with results written as PCAP, NDJSON, HTML, PDF and JSON.
Get Started

See What Your
Network
Actually Sent.

Version 2.0.0 — open source, CLI-native, Windows · Linux · macOS.

Install Now — pip install packetpulse View on GitHub