Porthunter

Porthunter operates as a local Model Context Protocol (MCP) server, specializing in the in-depth analysis of network traffic captures in PCAP/PCAPNG formats. It expertly detects and classifies common port scanning techniques such as SYN, FIN, NULL, and Xmas scans, categorizing them into horizontal or vertical patterns. This powerful tool pinpoints suspicious IP addresses and surfaces the first relevant scan events, enabling rapid identification of threats. Furthermore, Porthunter can enrich public IP addresses with valuable threat intelligence from OTX and GreyNoise, alongside ASN and geolocation data, and even correlate multiple IPs for a consolidated view of potential threats, making it an indispensable asset for cybersecurity investigations and proactive threat hunting.

Key Features

Use Cases