This is a non-IMPACT record, meaning that access to the data is not controlled by IMPACT. For access, see the directions below.

This Resource is offered and provided outside of the IMPACT mediation framework. IMPACT and the IMPACT Coordination Council/Blackfire Technology, Inc. expressly disclaim all conditions, representations and warranties including but not limited to Resource availability, quality, accuracy, non-infringement, and non-interference. All Resource information and access is controlled by entities and under terms that are external to the IMPACT legal framework.


External Tool
External Data Source
51 (lowest rank is 51)

Category & Restrictions

network data, forensics, cyber defense


Xplico is an open source network forensic analysis tool

The goal of Xplico is extract from an internet traffic capture the applications data contained.
For example, from a pcap file Xplico extracts each email (POP, IMAP, and SMTP protocols), all HTTP contents, each VoIP call (SIP), FTP, TFTP, and so on. Xplico isn't a network protocol analyzer. Xplico is an open source Network Forensic Analysis Tool (NFAT).

- Protocols supported: HTTP, SIP, IMAP, POP, SMTP, TCP, UDP, IPv6, ...;
- Port Independent Protocol Identification (PIPI) for each application protocol;
- Multithreading;
- Output data and information in SQLite database or Mysql database and/or files;
- At each data reassembled by Xplico is associated a XML file that uniquely identifies the flows and the pcap containing the data reassembled;
- Realtime elaboration (depends on the number of flows, the types of protocols and by the performance of computer -RAM, CPU, HD access time, ...-);
- TCP reassembly with ACK verification for any packet or soft ACK verification;
- Reverse DNS lookup from DNS packages contained in the inputs files (pcap), not from external DNS server;
- No size limit on data entry or the number of files entrance (the only limit is HD size);
- IPv4 and IPv6 support;
- Modularity. Each Xplico component is modular. The input interface, the protocol decoder (Dissector) and the output interface (dispatcher) are all modules;
- The ability to easily create any kind of dispatcher with which to organize the data extracted in the most appropriate and useful to you;

Additional Details

internet mail protocols, microcomputers, xplico, computer memory, network booting, clear text protocols, data serialization formats, packets, transport layer security, external data source, history of the internet, computer architecture, xml, internet protocol, multithreading, communication, network packet, protocol analyzer, uniform resource identifier, name server, computer network analysis, hypertext transfer protocol, computing input devices, history of computing hardware, input device, processor, internet traffic, history of computing, segmentation and reassembly, voice over ip, trivial file transfer protocol, file transfer protocol, server, network analyzers, internet message access protocol, cryptographic protocol, communication protocol, application layer protocols, servers, ipv4, pcap, ipv6, domain name system, verification and validation, internet governance, email, random access memory, videotelephony, simple mail transfer protocol, inferlink corporation, computer file formats, technical communication, network architecture, secure communication, 1368, quality management, computer mediated communication, application layer, reverse dns lookup