Wednesday, May 7, 2025
HomeComputer SecurityHow to Analyse a PCAP file WITH XPLICO - Network Forensic Analysis...

How to Analyse a PCAP file WITH XPLICO – Network Forensic Analysis Tool

Published on

SIEM as a Service

Follow Us on Google News

Network forensics is a sub-branch of digital forensics relating to the monitoring and analysis of computer network traffic for the purposes of information gathering, legal evidence, or intrusion detection.

Unlike other areas of digital forensics, network investigations deal with volatile and dynamic information. Network traffic is transmitted and then lost, so network forensics is often a proactive investigation.

What is PCAP File?

In the field of computer network administration, pcap (packet capture) consists of an application programming interface (API) for capturing network traffic.

- Advertisement - Google News

Unix-like systems implement pcap in the libpcap library; Windows uses a port of libpcap known as WinPcap.

It is a Data file created by Wireshark (formerly Ethereal), a free program used for network analysis; contains network packet data created during a live network capture; used for “packet sniffing” and analyzing data network characteristics; can be analyzed using software that includes the libpcap or WinPcap libraries

Forensic Analysis Medium

Well, we will be using a tool known as XPLICO, xplico is an open-source NFAT (Network Forensic Analysis Tool), the goal of Xplico is to extract from an internet traffic capture the application’s data contained.

Must Read Complete Kali Tools tutorials from Information gathering to Forensics

For example, from a pcap file Xplico extracts each email (POP, IMAP, and SMTP protocols), all HTTP contents, each VoIP call (SIP), FTP, TFTP, and so on
To know more about XPLICO tool click here

Procedure – Network Forensics

  • Open the terminal and start the xplico service by the command “etc/init.d/xplico start” or “service xplico start”
  • Go to the browser and type the following URL “ http://localhost:9876/ ”By the following credentials log in to the xplico web interface

“Username : xplico”
“Password : xplico”

  • Click on the new case and give it a name and a reference number and click Create.
  • Click on the case name (eg: test)
  • Click on a new session and give it a name (eg: analysis-1) and click on create
  • Click on the name of the session (eg analysis-1)
  • Click on browse and browse your PCAP file
  • After loading it on xplico interface click on the upload button
  • After the uploading process, the tool will start decoding
  • After the decoding process, you will get the status as shown below
  • Now you can get the overview of the analysis and in the left pane, you will have the option to navigate to the analysis done (below is the screenshot of the graph of DNS messages).

Conclusion

XPLICO – This tool is simple and easy to use also it does an intense analysis of the Packet Capture –PCAP file, This tool is pre-loaded in many penetrations testing Linux flavors such as KALI LINUX, PARROT OS, DEFT, Security Onion, Backbox, Pentooetc.

Source & credits

This article was provided to www.gbhackers.com by Shankara Narayanan Co-Leader at Hackers Day, a student at Tamil Nadu Dr. Ambedkar Law University.

Latest articles

BFDOOR Malware Targets Organizations to Establish Long-Term Persistence

The BPFDoor malware has emerged as a significant threat targeting domestic and international organizations,...

Uncovering the Security Risks of Data Exposure in AI-Powered Tools like Snowflake’s CORTEX

As artificial intelligence continues to reshape the technological landscape, tools like Snowflake’s CORTEX Search...

UNC3944 Hackers Shift from SIM Swapping to Ransomware and Data Extortion

UNC3944, a financially-motivated threat actor also linked to the group known as Scattered Spider,...

Over 2,800 Hacked Websites Targeting MacOS Users with AMOS Stealer Malware

Cybersecurity researcher has uncovered a massive malware campaign targeting MacOS users through approximately 2,800...

Resilience at Scale

Why Application Security is Non-Negotiable

The resilience of your digital infrastructure directly impacts your ability to scale. And yet, application security remains a critical weak link for most organizations.

Application Security is no longer just a defensive play—it’s the cornerstone of cyber resilience and sustainable growth. In this webinar, Karthik Krishnamoorthy (CTO of Indusface) and Phani Deepak Akella (VP of Marketing – Indusface), will share how AI-powered application security can help organizations build resilience by

Discussion points


Protecting at internet scale using AI and behavioral-based DDoS & bot mitigation.
Autonomously discovering external assets and remediating vulnerabilities within 72 hours, enabling secure, confident scaling.
Ensuring 100% application availability through platforms architected for failure resilience.
Eliminating silos with real-time correlation between attack surface and active threats for rapid, accurate mitigation

More like this

How To Use Digital Forensics To Strengthen Your Organization’s Cybersecurity Posture

Digital forensics has become a cornerstone of modern cybersecurity strategies, moving beyond its traditional...

Kaspersky Shares 12 Essential Tips for Messaging App Security and Privacy

In an era where instant messaging apps like WhatsApp, Telegram, Signal, iMessage, Viber, and...

Top 10 Best Penetration Testing Companies in 2025

Penetration testing companies play a vital role in strengthening the cybersecurity defenses of organizations...