Judging packets guilty or benign by their headers alone

What it does

FlowMeter ingests network traffic and groups packets into flows, then labels each flow or individual packet as benign or malicious using only header data. It outputs a statistics-rich flow record for further review. Deepfence uses it internally as a fast pre-filter to reduce the volume of traffic that needs deeper layer-7 analysis in ThreatMapper.

The interesting bit

Instead of cracking open payloads, the tool bets that packet headers carry enough signal for a first-pass verdict. That keeps the initial classification lightweight, pushing expensive deep inspection downstream only for traffic that makes it past the header-based triage.

Key highlights

• Go-based utility that processes packet captures (pcap) and organizes them into flows with statistical summaries.
• Aims to classify traffic via machine learning with high true positives and low false positives, though the README offers no performance figures yet.
• Designed as an experimental pre-filter: it labels data quickly so heavier analysis tools see less noise.
• Deepfence deploys it internally inside ThreatMapper’s pipeline, so it has at least one production-adjacent user.
• Apache 2 licensed.

Caveats

• The README is vague on mechanics: it never names the ML algorithms, states whether models ship pre-trained, or backs up the high-TP/low-FP claim with numbers.
• The repository’s “Quick Start” simply redirects to external documentation, so you won’t learn how it works from the README alone.

Verdict

Give it a spin if you are assembling a custom network-analysis pipeline and want a header-only triage layer. Look elsewhere if you need a mature, fully documented network forensics tool with published benchmarks.