Packet capture, on your own interfaces.

Same category as tcpdump/Wireshark. Not a proxy like WraithFlow — this sits directly on an interface and sees everything crossing it: TCP, UDP, ICMP, ARP, anything, not just traffic you've deliberately routed through a pipeline.

Install Source

bpf filters pcap export follow tcp stream

Scope — live

Capture feed

TCP10.0.0.14:51882 → 140.82.113.3:443 [SYN]

TCP140.82.113.3:443 → 10.0.0.14:51882 [SYN,ACK]

UDP10.0.0.14:52110 → 1.1.1.1:53 len=61

ICMP10.0.0.14 → 10.0.0.1 echo request

TCP10.0.0.14:51882 → 140.82.113.3:443 [ACK]

UDP1.1.1.1:53 → 10.0.0.14:52110 len=134

Capture engine

Real libpcap, real BPF.

The exact same capture engine tcpdump/Wireshark use — via the pcap crate. BPF filter syntax (tcp port 22, udp and not port 53) comes free from libpcap, not reimplemented.

-w capture.pcap writes every frame to a real Wireshark-compatible file alongside terminal output.

Proteus — TUI

Follow TCP Stream.

The interactive browser AetherScope never had. Press s on a selected TCP packet to reconstruct the full conversation, both directions, color-coded — the actual headline feature this was built for.

j/k move · / filter · w export · ? help

Output

Three formats. One pipeline.

summary (tcpdump-style, one line), hexdump, or json — same parsed packet, three renderers. Colors sourced from the shared cybercore CYBERGRID palette, by protocol.

Verified

Round-tripped through real tshark.

pcap export/import isn't just verified against itself — Proteus's own exports were checked against real tshark reading them, and vice versa.

Roadmap

Ethernet/IPv4/IPv6/TCP/UDP/ICMP parsing, unit-tested

BPF filtering via libpcap

summary/hexdump/json output

pcap export/import, verified against tshark

Follow TCP Stream, tshark-verified

IPv6 extension header chains

Higher-level dissection (HTTP, DNS, TLS)

Sequence-aware TCP stream reassembly

Install

>_ curl -fsSL https://raw.githubusercontent.com/cybercoretech/aetherscope/main/install.sh | sh

Installs both aetherscope and proteus. Needs root or CAP_NET_RAW to open a capture device — --list-interfaces works unprivileged. Note: sudo resets PATH, so a bare sudo aetherscope may say "command not found" even though it's installed — use sudo env "PATH=$PATH" aetherscope ....

More install options & manual builds →