Xplico
Xplico is an open-source network forensic analysis tool that extracts application data from PCAP traffic captures.
What Xplico is
Xplico is an open-source network forensic analysis tool that extracts application data from PCAP traffic captures. It can recover email, HTTP content, VoIP calls, and FTP and TFTP data, with protocol support including HTTP, SIP, IMAP, POP, SMTP, TCP, UDP and IPv6. Its protocol identification does not depend on port numbers. Processing can be multithreaded or real time, though speed depends on traffic flows, protocol types and computer resources. Results can be saved to files or SQLite and MySQL databases. A web interface supports concurrent users managing one or more cases, with SQLite, MySQL or PostgreSQL as its backend. Capture, dissector and dispatcher components are modular; dispatchers can send output to files, databases or network sockets. Xplico is free, with no data-entry or input-file count limit; hard-drive size is the stated constraint. Downloads cover Fedora, CentOS/RHEL and Ubuntu, alongside source code and a VirtualBox image. Live capture and a command-line tool are supported, but traffic decryption is not.
Good
- Extracts email, HTTP, VoIP, FTP and TFTP data from PCAP
- Identifies application protocols independently of port numbers
- Web interface supports concurrent case users
- No stated limit on input files or data entries
Watch out
- Traffic decryption is not supported
- SSL/TLS and IPsec dissectors are listed at 0% with keys
- 802.11 is listed at 60% with no encryption support
- Processing speed depends on flows, protocols and computer resources
Who it suits
Xplico suits users who need to examine PCAP captures and extract application data into files or databases. It runs on Linux and Unix-like operating systems; its listed traffic decryption capability is absent.
Verdict
Xplico offers modular PCAP analysis with a web interface, command-line tool and live capture support. Its listed decryption gaps matter for encrypted traffic, and processing performance depends on the workload and available computer resources.
Plans and prices
From Xplico's own pricing page, checked 1 Oct 2026.
| Plan | Price | What it gives you |
|---|---|---|
| Xplico Free Software | Free | No data-entry or input-file count limit · hard-drive size is the only limit |
The facts
Each one read from Xplico's own pages, with the date it was checked.
What it does
- Deployment
- Official downloads cover Fedora, CentOS/RHEL and Ubuntu, plus source code and a VirtualBox image.checked 1 Oct 2026
- Extracted data
- From PCAP files, Xplico can extract email, HTTP contents, VoIP calls, FTP and TFTP data.checked 1 Oct 2026
- Integrations
- The official site lists CapAnalysis as a PCAP viewer and n2disk, netsniff-ng and Junkie as capture tools.checked 1 Oct 2026
- Licensing
- The Xplico decoder, DeMa and listed manipulators are GPL v2.0, while Xplico Interface can use MPL 1.1 or later, GPL 2.0 or later, or LGPL 2.1 or later.checked 1 Oct 2026
- Modularity
- Capture, dissector and dispatcher components are modular, and dispatchers can target files, SQLite, Oracle, MySQL, PostgreSQL or network sockets.checked 1 Oct 2026
- Processing
- Xplico supports multithreading and realtime processing whose performance depends on flows, protocol types and computer resources.checked 1 Oct 2026
- Protocol identification
- Xplico provides Port Independent Protocol Identification for each application protocol.checked 1 Oct 2026
- Protocol support
- Supported protocols include HTTP, SIP, IMAP, POP, SMTP, TCP, UDP and IPv6.checked 1 Oct 2026
- Purpose
- Xplico extracts application data from internet traffic captures and is an open-source Network Forensic Analysis Tool.checked 1 Oct 2026
- Release status
- The official status page lists decoder version 1.2.2 as stable and 1.3.0 as the development version.checked 1 Oct 2026
- Security limit
- The status page lists SSL/TLS and IPsec dissectors at 0% with keys and 802.11 at 60% with no encryption support.checked 1 Oct 2026
- Storage
- Output can be written to SQLite or MySQL databases and/or files.checked 1 Oct 2026
- Support
- Documentation is provided through the Xplico Wiki, with questions and problem reports handled through the forum and [email protected].checked 1 Oct 2026
- Web interface
- The product has a web user interface, supports concurrent users managing one or more cases, and can use SQLite, MySQL or PostgreSQL as its backend database.checked 1 Oct 2026
Alternatives to Xplico
- 1
NETCAP
Free planOpen sourceWebAPILinuxmacOS8.1From €49 a month - 2
PacketSafari
Free planOpen sourceWebAPILinuxmacOS7.6Free plan - 3
A-Packets
Free planWebAPILinuxSelf-hosted7.5From $99 a year - 4
Wireshark
Free planOpen sourceAPILinuxmacOSSelf-hosted7.5Free plan - 5
Colasoft Capsa
Free planWindows7.4$295 one-time - 6
PcapAI
Open sourceWebAPILinuxmacOS7.4From $114 a year