{
  "added_at": "2026-11-02",
  "additional_evidence_urls": [
    "https://github.com/mandiant/flare-fakenet-ng/blob/7c8e006198b9df6e7b511140288fc5113c25d729/fakenet/configs/default.ini",
    "https://github.com/mandiant/flare-fakenet-ng/blob/7c8e006198b9df6e7b511140288fc5113c25d729/CHANGELOG.txt",
    "https://github.com/mandiant/flare-fakenet-ng/blob/7c8e006198b9df6e7b511140288fc5113c25d729/docs/testing.md",
    "https://github.com/mandiant/flare-fakenet-ng/blob/7c8e006198b9df6e7b511140288fc5113c25d729/docs/CustomResponse.md",
    "https://github.com/mandiant/flare-fakenet-ng/blob/7c8e006198b9df6e7b511140288fc5113c25d729/.github/workflows/build.yaml",
    "https://github.com/mandiant/flare-fakenet-ng/tree/7c8e006198b9df6e7b511140288fc5113c25d729/windivert",
    "https://github.com/mandiant/flare-fakenet-ng/tree/7c8e006198b9df6e7b511140288fc5113c25d729/fakenet/defaultFiles",
    "https://github.com/mandiant/flare-fakenet-ng/blob/7c8e006198b9df6e7b511140288fc5113c25d729/setup.py",
    "https://github.com/mandiant/flare-fakenet-ng/blob/7c8e006198b9df6e7b511140288fc5113c25d729/LICENSE.txt",
    "https://github.com/mandiant/flare-fakenet-ng/releases/tag/v3.5"
  ],
  "category": "dynamic-analysis",
  "description_en": "Mandiant FLARE's dynamic network analysis tool for malware analysts, a successor to the original Fakenet. Its Diverter redirects traffic from local processes on Windows, or from other hosts in Linux MultiHost mode, to configurable listeners that simulate DNS, HTTP and HTTPS, SMTP, FTP, TFTP, IRC, POP and raw TCP or UDP services, with process and host filters, custom responses and an option to launch a command such as a debugger on a connection. Sessions can be saved as PCAP and end with an interactive HTML report of network-based indicators grouped by process and protocol.",
  "description_zh": "Mandiant FLARE 团队面向恶意软件分析人员的动态网络分析工具，是原版 Fakenet 的后继。其 Diverter 将 Windows 本机进程的流量，或在 Linux MultiHost 模式下将其他主机的流量，重定向到可配置的监听器；这些监听器模拟 DNS、HTTP 与 HTTPS、SMTP、FTP、TFTP、IRC、POP 以及原始 TCP 或 UDP 服务，并支持进程和主机过滤、自定义响应，以及在连接到来时启动调试器等命令。会话可保存为 PCAP，结束时生成交互式 HTML 报告，按进程和协议归类展示网络行为指标。",
  "entry_url": "https://awesomerea.org/resources/fakenet-ng/",
  "entry_url_zh": "https://awesomerea.org/zh/resources/fakenet-ng/",
  "evidence_url": "https://github.com/mandiant/flare-fakenet-ng/blob/7c8e006198b9df6e7b511140288fc5113c25d729/README.md",
  "group": "tools",
  "id": "fakenet-ng",
  "json_url": "https://awesomerea.org/resources/fakenet-ng/record.json",
  "kind": "tool",
  "markdown_url": "https://awesomerea.org/resources/fakenet-ng/index.md",
  "markdown_url_zh": "https://awesomerea.org/zh/resources/fakenet-ng/index.md",
  "name": "FakeNet-NG",
  "name_zh": "FakeNet-NG 动态网络分析工具",
  "record_type": "resource",
  "relationship": "foundation",
  "requirements": [
    "Latest release at review: v3.5, published 2025-04-09, as fakenet3.5.zip with a PyInstaller fakenet.exe for Windows. The reviewed master commit, 11 commits later and still versioned 3.5, adds a Windows release-build workflow, CRL generation for TLS revocation checks and SingleHost as the default NetworkMode, although the README still recommends Auto.",
    "Module installs use Python 3.10.11 and administrator rights; Windows needs the Visual C++ build tools, and Linux needs build tools, Python and libnetfilter-queue development packages and port 53 freed from systemd-resolved, with the README's Linux steps tested on Ubuntu 24.04.2. SingleHost mode needs Windows Vista or later and is experimental on Linux, without process and host filtering; MultiHost is Linux-only, only TCP, UDP and ICMP are intercepted, and the Linux Diverter mishandles packets over 4,016 bytes.",
    "The README recommends a controlled, isolated VM, because the tool changes the system's network settings, and says antivirus and EDR products may flag it. The repository bundles runtime helpers: WinDivert 32- and 64-bit DLLs and drivers, a small FakeNetMini.exe and other placeholder files served from defaultFiles, and TLS listener keys plus a static CA certificate and private key. The repository states no separate license for the WinDivert files, and the README notes that some dynamically loaded libraries may be LGPL; since the CA private key is public, trust that CA only inside the analysis VM.",
    "docs/testing.md describes an interactive test/test.py suite and manual tests on Windows and Linux VMs on a host-only network; the GitHub workflow only builds the Windows PyInstaller release. FakeNet-NG itself is Apache-2.0."
  ],
  "requirements_zh": [
    "审阅时最新版本为 v3.5，发布于 2025-04-09，以 fakenet3.5.zip 提供基于 PyInstaller 的 Windows 版 fakenet.exe。所审阅的 master 提交比该版本多 11 个提交，版本号仍为 3.5，新增了 Windows 发布构建工作流、用于 TLS 吊销检查的 CRL 生成，并把默认 NetworkMode 改为 SingleHost，而 README 仍建议使用 Auto。",
    "以 Python 模块安装时使用 Python 3.10.11 并需要管理员权限；Windows 需安装 Visual C++ 构建工具，Linux 需安装编译工具、Python 与 libnetfilter-queue 开发包，并让 systemd-resolved 释放 53 端口，README 的 Linux 步骤在 Ubuntu 24.04.2 上测试过。SingleHost 模式需要 Windows Vista 或更高版本，在 Linux 上仍属实验性且不支持进程与主机过滤；MultiHost 仅支持 Linux，只拦截 TCP、UDP 和 ICMP 流量，Linux Diverter 无法正确处理超过 4,016 字节的数据包。",
    "README 建议在受控、隔离的虚拟机中使用，因为该工具会修改系统网络设置，并提到杀毒软件和 EDR 产品可能将其标记为恶意。仓库附带运行时所需的辅助文件：WinDivert 32 位与 64 位 DLL 和驱动、defaultFiles 中用于响应请求的小型 FakeNetMini.exe 及其他占位文件，以及 TLS 监听器密钥和一套静态 CA 证书与私钥。仓库未说明 WinDivert 文件的单独许可证，README 提到部分动态加载的库可能采用 LGPL；由于该 CA 私钥是公开的，只应在分析虚拟机内信任此 CA。",
    "docs/testing.md 介绍了交互式 test/test.py 测试套件，以及在仅主机网络中的 Windows 与 Linux 虚拟机上进行的手动测试；GitHub 工作流只构建 Windows 的 PyInstaller 发布包。FakeNet-NG 本身采用 Apache-2.0。"
  ],
  "targets": [
    "binary",
    "protocol"
  ],
  "url": "https://github.com/mandiant/flare-fakenet-ng",
  "verification": "source-reviewed",
  "verified_at": "2026-10-19"
}