Xplico
What it is
Xplico is an open-source network forensic analysis tool for extracting application data from PCAP internet traffic captures. It can recover email, HTTP content, VoIP calls, and FTP or TFTP data. Supported protocols include HTTP, SIP, IMAP, POP, SMTP, TCP, UDP, and IPv6, and its Port Independent Protocol Identification identifies application protocols without relying on port numbers. Processing can be multithreaded and real time, with performance depending on traffic flows, protocols, and available computer resources. Results can be written to files or SQLite and MySQL databases. A web interface allows concurrent users to manage cases, with SQLite, MySQL, or PostgreSQL available as the backend. Modular capture, dissector, and dispatcher components can send output to files, databases, or network sockets. Xplico runs on Linux and Unix-like operating systems; downloads include Fedora, CentOS/RHEL, Ubuntu, source code, and a VirtualBox image. Its free plan has no data-entry or input-file count limit, with hard-drive size as the constraint. Traffic decryption is not supported.
For and against
For
- Free plan has no input-file count limit.
- Extracts email, HTTP, VoIP, FTP, and TFTP data.
- Supports multithreaded and real-time processing.
- Concurrent users can manage cases through the web interface.
- Output can be directed to files or databases.
Against
- Traffic decryption is not supported.
- Processing performance depends on traffic and computer resources.
- SSL/TLS and IPsec dissectors are listed at 0%.
- 802.11 support is listed at 60% without encryption support.
The verdict
Xplico focuses on extracting application data from PCAP captures, with configurable processing and output options. Its listed decryption limits are important to account for when assessing traffic that requires encrypted-protocol analysis.
Who it suits
Xplico suits Linux and Unix-like users who need to examine PCAP captures and extract application data. It is relevant to analysts who want case management through a web interface or modular output options.
Plans and prices
Xplico Free Software
No data-entry or input-file count limit · hard-drive size is the only limit
Read 1 Oct 2026 · wiki.xplico.org
On the record
- Deployment
- Official downloads cover Fedora, CentOS/RHEL and Ubuntu, plus source code and a VirtualBox image.xplico.org · read 1 Oct 2026
- Extracted data
- From PCAP files, Xplico can extract email, HTTP contents, VoIP calls, FTP and TFTP data.xplico.org · read 1 Oct 2026
- Integrations
- The official site lists CapAnalysis as a PCAP viewer and n2disk, netsniff-ng and Junkie as capture tools.xplico.org · read 1 Oct 2026
- Licensing
- The Xplico decoder, DeMa and listed manipulators are GPL v2.0, while Xplico Interface can use MPL 1.1 or later, GPL 2.0 or later, or LGPL 2.1 or later.xplico.org · read 1 Oct 2026
- Modularity
- Capture, dissector and dispatcher components are modular, and dispatchers can target files, SQLite, Oracle, MySQL, PostgreSQL or network sockets.wiki.xplico.org · read 1 Oct 2026
- Processing
- Xplico supports multithreading and realtime processing whose performance depends on flows, protocol types and computer resources.xplico.org · read 1 Oct 2026
- Protocol identification
- Xplico provides Port Independent Protocol Identification for each application protocol.xplico.org · read 1 Oct 2026
- Protocol support
- Supported protocols include HTTP, SIP, IMAP, POP, SMTP, TCP, UDP and IPv6.xplico.org · read 1 Oct 2026
- Purpose
- Xplico extracts application data from internet traffic captures and is an open-source Network Forensic Analysis Tool.xplico.org · read 1 Oct 2026
- Release status
- The official status page lists decoder version 1.2.2 as stable and 1.3.0 as the development version.xplico.org · read 1 Oct 2026
- Security limit
- The status page lists SSL/TLS and IPsec dissectors at 0% with keys and 802.11 at 60% with no encryption support.xplico.org · read 1 Oct 2026
- Storage
- Output can be written to SQLite or MySQL databases and/or files.xplico.org · read 1 Oct 2026
- Support
- Documentation is provided through the Xplico Wiki, with questions and problem reports handled through the forum and [email protected].xplico.org · read 1 Oct 2026
- Web interface
- The product has a web user interface, supports concurrent users managing one or more cases, and can use SQLite, MySQL or PostgreSQL as its backend database.xplico.org · read 1 Oct 2026
