snoopprotokoll

snoopprotokoll is a lightweight, open‑source multicast and unicast network traffic monitoring protocol developed in 2011 by the German research group Netz- und SystemSicherheit (NSS). The protocol was designed to provide a low‑overhead mechanism for capturing and forwarding packet data across distributed monitoring nodes in large campus and enterprise networks. By building on the existing snoop data format originally created for Apple’s IOS Ethernet analyzers, snoopprotokoll allows cross‑vendor interoperability and makes it easier to integrate packet traces into commercial and academic analysis tools.

A snoopprotokoll packet is encapsulated in a standard Ethernet frame and contains a header that specifies the stream identifier, timestamp, source and destination MAC addresses, and optional payload fields for filters and annotations. The protocol supports both broadcast and unicast transport, enabling the selective distribution of captured traffic to interested observers while keeping the broadcast domain isolated. Version 2.0 added support for IPv6 addresses and improved checksum validation, making it suitable for modern data center environments.

The project is maintained on GitHub under the MIT license, and contributions from security researchers worldwide have extended its capabilities to support encrypted traffic decryption assistance and real‑time anomaly detection via integration with the Zeek (formerly Bro) framework. While snoopprotokoll is not widely used in commercial products, it is frequently cited in academic literature on network forensics and is considered a reference implementation for teaching NSP (network security principles) at several European universities.