Xplico

Quality 0.50 · 1 view · Updated 2 months ago

Network forensics analysis tool

title: "Xplico" type: doc version: 1 created: 2026-02-28 author: "Wikipedia contributors" status: active scope: public tags: ["free-software-programmed-in-c", "network-analyzers", "free-network-management-software", "unix-network-related-software", "linux-only-free-software", "software-using-the-gnu-general-public-license"] description: "Network forensics analysis tool" topic_path: "technology/operating-systems" source: "https://en.wikipedia.org/wiki/Xplico" license: "CC BY-SA 4.0" wikipedia_page_id: 0 wikipedia_revision_id: 0

::summary Network forensics analysis tool ::

::data[format=table title="Infobox software"]

Field	Value
name	Xplico
logo
screenshot
developer	Gianluca Costa & Andrea de Franceschi
released
latest release version	1.2.2
latest release date
latest preview date
programming language	C, PHP, Python
operating system	Linux
language count
genre	Network Forensics
license	GNU General Public License
website
::

Unlike the protocol analyzer, whose main characteristic is not the reconstruction of the data carried out by the protocols, Xplico was born expressly with the aim to reconstruct the protocol's application data and it is able to recognize the protocols with a technique named Port Independent Protocol Identification (PIPI).

The name "xplico" refers to the Latin verb explico and its significance.

Xplico is free and open-source software, subject to the requirements of the GNU General Public License (GPL), version 2.

Overview

Using raw data from Ethernet or PPP of a web navigation (HTTP protocol), Xplico extracts application data and reconstructs the contents within a packet. In the case of HTTP protocol: images, files, or cookies would be extracted. Similarly Xplico is able to reconstruct the e-mail exchanged with the IMAP, POP, and SMTP protocols.

Among the protocols that Xplico identifies and reconstructs there are VoIP, MSN, IRC, HTTP, IMAP, POP, SMTP, and FTP.

Features

Software architecture

The Xplico's software architecture provides:

an input module to handle data input (from probes or packet sniffer)
an output module to organize the decoded data and presenting them to the end user; and
a set of decoding modules, called protocol dissector for the decoding of the individual network protocol.

With the output module Xplico can have different user interfaces, in fact it can be used from command line and from a web user interface called "Xplico Interface". The protocol dissector is the modules for the decoding of the individual protocol, each protocol dissector can reconstruct and extract the data of the protocol.

All modules are plug-in and, through the configuration file, they can be loaded or not during execution of the program. This allows to focus the decoding, that is, if you want to decode only VoIP calls but not the Web traffic then you configure Xplico to load only the RTP and SIP modules excluding the HTTP module.{{Cite book | publisher = Apogeo | isbn = 978-88-503-2816-1 | pages = 5, 227, 278, 369–370 | last = Gabriele Faggioli | first = Andrea Ghirardini | title = Computer Forensics | location = Italy | year = 2009

Large scale pcap data analysis

Another feature of Xplico is its ability to process (reconstruct) huge amounts of data: it is able to manage pcap files of multiple gigabytes and even terabytes from multiple capture probes simultaneously. This is thanks to the use of various types of "input modules". The pcap files can be uploaded in many ways, directly from the Xplico Web user interface, with a SFTP or with a transmission channel called PCAP-over-IP.

For these features Xplico is used in the contexts of Lawful interception and in Network Forensics.{{Cite book | isbn = 978-1597494724 | last = Cameron H. Malin | first = Eoghan Casey BS MA | title = Malware Forensics Field Guide for Windows Systems: Digital Forensics Field Guides | year = 2012 | publisher = Elsevier

VoIP calls

Xplico and also its specific version called pcap2wav is able to decode VoIP calls based on the RTP protocol (SIP, H323, MGCP, SKINNY) and supports the decodidica of audio codecs G711ulaw, G711alaw, G722, G729, G723, G726, and MSRTA (Microsoft's Real-time audio).

Basic commands working from command line

In these examples, it is assumed that eth0 is the used network interface.

real-time acquisition and decoding: xplico -m rltm -i eth0
decoding of a single pcap file: xplico -m pcap -f example.pcap
decoding a directory which contains many files pcap xplico -m pcap -d /path/dir/ in all cases the data decoded are stored in the a directory named xdecode. With the parameter -m we can select the "input module" type. The input module named rltm acquires the data directly from the network interface, vice versa the input module named pcap acquires data form pcap files or directory.

Distributions

Xplico is installed by default in the major distributions of digital forensics and penetration testing:

Kali Linux,
BackTrack,
DEFT,
Security Onion
Matriux
BackBox
CERT Linux Forensics Tools Repository.

References

"Xplico – Xplico 1.2.2".
"ISSA Journal".
"Xplico License".
"On detecting Internet-based criminal threats (European FP7-SEC Project INDECT)".
(January 2009). "Sistema de interceptación y análisis de comunicaciones) |".
pcap2wav Xplico interface http://www.xplico.org/archives/1287
[http://bugs.kali.org/view.php?id=61 Kali, Xplico as a package].
"Backtrack 5".
"Projects DEFT Linux".
"Linux Forensics Tools Repository".

::callout[type=info title="Wikipedia Source"] This article was imported from Wikipedia and is available under the Creative Commons Attribution-ShareAlike 4.0 License. Content has been adapted to SurfDoc format. Original contributors can be found on the article history page. ::