FlowCarp
FlowCarp identifies application-layer protocols in network traffic by analyzing how connections behave, not just which ports they use. It can help analysts classify unknown traffic and identify malware C2 protocols.
FlowCarp analyzes PCAP files and live network traffic to identify application-layer protocols, including proprietary and malware C2 protocols. It uses statistical models based on traffic behavior rather than traditional port numbers or signature rules. Use it to investigate suspicious traffic, classify malware communications and add detection for proprietary communication protocols.
FlowCarp's official website:
https://flowcarp.com
Container image repository:
ghcr.io/netresec/flowcarp
Commercial FlowCarp Licenses
Commercial FlowCarp licenses provide access to larger protocol packages and higher daily flow limits. They are intended for organizations that need to analyze more than 10,000 flows per day or identify protocols that are not included in the free community edition.
A license combines one Protocol Package, which determines what FlowCarp can identify, with one Traffic Volume Level, which determines how many flows the organization can inspect per day.
Protocol Packages
| Package | Protocols | Custom Protocols |
Malicious protocols |
Sub-protocol identification |
Use case |
|---|---|---|---|---|---|
| P1 | 200+ | 10 | Traffic classification | ||
| P2 | 300+ | 20 | ✅ | Security monitoring | |
| P3 | 600+ | 30 | ✅ | ✅ | Any |
All commercial protocol packages also include identification of the 25 protocols from the community edition.
P3 adds sub-protocol identification. This lets FlowCarp identify protocols carried inside other protocols, such as Windows Update, CRL, OCSP or WebSocket traffic inside HTTP.
FlowCarp's sub-protocol identification feature can also detect many malicious protocols that run on top of HTTP, such as AdaptixC2, DCRat, Formbook, LummaC2, NetSupport RAT, RedLine and StealC. The sub-protocol identification feature can even detect what's running inside of a TLS encrypted session, without having to decrypt the traffic! Identification of sub-TLS protocols is much more complex than for HTTP, which is why the precision will not be quite as high. But it can usually accurately identify many legitimate as well as malicious protocols that run on top of TLS, regardless of which port is being used.
Volume Levels
FlowCarp customers can run multiple FlowCarp instances using a single commercial FlowCarp license. The volume licenses restrict the total number of flows, across all running FlowCarp instances, that a customer organization can inspect per day with FlowCarp.
- client IP
- client port
- server IP
- server port
- transport protocol
| Level | Flows per day |
|---|---|
| L1 | 1 000 000 (1M) |
| L2 | 3 000 000 (3M) |
| L3 | 10 000 000 (10M) |
| L4 | 30 000 000 (30M) |
| L5 | 100 000 000 (100M) |
| UNLIMITED | No limit |
FlowCarp will still continue extracting flow information from PCAP data when this daily limit is reached, but it will not identify any more protocols.
Commercial licenses require an online connection to the license server for validation. This requirement also applies to the UNLIMITED volume level.
To request a quote, contact us with your preferred Protocol Package and Volume Level. If you are not sure which combination fits your environment, tell us roughly how many flows you expect to analyze and which protocols or use cases matter to you. We can recommend a suitable license.