github.com/bad-antics/nullsec-sniff
main / published Jan 27, 2026 / repository
NullSec Sniff - Network packet capture and analysis tool
NullSec sniff
Network packet sniffer with protocol analysis
Overview
Part of the NullSec security toolkit. Written in Crystal.
Features
- Packet capture and analysis
- Protocol parsing (TCP/UDP/ICMP/ARP)
- Service identification
- Interface statistics
- Filtering by protocol, port, host
Installation
crystal build --release src/sniff.cr -o sniff
sudo cp sniff /usr/local/bin/
Usage
sniff --help # Show help
sniff -i eth0 # Capture on interface
sniff -i eth0 -p tcp # TCP only
sniff -l # List interfaces
Author
bad-antics - NullSec Project
License
MIT License
API
- ARPHeader
ARP header structure
- Colors
ANSI Colors
- EthernetHeader
Ethernet header structure
- IPv4Header
IPv4 header structure
- PacketStats
Packet statistics
- Sniffer
Main sniffer class
- TCPHeader
TCP header structure
- UDPHeader
UDP header structure