pcapng

tcpdump

+9

the TCPdump network dissector

libpcap

+5

the LIBpcap interface to various kernel packet capture mechanism

gojue/ecapture

+5

Capture SSL/TLS plaintext with eBPF—no MITM proxy or custom CA installation. Supports Linux and Android on x86_64 and arm64.

ptcpdump

+4

Process-aware, eBPF-based tcpdump

Tracexy

+3

Native, local-first network intelligence for macOS—capture live traffic, inspect PCAP/PCAPNG files, and investigate sessions, protocols, processes, flows, and packet evidence.

hcxtools

+2

A small set of tools to convert packets from capture files to hash files for use with Hashcat or John the Ripper.

hcxdumptool

+1

Small tool to capture packets from wlan devices.