NetOtter is a cross-platform packet listener and anlyser.

C 96.2%
Python 1.3%
HTML 1.1%
Shell 0.9%
Makefile 0.4%

Find a file

Watersrc-stack 6d792a596e Version 1.2.1 Fix of some keybinds		2026-10-14 05:50:00 +02:00
includes	(enhancement) Interactive commands take their argument on the same line (i 30, O file, f port 443, F port 22, port 80,,, r 2), asking only when it's left out; str_to_id can't overflow on long ids	2026-10-14 05:49:42 +02:00
libs	(enhancement) Interactive commands take their argument on the same line (i 30, O file, f port 443, F port 22, port 80,,, r 2), asking only when it's left out; str_to_id can't overflow on long ids	2026-10-14 05:49:42 +02:00
src	(enhancement) Interactive commands take their argument on the same line (i 30, O file, f port 443, F port 22, port 80,,, r 2), asking only when it's left out; str_to_id can't overflow on long ids	2026-10-14 05:49:42 +02:00
tools	(fix) make docs: the hand-written flows and module descriptions follow r1.02.00 (save format v16, application facts, anomaly detection flow)	2026-10-14 04:34:16 +02:00
.gitignore	(feat) Anomaly detection: flows, top talkers, port scans, sweeps, request floods and bursts, brute force, foreign and direct-IP hosts (-T), s / w commands, anomaly filter, live alerts with severity colors, and the tools/lab regression lab	2026-10-14 04:05:06 +02:00
Makefile	Merge branch 'documentation/prep-r1' into dev	2026-10-14 04:06:18 +02:00
README.md	(fix) Links to the new forge; make docs takes FORGE_URL and PAGES_URL	2026-10-14 04:06:05 +02:00

README.md

NetOtter

NetOtter is a packet sniffer for the terminal, written in C. It lists your network interfaces, captures on the ones you enable, and decodes each frame layer by layer: Ethernet, ARP, IPv4, IPv6, TCP, UDP, IGMP and MLD. Its analysis view names the hosts and the applications behind the traffic. It runs on Linux and Windows and reads the same capture files on both.

Features

Live capture on Linux (raw AF_PACKET sockets) and Windows (through Npcap).
Interactive or scripted: toggle interfaces and inspect packets from the keyboard, or capture in CLI mode until Ctrl-C.
Display filters on addresses, ports, IP protocol, EtherType and "this machine" (me), combined with OR or AND.
Analysis view: port names, hostnames learned passively from DNS answers, TLS SNI and QUIC Initial packets, app categories, and your own renamings.
Save files (.nto): compact, with compressed payloads. They keep the filters, the renamings and the learned names, and load the same on both systems.
Nothing sent behind your back: the only packets NetOtter ever sends are reverse DNS lookups. Each one is announced and logged, and -N turns them off.
Bounded memory: payloads are compressed into a temporary file, and the packet list has a RAM budget.

Build and install

Linux

Requirements: GCC, GNU make and OpenSSL's libcrypto.

make release      # optimised, hardened build
make install      # copies it to /usr/bin with cap_net_raw (asks for your password)

Windows

Install Npcap for live capture. Without it, NetOtter still opens and reads .nto files. Build with a 64-bit MinGW-w64 toolchain (WinLibs or MSYS2 UCRT64).

mingw32-make release
mingw32-make install        :: for you only, in %LOCALAPPDATA%\Programs\NetOtter
mingw32-make install-admin  :: for all users, in Program Files, added to PATH (admin prompt)

Quick start

netotter -l                   # list the interfaces and their ids
netotter -i 2                 # capture on interface 2, interactive (h lists the commands)
netotter -c -i 2 -O capture   # capture until Ctrl-C, then save to capture.nto
netotter -I capture.nto -c    # print a saved capture

Documentation

The wiki has three sections:

User guide: installation, options, commands, filters, the analysis view, save files.
Developer documentation: architecture, the build, the save format and the function explorer.
Learning: how Ethernet, IPv4, IPv6, TCP, UDP, QUIC and DNS packets are built, with real examples.