NetProbe
Open-source · C++20 · MIT

Read the network
down to the byte.

NetProbe is a C++20 traffic analyzer that decrypts QUIC ClientHello SNI, measures per-flow RTT, maps GeoIP and ASN, and names the process behind every connection — live, or from a PCAP.

Download latest release View source
Windows Linux macOS Npcap / libpcap Dear ImGui
packet_detail decoding
01 / 03 · TCP · TLS
  1. FRAME Ethernet II
  2. NETWORK IPv4
  3. TRANSPORT TCP
  4. APPLICATION TLS

Download

Get NetProbe.

Prebuilt and ready to run — no compiler or SDK needed. Dependencies are bundled or set up for you.

Loading releases…
Architecture

One packet, four stages.

A bounded producer–consumer pipeline: capture never blocks on the UI, and the UI never blocks on capture. Every stage is a real component in the source.

01 ICaptureBackend

Capture

Npcap or libpcap on a backend-owned thread, pushed into a bounded queue that drops the oldest packets under load so the view stays close to live.

02 ProtocolParser

Parse

Stateless decode: link layer → IPv4/IPv6 → tunnel descent → transport → application hints and service classification.

03 FlowAggregator

Aggregate

Both directions collapse into one canonical flow, tracking rates, byte totals, and initial TCP RTT from the SYN/SYN-ACK delta.

04 GuiLayer

Render

The Dear ImGui frame loop drains the queue, enriches packets, and updates every view without blocking the capture thread.

Capabilities

Depth where it counts.

Not just headers and ports — NetProbe recovers the details that usually stay hidden behind encryption, NAT, and short-lived sockets.

QUIC ClientHello SNI

Decrypts QUIC v1 (RFC 9000) and v2 (RFC 9369) Initial packets and reassembles CRYPTO frames across Initials to recover the SNI on any UDP port.

Initial TCP RTT

Measures round-trip time from the SYN / SYN-ACK delta and color-codes it by latency, per flow.

Process attribution

Names the owning process on Windows (iphlpapi), Linux (/proc), and macOS (proc_pidfdinfo), captured while the socket is live.

GeoIP / ASN

Adds country and ASN/organization to each flow from MaxMind GeoLite2 databases.

BPF filters & export

Live BPF capture filters such as tcp port 443, a separate display filter, PCAP export, and flow export to CSV or JSON.

Cross-platform backends

Npcap on Windows, libpcap on Linux and macOS, behind one ICaptureBackend interface.

In the app

Three views on one capture.

A Dear ImGui dashboard you can dock, filter, and theme — reading a live adapter or a PCAP on disk.

NetProbe live packet analysis view
Live packet analysis Protocol, hostname, and per-packet hex
NetProbe connection flows view
Connection flows Rate, service, GeoIP, and ASN
NetProbe offline PCAP mode
Offline PCAP mode No administrator rights required
Verified on every push
95 tests 40 adversarial fixtures libFuzzer harness ASan + UBSan clang-tidy Windows · Linux · macOS CI
Build from source

Clone, build, test.

Prefer to compile it yourself? Prebuilt downloads are above — or build from source in a few commands.

Requires Visual Studio 2022 (C++ Desktop), the Npcap driver, and the Npcap SDK extracted to C:\Npcap-SDK.

PowerShell
git clone https://github.com/YehiaGewily/netprobe-cpp.git
cd netprobe-cpp
.\build_project.bat