nfstream

It combines the packet processing performance of native C libraries (nDPI for deep packet inspection) with Python's data science ecosystem, producing structured flow recordswith protocol identification, packet timing statistics, byte count distributions, and application-layer metadatadirectly as Python objects or pandas DataFrames without requiring intermediate tools.

The framework handles the full network flow analysis pipeline: reading raw packets, reassembling bidirectional flows, applying deep packet inspection to identify application protocols beyond simple port numbers, computing dozens of statistical features per flow (inter-arrival time distributions, payload size statistics, TCP flag counts), and exporting results in formats ready for machine learning.

NFStream processes multi-gigabyte PCAP files significantly faster than pure Python alternatives, making it practical for analyzing large network traffic datasets from production captures.

Network security researchers building ML-based intrusion detection systems, network operations teams analyzing traffic patterns for capacity planning, and academic researchers studying network measurement and traffic classification use NFStream to extract ML-ready features from network data without deep expertise in packet processing internals.

The Python-native output means flow features integrate directly with scikit-learn, PyTorch, and pandas workflows, shortening the pipeline from raw PCAP to trained classifier.

Its deep packet inspection capabilities enable application-level traffic analysis that port-based classification misses for traffic using non-standard ports or encryption.