Skip to content
SPECIFICTION
Get listed

Xplico

xplico.org

Free plan WebLinuxSelf-hosted
Visit xplico.org
Spec score 7.3 #28 of 32 in Network Packet Analyzer Software

What it is

Xplico is free, open-source network forensic software that extracts application data from PCAP traffic captures. It can recover email, HTTP content, VoIP calls, and FTP or TFTP data, with protocol support for HTTP, SIP, IMAP, POP, SMTP, TCP, UDP, and IPv6. Port Independent Protocol Identification recognizes application protocols without depending on port numbers. Processing supports multithreading and realtime operation, although speed depends on flows, protocol types, and computer resources. Results can be written to files or SQLite and MySQL databases. A web interface lets concurrent users manage one or more cases, using SQLite, MySQL, or PostgreSQL as a backend. Modular capture, dissector, and dispatcher components can target files, databases, or network sockets. Downloads cover Fedora, CentOS/RHEL, and Ubuntu, alongside source code and a VirtualBox image. The free plan costs nothing; data-entry and input-file counts are unrestricted, with hard-drive size as the stated limit.

Spec sheet

Purpose
Xplico extracts application data from internet traffic captures and is an open-source Network Forensic Analysis Tool.Read 1 Oct 2026 · xplico.org
Deployment
Official downloads cover Fedora, CentOS/RHEL and Ubuntu, plus source code and a VirtualBox image.Read 1 Oct 2026 · xplico.org
Integrations
The official site lists CapAnalysis as a PCAP viewer and n2disk, netsniff-ng and Junkie as capture tools.Read 1 Oct 2026 · xplico.org
Support
Documentation is provided through the Xplico Wiki, with questions and problem reports handled through the forum and [email protected].Read 1 Oct 2026 · xplico.org
Extracted data
From PCAP files, Xplico can extract email, HTTP contents, VoIP calls, FTP and TFTP data.Read 1 Oct 2026 · xplico.org
Licensing
The Xplico decoder, DeMa and listed manipulators are GPL v2.0, while Xplico Interface can use MPL 1.1 or later, GPL 2.0 or later, or LGPL 2.1 or later.Read 1 Oct 2026 · xplico.org
Modularity
Capture, dissector and dispatcher components are modular, and dispatchers can target files, SQLite, Oracle, MySQL, PostgreSQL or network sockets.Read 1 Oct 2026 · wiki.xplico.org
Processing
Xplico supports multithreading and realtime processing whose performance depends on flows, protocol types and computer resources.Read 1 Oct 2026 · xplico.org
Protocol identification
Xplico provides Port Independent Protocol Identification for each application protocol.Read 1 Oct 2026 · xplico.org
Protocol support
Supported protocols include HTTP, SIP, IMAP, POP, SMTP, TCP, UDP and IPv6.Read 1 Oct 2026 · xplico.org
Release status
The official status page lists decoder version 1.2.2 as stable and 1.3.0 as the development version.Read 1 Oct 2026 · xplico.org
Security limit
The status page lists SSL/TLS and IPsec dissectors at 0% with keys and 802.11 at 60% with no encryption support.Read 1 Oct 2026 · xplico.org
Storage
Output can be written to SQLite or MySQL databases and/or files.Read 1 Oct 2026 · xplico.org
Web interface
The product has a web user interface, supports concurrent users managing one or more cases, and can use SQLite, MySQL or PostgreSQL as its backend database.Read 1 Oct 2026 · xplico.org

Plans and prices

Xplico Free Software Free No data-entry or input-file count limit · hard-drive size is the only limit Read 1 Oct 2026 · wiki.xplico.org

Every Xplico plan and price →

Strong points and limits

Strong points

  • Extracts email, HTTP, VoIP, FTP, and TFTP data
  • Identifies protocols independently of ports
  • Supports multithreaded and realtime processing
  • Web interface supports concurrent case users
  • No input-file count limit

Limits

  • Traffic decryption is not supported
  • SSL/TLS and IPsec dissectors are at 0%
  • Performance depends on flows and hardware
  • Hard-drive capacity is the stated limit

Who it suits

Xplico suits investigators and administrators analyzing captured network traffic on Linux or Unix-like systems. Its case-oriented web interface also fits teams managing concurrent forensic work.

Verdict

Xplico offers broad PCAP extraction and case management without a software charge. Its lack of traffic decryption and limited security-protocol dissectors constrain some investigations.

Where Specifiction places it

Alternatives to XplicoAll alternatives →