PCAP Analysis

Upload a capture, watch the pipeline run, and interpret what you get back. Same pipeline runs on live capture, just streaming.

Supported formats

• .pcap (libpcap)
• .pcapng (libpcap-ng with multiple interfaces, comments, secrets blocks)
• .cap (Microsoft Network Monitor — auto-converted)
• .eml for email forensics (limited — surfaces headers and attachments)

Upload methods

1. Drag-and-drop onto the dashboard or upload panel
2. File picker via Ctrl/Cmd + O or topbar Upload button
3. Watched folder — configure under Settings → Watched folders; new files in the folder auto-import
4. API — POST /api/upload with multipart form-data (Pro+)

The pipeline

Every capture runs through 21 ordered stages. Stages are independent and idempotent — you can re-run any stage individually from the session manager. Stage timing is reported in the right-rail.

Parsing & dissection

1. parse — libpcap parsing, packet table construction, link-layer detection
2. dissect_extended — core protocols (TCP, UDP, ICMP, IPv4/6, ARP)
3. dissect_http — HTTP/1.x with full request/response reassembly
4. dissect_http2_grpc — HTTP/2 framing, gRPC method names
5. dissect_quic — QUIC initial & handshake; payload encrypted
6. dissect_db — MySQL, PostgreSQL, Redis, MSSQL, Oracle
7. dissect_ics — Modbus, DNP3, S7comm, IEC-104, OPC UA, BACnet, PROFINET, CIP, GE-SRTP, Niagara Fox (Team)
8. dissect_iot — MQTT, CoAP, BLE, ZigBee, Thread, 6LoWPAN, LoRaWAN
9. analyze_tls — SNI, JA3/JA3S, certificate chain, mismatch detection
10. os_fingerprint — passive OS detection from TTL, window size, options
11. reassemble_streams — TCP stream reassembly into byte streams

Extraction

12. extract_artifacts — URLs, domains, hostnames, MIME parts
13. extract_credentials — HTTP Basic, FTP, Telnet, SMTP/POP/IMAP cleartext credentials
14. extract_files — reassembled files from HTTP, SMB, SMTP attachments, FTP

Detection & scoring

15. match_iocs — check IPs, domains, URLs, hashes against your local IOC feed
16. run_detection_rules — built-in rules engine (suspicious-domain, exfil-by-volume, …)
17. run_suricata — optional Suricata pass if rules folder configured
18. detect_beacons — periodic communication patterns indicative of C2
19. detect_anomalies — ML/statistical anomaly detection per-host
20. detect_dga — DGA-likelihood classifier on DNS query names
21. detect_scans — horizontal & vertical port scans
22. detect_advanced — lateral movement, credential theft, covert channels
23. threat_hunt — saved-hunt evaluation across the session
24. yara_scan — YARA against extracted files (Pro+)
25. map_mitre — map detections to ATT&CK techniques (Pro+)
26. pyramid_of_pain — classify indicators by adversary cost-to-replace
27. score_risks — per-host and per-flow risk scores
28. rescore_risks — second-pass with cross-correlation context

Narrative & CTF

29. attack_narrative — AI-generated story with Mermaid diagram (if AI configured)
30. ctf_mode — flag-pattern detection for CTF / homelab traffic
31. plugin_stages — user-defined plugin stages (Pro+)

Performance characteristics

Times measured on M1 Pro / Ryzen 7 5800X with default settings. Disabling Suricata, YARA, and AI roughly halves runtime.

Reading the results

Dashboard

The dashboard is your triage view. Risk gauge gives a one-glance verdict; protocol distribution and top-risk IPs lead your attention.

DPI (Deep Packet Inspection)

Wireshark-style packet list with display filters (Wireshark filter syntax). Color-coded by protocol. Click a packet to see protocol tree, hex dump, and expert info.

Network Map

Force-directed graph of hosts. Edge weight = bytes; edge color = risk. Click a host for OSINT lookup, threat-intel context, and pivot links.

Timeline

Chronological event view, kill-chain story mode, severity filter. Use this for “what happened, in what order”.

Investigation graph

Living force-directed graph with attack-chain detection. Particle flow shows live volume on each edge during live capture.

Tips

• Pre-filter big captures with editcap or tcpdump if you only care about specific traffic.
• Disable AI for speed — Settings → AI → Auto-narrative: off.
• Disable Suricata if you don’t maintain rule sets — Settings → Detection → Suricata: off.
• Re-run a single stage — right-click in the right-rail, “Re-run from this stage”.
• Compare two sessions — Sessions → Compare highlights deltas.

What if a stage fails?

If a stage errors, the pipeline continues with the rest. The failed stage shows in red in the right-rail with a stack trace. See Troubleshooting → PCAP failed to parse.