nfstream

Why we included this project

NFStream is a Python framework that turns raw pcap files or live network interfaces into clean, labeled flow records in a few lines of code. On top of nDPI, it handles deep packet inspection and encrypted application identification, so you can separate traffic by service and recognize protocols like TLS or SSH without writing your own parsers. It also extracts the statistical flow features that ML-based traffic classification depends on, and supports retraining and deploying models against live traffic. For security analysts, SREs, and researchers building reproducible network datasets, that saves the trouble of putting together a pcap-to-feature pipeline from scratch.