Free tools Windows power users keep installed
One-click scans. No signup required.
tcpcat is an open-source network reconnaissance engine written in Go. Its official repository documents network discovery, TCP, UDP, and ICMP enumeration, service and version fingerprinting, vulnerability-data correlation, and detection logic written as sandboxed WebAssembly modules. The eBPF/AF_XDP packet path is optional, and whether it works, and how fast it runs, depends on your Linux kernel, network driver, and device. The performance numbers in the project’s documentation are the maintainer’s own measurements, not independent benchmarks.
What tcpcat covers
According to the tcpcat GitHub repository, the tool combines several jobs that are often split across separate programs:
As an Amazon Associate I earn from qualifying purchases.
- Discovery: asynchronous DNS, mDNS, and NetBIOS discovery of hosts on a network.
- Port and service enumeration: TCP, UDP, and ICMP enumeration, with service topology and version fingerprinting.
- Vulnerability correlation: matching discovered service versions against Vulners, Google OSV, or an offline database.
- Programmable detections: WASM detection modules that run in a sandbox, and custom protocol dissectors that the project says can be written in Rust, C, Go, or AssemblyScript.
These are capabilities the project documents. Readers should treat them as the feature list to verify against their own needs, not as a set of results that has been independently tested.
What AF_XDP means for your install
AF_XDP is a Linux mechanism that connects XDP programs running in the kernel to sockets and packet buffers in user space. The Linux kernel documentation for AF_XDP describes RX and TX rings and a shared memory area called UMEM.
#1 Best Overall
- Available with the Cloud Labs which provide a hands-on, immersive mock IT infrastructure enabling students to test their skills with realistic security scenarios
- New Chapter on detailing network topologies
- The Table of Contents has been fully restructured to offer a more logical sequencing of subject matter
- Introduces the basics of network security—exploring the details of firewall security and how VPNs operate
- Increased coverage on device implantation and configuration
The kernel documentation also distinguishes how XDP attaches to the network path:
- XDP_SKB (generic mode): a fallback that works without driver-specific support, at the cost of running later in the network stack.
- XDP_DRV (driver mode): runs inside the network driver itself, and is only available when that driver implements it.
The kernel documentation also describes copy and zero-copy binding options. Performance therefore varies with the mode, driver, and device in use. Do not assume that “AF_XDP” means zero-copy operation or identical speed on every machine. If your interface does not support driver-mode XDP, tcpcat’s fast path may not be available in the form the project’s figures describe, and you should measure what your hardware actually does.
Requirements before you install
The repository lists the following requirements. Check the README’s current platform table and release instructions before installing, because these values can change between releases.
Rank #2
- equipped with atom n2600 d2700 processor, compatible with many freebsd based router systems, linux distros, or win.os supported, easy configuration and management
- Please note, this is a barebone only. A system memory, a storage drive and an operating system are needed to complete this system
- 13-19 inches 1u, 50w power, with power cord, make sure to use a big brand memory and ssd/hdd with quality assurance
- Designed with console, 2 x usb, 4 x lan, vga, power switch, size at 290 x 180 x 44mm
- There are 2 inside reserved fans on chassis, which could be removed freely or be turned on in a high temperature environment to ensure the best function of the product
| Requirement | Stated value in the repository | Notes |
|---|---|---|
| Linux kernel for eBPF/XDP | 5.8 or later | Optional. Needed only for the eBPF/XDP path; the rest of the tool does not depend on it. |
| Go toolchain | 1.26 or later | Required to build from source. |
| Raw socket privileges | CAP_SYS_ADMIN or root | Needed for raw-socket operations. |
| Compiler for eBPF | gcc or clang | Optional, needed only to compile eBPF programs. |
| Other platforms, including macOS | Described with more limited capabilities | The repository’s platform table defines what is supported on each platform. |
Project-published performance figures
The repository publishes the following numbers. The project presents them as its own test results, and no independent measurement of them has been published in the sources reviewed for this article.
| Measurement | Reported value | Conditions stated by the project |
|---|---|---|
| Packet throughput | About 1 million packets per second per core | Associated with the eBPF/AF_XDP mode. Hardware, driver, and traffic conditions are not stated in the excerpt reviewed. |
| Ports 1–1024 scan time | 80 ms for tcpcat; 1.9–2.3 seconds for Nmap | Described as baseline values. The full test setup is not given in the README excerpt reviewed. |
| Full 1–65,535 SYN scan across two hosts | tcpcat eBPF/XDP: 4.466 s; Nmap: 11.723 s; naabu: 20.945 s | Rate limit of 25,000 packets per second; three runs; published by the project as its own test results. |
Read these figures as claims about one configuration the project chose, not as expected performance on your network. Comparisons with other tools depend on their versions, flags, and settings, which the README does not fully specify. If speed matters for your decision, run the same scan with each tool on your own hardware, against hosts you are authorized to test, using the same rate limit and repeating each run several times.
Evasion-style controls and their limits
The repository describes advanced packet controls, such as fragmentation, decoy traffic, and timing variation. It says they are meant for checking how an authorized team’s monitoring stack records varied traffic. It also states plainly: “These controls do not guarantee detection avoidance or IDS/IPS bypass.” Treat that sentence as the operating limit for these features. Their purpose is to test visibility, not to make scanning invisible.
Rank #3
- SonicWall TZ270W Appliance Only - No Service Subscription (02-SSC-2823) - Combines enterprise-grade firewalling with integrated 802.11ac Wave 2 Wi-Fi to deliver secure wired and wireless connectivity in one compact device for small offices and clinics.
- Blocks zero-day threats and ransomware with Capture ATP sandboxing enhanced by RTDMI, plus IPS and anti-malware scanning for layered protection.
- Eliminates the need for separate access points in smaller spaces thanks to built-in high-speed wireless that is simple to deploy and manage.
- Supports VPN, SD-WAN, and TLS 1.3 decryption to secure hybrid cloud access and remote workers while maintaining usability and performance.
- Delivers gigabit performance with up to 750,000 concurrent connections to handle growth in users, devices, and SaaS applications.
A similar caution applies to vulnerability correlation. The repository says a version or banner match against a CVE is a lead that needs validation, not proof that a system can be exploited.
Recommended Free Tools
Authorization and intended use
The project describes itself this way: “The project is intended for learning, network administration, and authorized security testing.” For any system you do not own or administer, the repository calls for explicit written authorization, a documented scope, and a defined assessment window before scanning begins. Scanning without those in place is outside the project’s stated purpose, regardless of how the tool behaves technically.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Project status and who it suits
The project repository describes tcpcat as a personal open-source community project, not a commercial product. It states there is no hosted scanning service, no paid support, no managed assessments, and no customer accounts. A project post on DEV Community, dated 2026-10-01 and written by the project, gives an overview, but the repository takes precedence where the two differ.
tcpcat suits people who are comfortable building a Go tool from source, who can work with Linux kernel and driver details, and who want to script their own detections in WASM. It is a poor fit for someone who needs a supported commercial product, vendor-backed support, or a tool with a long track record of independent testing.
Rank #4
- Compact and Efficient Design: The FortiGate 40F is designed for small to mid-sized businesses and enterprise branch offices, featuring a compact, fanless desktop form factor that ensures quiet operation and minimizes space usage.
- Robust Connectivity Options: Equipped with 5 GE RJ45 ports, including 1 WAN port and 4 internal ports, this model provides essential connectivity and flexibility for various network configurations in a small-scale environment.
- High-Performance Security: Offers up to 1 Gbps IPS throughput and 600 Mbps threat protection throughput, using Fortinet’s purpose-built security processor technology to deliver industry-leading performance and protection for SSL encrypted traffic.
- Advanced Threat Protection: Integrated with Fortinet’s AI-powered FortiGuard Labs, the FortiGate 40F offers comprehensive cybersecurity, identifying and mitigating both known and unknown threats to maintain robust security across your network.
- Simplified Management and Deployment: Features a user-friendly management console that provides comprehensive network automation and visibility, coupled with Zero Touch Integration with Fortinet’s Security Fabric for easy deployment.
Checking your system before installing
These checks confirm prerequisites only. They do not test tcpcat itself.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →- Confirm the kernel version. Run
uname -r. The repository lists 5.8 or later for eBPF/XDP use. - Confirm the Go toolchain. Run
go version. The repository lists Go 1.26 or later. - Identify the network driver for your capture interface. Run
ethtool -i eth0, replacingeth0with your interface name. Thedriver:line tells you which driver to check. Consult that driver’s documentation or the kernel source to see whether it supports native XDP. Without native support, expect the generic XDP_SKB path described above. - Confirm privileges. Run
id -u. A result of0means you are root. Otherwise, rungetpcaps $$and check that CAP_SYS_ADMIN is present in the effective set. - Check the compiler, only if you plan to build eBPF programs. Run
clang --versionorgcc --version. - Read the platform table in the README to confirm your operating system is supported at the level you need.
If your driver lacks native XDP support or your kernel is older than 5.8, you can still use the parts of the tool that do not depend on eBPF/XDP, provided the README confirms that for your platform.
Quick Recap
“
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
