Freedom251 › Network Packet Analyzer Software
Xplico
What Xplico is
Xplico is a free, open-source network forensic analysis tool that extracts application data from PCAP traffic captures. It can extract email, HTTP content, VoIP calls, and FTP or TFTP data, and supports protocols including HTTP, SIP, IMAP, POP, SMTP, TCP, UDP, and IPv6. Port Independent Protocol Identification identifies application protocols independently of port numbers. Processing supports multithreading and real-time operation, with performance depending on flows, protocol types, and computer resources. Results can be stored in files or SQLite and MySQL databases. Its web interface allows concurrent users to manage cases, with SQLite, MySQL, or PostgreSQL available as the backend. Modular capture, dissector, and dispatcher components can direct results to files, databases, or network sockets. Xplico runs on Linux and Unix-like systems; downloads cover Fedora, CentOS/RHEL, and Ubuntu, as well as source code and a VirtualBox image. The free plan is listed as free, with no data-entry or input-file count limit; hard-drive size is the stated limit. Live capture and a command-line tool are supported, but traffic decryption is not.
Who it suits
Xplico suits people conducting network forensics who need to extract application data from PCAP captures and manage cases through a web interface. It is intended for Linux and Unix-like systems.
What it does well
- Extracts email, HTTP content, VoIP, FTP, and TFTP data.
- Identifies application protocols independently of port numbers.
- Supports concurrent case management through a web interface.
- No input-file or data-entry count limit.
- Supports live capture and command-line use.
What to know first
- Traffic decryption is not supported.
- Hard-drive size limits stored data.
- SSL/TLS and IPsec dissectors are listed at 0%.
- 802.11 support is listed at 60% with no encryption support.
Limits
The free plan costs nothing and places no count limit on input files or data entries; hard-drive size is the stated constraint. Traffic decryption is not supported, and the status page lists SSL/TLS and IPsec dissectors at 0%, with 802.11 at 60% and no encryption support.
Plans
| Plan | Billed and limits | Price |
|---|---|---|
| Xplico Free Software | No data-entry or input-file count limit · hard-drive size is the only limit | Free |
As xplico.org lists them, read 1 Oct 2026. The maker's own page has the final word.
Getting started
- Visit the Xplico website.
- Choose a Fedora, CentOS/RHEL, or Ubuntu download, or use the source code or VirtualBox image.
- Install or deploy it on Linux or a Unix-like operating system.
- Use the web interface or command-line tool to work with captures.
- Process PCAP files or use live capture, then direct output to files or a supported database.
Verdict
Xplico provides PCAP extraction, protocol identification, and case management, with a free plan that has no input-file count limit. It does not decrypt traffic, and the listed SSL/TLS and IPsec dissectors are at 0%.
Questions
Is Xplico free?
Yes. Its Xplico Free Software plan costs nothing.
What files can Xplico process?
It processes PCAP files and can extract email, HTTP content, VoIP calls, and FTP or TFTP data.
Which operating systems does Xplico support?
It runs on Linux and Unix-like operating systems. Downloads cover Fedora, CentOS/RHEL, and Ubuntu, along with source code and a VirtualBox image.
Can multiple users work in Xplico?
Yes. Its web interface supports concurrent users managing one or more cases.
Is Xplico open source?
Yes. The Xplico decoder, DeMa, and listed manipulators use GPL v2.0; Xplico Interface can use MPL 1.1 or later, GPL 2.0 or later, or LGPL 2.1 or later.
Does Xplico decrypt network traffic?
No. Traffic decryption is not supported.
Facts from Xplico's own pages
- Deployment
- Official downloads cover Fedora, CentOS/RHEL and Ubuntu, plus source code and a VirtualBox image. · xplico.org, 1 Oct 2026
- Extracted data
- From PCAP files, Xplico can extract email, HTTP contents, VoIP calls, FTP and TFTP data. · xplico.org, 1 Oct 2026
- Integrations
- The official site lists CapAnalysis as a PCAP viewer and n2disk, netsniff-ng and Junkie as capture tools. · xplico.org, 1 Oct 2026
- Licensing
- The Xplico decoder, DeMa and listed manipulators are GPL v2.0, while Xplico Interface can use MPL 1.1 or later, GPL 2.0 or later, or LGPL 2.1 or later. · xplico.org, 1 Oct 2026
- Modularity
- Capture, dissector and dispatcher components are modular, and dispatchers can target files, SQLite, Oracle, MySQL, PostgreSQL or network sockets. · wiki.xplico.org, 1 Oct 2026
- Processing
- Xplico supports multithreading and realtime processing whose performance depends on flows, protocol types and computer resources. · xplico.org, 1 Oct 2026
- Protocol identification
- Xplico provides Port Independent Protocol Identification for each application protocol. · xplico.org, 1 Oct 2026
- Protocol support
- Supported protocols include HTTP, SIP, IMAP, POP, SMTP, TCP, UDP and IPv6. · xplico.org, 1 Oct 2026
- Purpose
- Xplico extracts application data from internet traffic captures and is an open-source Network Forensic Analysis Tool. · xplico.org, 1 Oct 2026
- Release status
- The official status page lists decoder version 1.2.2 as stable and 1.3.0 as the development version. · xplico.org, 1 Oct 2026
- Security limit
- The status page lists SSL/TLS and IPsec dissectors at 0% with keys and 802.11 at 60% with no encryption support. · xplico.org, 1 Oct 2026
- Storage
- Output can be written to SQLite or MySQL databases and/or files. · xplico.org, 1 Oct 2026
- Support
- Documentation is provided through the Xplico Wiki, with questions and problem reports handled through the forum and [email protected]. · xplico.org, 1 Oct 2026
- Web interface
- The product has a web user interface, supports concurrent users managing one or more cases, and can use SQLite, MySQL or PostgreSQL as its backend database. · xplico.org, 1 Oct 2026
Where Xplico stands on Freedom251
- Network Packet Analyzer Software#20 of 32