Analyze network traffic with state-of-the-art AI - Cloud or 100% Offline
Features • Quick Start • Documentation • Contributing
Sniff-Recon is a professional-grade network packet analyzer that combines traditional packet analysis with cutting-edge AI technology. Built for security researchers, SOC teams, and network engineers, it transforms complex PCAP data into actionable insights through natural language queries.
- 🔒 Privacy-First: Full offline mode with local LLMs (Ollama) - no data leaves your machine
- 🤖 Multi-Provider AI: Support for 6 AI providers (Groq, OpenAI, Anthropic, Google Gemini, xAI, Ollama)
- 📊 Smart Analysis: Automatic suspicious packet detection and threat clustering
- 🎨 Modern UI: Beautiful cyberpunk-themed Streamlit interface
- 🐳 Deploy Anywhere: Docker-ready, works on Linux/Windows/macOS
- 🚀 Scalable: Handle large PCAPs (up to 200MB) with intelligent chunking
| Feature | Description |
|---|---|
| Multi-Format Support | PCAP, PCAPNG, CSV, TXT log files |
| AI-Powered Analysis | Natural language queries: "Show me all SYN floods" |
| Offline Mode | 🔒 100% local analysis with Ollama (no external APIs) |
| Cloud AI Support | Groq, OpenAI, Anthropic, Google Gemini, xAI (Grok) |
| Load Balancing | Intelligent query distribution across AI providers |
| Packet Inspection | Layer-by-layer protocol analysis (Ethernet → Application) |
| Threat Detection | Automatic suspicious pattern identification |
| Export Capabilities | JSON, CSV, PDF reports |
| Large File Handling | Chunking strategy for files up to 200MB |
| Docker Deployment | One-command containerized setup |
| ☁️ Cloud Mode | 🔒 Offline Mode |
|---|---|
|
|
Note: Sniff-Recon is a local-only tool. All analysis runs on your machine for maximum privacy and control.
Best for: Privacy-sensitive analysis, classified traffic, air-gapped networks
# 1. Clone repository
git clone https://github.com/mfscpayload-690/Sniff-Recon.git
cd Sniff-Recon
# 2. Install Ollama (if not already installed)
curl -fsSL https://ollama.ai/install.sh | sh # Linux
# brew install ollama # macOS
# 3. Start Ollama and download model
ollama serve &
ollama pull qwen2.5-coder:7b
# 4. Configure environment
cp .env.template .env
# Edit .env: Set OLLAMA_ENABLED=true
# 5. Run automated setup
./dev-setup.sh
# Access at http://localhost:8501System Requirements:
- RAM: 8GB minimum (16GB recommended)
- Disk: 5GB for model + dependencies
- OS: Linux, macOS, Windows (WSL2)
Best for: Maximum AI quality, faster responses
# 1. Clone repository
git clone https://github.com/mfscpayload-690/Sniff-Recon.git
cd Sniff-Recon
# 2. Configure API keys
cp .env.template .env
# Edit .env and add your API keys:
# GROQ_API_KEY=sk-... (Free tier available)
# OPENAI_API_KEY=sk-...
# ANTHROPIC_API_KEY=sk-...
# GOOGLE_API_KEY=...
# XAI_API_KEY=...
# 3. Run with Docker
docker-compose up -d
# Access at http://localhost:8501Get Free API Keys:
- Groq - Fast inference, free tier ⭐
- OpenAI - Best quality
- Google Gemini - Free tier
- Anthropic - Claude models
- xAI - Grok
Best for: Development, testing, customization
git clone https://github.com/mfscpayload-690/Sniff-Recon.git
cd Sniff-Recon
# Create virtual environment
python -m venv venv
source venv/bin/activate # Linux/Mac
# venv\Scripts\activate # Windows
# Install dependencies
pip install -r requirements.txt
# Configure .env (Ollama or Cloud AI)
cp .env.template .env
# Run the app
streamlit run app.py
# Access at http://localhost:8501Supported formats:
- PCAP/PCAPNG: Standard packet captures (Wireshark, tcpdump)
- CSV: Exported packet data with IP/port columns
- TXT: Structured logs (IP, protocol, ports)
For Sensitive Data (Offline):
- Select "Ollama (Local)" from dropdown
- Look for 🔒 OFFLINE badge
- All analysis runs on your machine
For General Analysis (Cloud):
- Select "Auto (Load Balanced)" for automatic distribution
- Or choose specific provider (Groq, OpenAI, etc.)
Ask questions like:
- "What are the top 5 source IP addresses?"
- "Show me all SYN flood attempts"
- "Identify suspicious DNS queries"
- "Analyze HTTP traffic patterns"
- "Find potential port scans"
- Protocol Stats: Packet counts, IP distributions
- Packet Table: Interactive AgGrid with filtering
- Layer Inspector: Ethernet → IP → TCP/UDP → Application
- Hex Dump: Raw packet data view
- JSON: Structured analysis data
- CSV: Packet tables for spreadsheets
- PDF: Professional reports (upcoming)
┌─────────────────────────────────────────────────────────┐
│ Streamlit Web UI │
│ (File Upload, AI Chat, Packet Viewer) │
└────────────────┬────────────────────────────────────────┘
│
┌───────┴────────┐
│ │
▼ ▼
┌─────────────────┐ ┌──────────────────┐
│ Parser Layer │ │ AI Layer │
│ - PCAP (Scapy) │ │ Multi-Agent │
│ - CSV (Pandas) │ │ Load Balancer │
│ - TXT (Regex) │ │ Chunking Engine │
└─────────────────┘ └────────┬─────────┘
│
┌────────────┴────────────┐
│ │
▼ ▼
┌───────────────────┐ ┌──────────────────┐
│ Cloud Providers │ │ Local LLM │
│ - Groq │ │ - Ollama │
│ - OpenAI │ │ (100% Offline) │
│ - Anthropic │ └──────────────────┘
│ - Google Gemini │
│ - xAI (Grok) │
└───────────────────┘
Design Principles:
- ✅ Separation of Concerns: Parsers are deterministic, AI only receives summaries
- ✅ Provider Agnostic: Easy to add new AI backends
- ✅ Security First: No raw packet data sent to AI, secrets in
.env - ✅ Offline-First: Full functionality without internet (Ollama mode)
- Setup Guide - Detailed installation instructions
- Quick Reference - Common commands and workflows
- Troubleshooting - Common issues and solutions
- Weighted Load Balancing - Configure AI provider distribution
- Docker Deployment - Container orchestration
- UI Development - Frontend customization
- Contributing Guide - How to contribute
- Development Workflow - Code standards
- Roadmap - Upcoming features
- Offline Mode: Ollama processes everything locally, no external connections
- Cloud Mode: Only packet summaries sent to AI (never raw payloads)
- Secrets Management: API keys stored in
.env(never committed) - Input Validation: File size limits, extension whitelist, rate limiting
Found a security issue? Please report privately via:
- GitHub Security Advisories (preferred)
- Email: See SECURITY.md
Do not create public issues for security vulnerabilities.
We welcome contributions! Here's how to get started:
- Fork the repository
- Create a feature branch (
git checkout -b feat/amazing-feature) - Commit your changes (
git commit -m 'feat: Add amazing feature') - Push to the branch (
git push origin feat/amazing-feature) - Open a Pull Request
See CONTRIBUTING.md for detailed guidelines.
git clone https://github.com/mfscpayload-690/Sniff-Recon.git
cd Sniff-Recon
# Quick setup (Arch Linux with Ollama)
./dev-setup.sh
# Manual setup
python -m venv venv
source venv/bin/activate
pip install -r requirements.txt
streamlit run app.py --server.runOnSave trueRecent Updates (February 2026):
- ✅ Ollama local LLM support (offline mode)
- ✅ Enhanced provider selection UI with visual badges
- ✅ Explicit provider routing
- ✅ Simplified
.envconfiguration - ✅ Automated development setup script
See RELEASE_NOTES for full changelog.
- 🚧 Planned: Real-time packet capture (interface sniffing)
- 🚧 Planned: Multi-user authentication
- 🚧 Planned: Custom detection rule engine
- 🚧 Planned: Threat intel integration (VirusTotal, AlienVault)
See ROADMAP.md for complete feature pipeline.
- Streamlit - Web UI framework
- Scapy - Packet manipulation
- PyShark - PCAP analysis
- Ollama - Local LLM runtime
- Groq - Fast AI inference
- OpenAI - GPT models
- Anthropic - Claude models
- Google Gemini - Gemini API
- xAI - Grok API
Thanks to all contributors who have helped improve Sniff-Recon!
This project is licensed under the MIT License - see the LICENSE file for details.
- Issues: GitHub Issues
- Discussions: GitHub Discussions
- Sponsor: Buy Me a Coffee
⭐ Star this repository if you find it helpful!
Made with ❤️ by mfscpayload-690