above

No entries match these filters. Clear filters

1. v2.8 Mar 27, 2025 · release notes

   Above v2.8 adds HSRPv2 detection, VRRPv2 plaintext password decoding, and MAC vendor identification.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v2.8 https://github.com/caster0x00/Above.git
   # already have the repo? check out this version:
   $ git checkout v2.8

   • Adds HSRPv2 protocol support for detecting first-hop redundancy attacks.
   • Adds decoding of plaintext passwords found in VRRPv2 packets.
   • Adds vendor detection by MAC addressMAC addressA hardware-address identifier used on a local network, such as Ethernet or Wi-Fi. It identifies a network interface for delivery on that link, rather than routing across the internet. to aid device fingerprinting during network reconnaissance.

   3 details in Everything

   └──▷ BREAKING ON UPGRADE

   • !RADIUSRADIUSA networking protocol for centralised authentication, authorisation, and accounting of users connecting to a network, maintained under IETF standards. Cyber tools use it to integrate with existing enterprise identity infrastructure. protocol support has been removed; setups relying on Above to detect RADIUS traffic will no longer capture it.
2. v2.7 Aug 23, 2024 · release notes

   Above v2.7 adds SNMPSNMPA UDP-based protocol for querying and managing network devices, standardized by the IETF. Cyber tools use it to pull interface stats, topology data, and device state from routers, switches, and servers at scale. and RADIUSRADIUSA networking protocol for centralised authentication, authorisation, and accounting of users connecting to a network, maintained under IETF standards. Cyber tools use it to integrate with existing enterprise identity infrastructure. protocol detection to its network threat-visibility toolkit.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v2.7 https://github.com/caster0x00/Above.git
   # already have the repo? check out this version:
   $ git checkout v2.7

   • Adds SNMP and RADIUS protocol support for network threat detection.
   • Separates VLAN search into a dedicated function for improved modularity.
   • Rewrites host discovery via Passive ARPARPA network protocol that maps IP addresses to MAC addresses on a local Ethernet segment, letting tools resolve layer-3 targets to layer-2 hardware addresses for packet crafting or host discovery. for enhanced reliability.

   3 details in Everything

3. v2.5 Mar 7, 2024 · release notes

   Above v2.5 adds support for EAPOL, ARPARPA network protocol that maps IP addresses to MAC addresses on a local Ethernet segment, letting tools resolve layer-3 targets to layer-2 hardware addresses for packet crafting or host discovery., IGMPIGMPA network-layer protocol used by IPv4 hosts and routers to manage multicast group membership, letting routers know which hosts want traffic for a given multicast address., DHCP, and ICMPv6 protocols

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v2.5 https://github.com/caster0x00/Above.git
   # already have the repo? check out this version:
   $ git checkout v2.5

   • Adds new parsing capabilities for EAPOL, ARP, IGMP, DHCP, and ICMPv6 protocols.
   • Introduces a new visual output mode for displaying captured packets.

   2 details in Everything

4. v2.3 Jan 28, 2024 · release notes

   Above v2.3 adds protocol support for SSDP, VRRPVRRPA network protocol (RFC 5798) that lets multiple routers share a virtual IP address, electing one as active so hosts keep a working gateway if the primary fails. v2/v3, LLDP, MNDP, and DTP plus mitigation display.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v2.3 https://github.com/caster0x00/Above.git
   # already have the repo? check out this version:
   $ git checkout v2.3

5. vettel Dec 4, 2023 · release notes

   Adds --record-pcap and --analyze-pcap flags for traffic recording and analysis.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch vettel https://github.com/caster0x00/Above.git
   # already have the repo? check out this version:
   $ git checkout vettel

   └──▷ TRY IT
   Capture network traffic during an interaction and save it as a standard PCAPPCAPA packet capture, recorded network packets that can be inspected later. Analysts use it to reconstruct communication and investigate protocol behavior or suspicious traffic. file for later inspection.
   copy

   $ above --record-pcap output.pcap

   Inspect the contents of a previously captured traffic file to identify suspicious patterns.
   copy

   $ above --analyze-pcap capture.pcap

   • Adds --record-pcap flag to record live traffic directly into a .pcap file.
   • Adds --analyze-pcap <path> flag to analyze previously recorded .pcap files.

   2 details in Everything

6. vivid Nov 30, 2023 · release notes

   Above vivid adds Simultaneous Multi-Protocol Analysis and 802.1Q802.1QAn IEEE standard that adds a 4-byte VLAN tag to Ethernet frames, letting a single physical link carry traffic for multiple isolated networks. Cyber tools use it to capture or inject traffic on specific VLANs. Tag Search

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch vivid https://github.com/caster0x00/Above.git
   # already have the repo? check out this version:
   $ git checkout vivid

   └──▷ TRY IT
   Scan for VLAN segmentation issues across all supported protocols in a single pass.
   copy

   $ above --protocol all --802.1q_tag <tag_id> capture.pcap

   • protocol search now targets all 12 supported network protocols simultaneously instead of one at a time, enabling unified detection across the full protocol stack.
   • New 802.1q_tag argument allows searching specifically for 802.1Q tags to detect segmentation security issues on VLANs.

   2 details in Everything