See everything.
Send nothing.

2-minute demo

Load a PCAP, browse hosts, explore vulnerabilities, and navigate the topology map.

What you get

Dashboard — hosts, services, vulnerabilities at a glance

Network Topology — color-coded by risk severity

CVE Browser — 287K CVEs searchable with EPSS & KEV

HTML Report — shareable, self-contained vulnerability report

Everything passive.
Nothing missed.

nopack extracts an extraordinary amount of intelligence from traffic you already have — PCAP files, live capture, or both.

Distributed mode

Deploy sensors across your network. Aggregate findings on a central master with a unified dashboard and REST API.

Getting Packets to nopack

nopack reads standard PCAP files — the same format used by every IDS, packet broker, and forensics tool. If you’ve deployed Snort, Suricata, or Zeek, you already know how to feed nopack.

# Capture all traffic on eth0
sudo tcpdump -i eth0 -w capture.pcap

# Rotate: new file every hour, keep 24
sudo tcpdump -i eth0 -w cap-%H.pcap \
  -G 3600 -W 24

# Analyze with nopack
nopack --pcap capture.pcap --server

# Wireshark: Capture → Save As → .pcap

# tshark (Wireshark CLI)
tshark -i Ethernet -w capture.pcap

# WinDump (requires Npcap)
windump -i 1 -w capture.pcap

# Or use nopack directly
nopack.exe -i Ethernet -w capture.pcap

# Live capture with web dashboard
sudo nopack -i eth0 --server 0.0.0.0:8080

# Save to file + dashboard
sudo nopack -i eth0 -w capture.pcap \
  --server 0.0.0.0:8080

# Capture for 5 minutes
sudo nopack -i eth0 -d 300 --server

# Cisco IOS
monitor session 1 source interface Gi0/1
monitor session 1 destination interface Gi0/24

# HP / Aruba
mirror 1 port 24
interface 1 monitor all both mirror 1

# On the sensor
sudo nopack -i eth0 --promisc --server

# Tap types:
#  Passive fiber — split optical signal
#  Passive copper — signal splitter
#  Active/regen — powered, higher speed
#  Aggregation — merge multiple links

# On sensor connected to tap MON port
sudo nopack -i eth1 --promisc --server

# Create Linux bridge
sudo ip link add br0 type bridge
sudo ip link set eth0 master br0
sudo ip link set eth1 master br0
sudo ip link set br0 up

# Capture on the bridge
sudo nopack -i br0 --server

# Linux — monitor mode
sudo ip link set wlan0 down
sudo iw wlan0 set monitor control
sudo ip link set wlan0 up

# Capture
sudo tcpdump -i wlan0 -w wifi.pcap
nopack --pcap wifi.pcap --server

# AWS VPC Traffic Mirroring
aws ec2 create-traffic-mirror-session \
  --network-interface-id eni-src \
  --traffic-mirror-target-id tmt-xx

# Docker
sudo tcpdump -i docker0 -w docker.pcap

# On capture instance
sudo nopack -i eth0 --promisc --server

# On phone:
# Tap Start → use phone → tap Stop
# Share the .pcap to your computer

# On computer:
nopack --pcap nopack_20260218.pcap \
  --server

# Master server
nopack --master --server 0.0.0.0:8080 \
  --agent-key SECRET

# Agents (on each sensor)
sudo nopack -i eth0 --agent \
  --master-url https://master:8080 \
  --agent-key SECRET \
  --agent-name dmz-sensor

Network Tap Deployment

SPAN vs. Taps: SPAN is easier to set up but uses switch CPU and may drop packets under load. Taps are completely passive and more reliable, but require physical access. For nopack’s purposes — fingerprinting, vulnerability detection — SPAN is usually sufficient since you don’t need 100% packet capture.

ARP Spoofing (Active Interception)

# Enable IP forwarding
sudo sysctl -w net.ipv4.ip_forward=1

# Spoof: tell network you're the gw
sudo arpspoof -i eth0 \
  -t 192.168.1.0/24 192.168.1.1 &

# Bidirectional
sudo arpspoof -i eth0 \
  -t 192.168.1.1 192.168.1.0/24 &

# Capture the redirected traffic
sudo nopack -i eth0 --server

# Bettercap
sudo bettercap -iface eth0
> set arp.spoof.targets 192.168.1.0/24
> arp.spoof on
> set net.sniff.output capture.pcap
> net.sniff on

# Ettercap
sudo ettercap -T -M arp:remote \
  /192.168.1.1// /192.168.1.0/24// \
  -w capture.pcap

Detection: nopack itself detects ARP spoofing — if two different MAC addresses claim the same IP in a capture, it flags the anomaly. Organizations can both perform and detect this technique. Mitigations: Dynamic ARP Inspection (DAI), 802.1X, and static ARP entries can prevent ARP spoofing. If these are in place, use a tap or SPAN port instead.

Method Comparison

Get nopack for your platform

Single binary, no dependencies. Download, extract, and run your first scan in under a minute.

History

Nopack was created in 2011 as a passive vulnerability assessment tool written in Ruby. Unfortunately it never got out of beta and I eventually abandoned the project. I decided to rewrite the app with Rust for various reasons — performance, security, and the ability to ship a single, dependency-free binary that runs everywhere.