What is a PCAP capture?
A packet capture (.pcap or .pcapng) is a recording of network traffic, produced by tools such as Wireshark, tcpdump, tshark or dumpcap. Each frame is stored with a timestamp and the bytes seen on the wire, from the link layer up.
pcapng is the newer format: one file can hold several capture interfaces, each with its own link type and timestamp resolution, plus metadata and even decryption secrets. This tool reads both, decodes Ethernet/VLAN, Linux cooked (SLL/SLL2), raw IP and loopback links, and follows IPv4/IPv6, TCP, UDP and ICMP.
What it reconstructs
- Conversations: every 5-tuple flow with packet and byte counts per direction, first/last seen and duration.
- DNS, HTTP and TLS: queries and answers; requests and responses with host, URI, status, user-agent and content-type; ClientHello SNI, ALPN and JA3/JA4 fingerprints.
- Extracted files: HTTP bodies rebuilt after TCP reassembly, gzip/deflate decoded, hashed with SHA-256 and downloadable.
- Credentials, IOCs and a protocol hierarchy: HTTP Basic, form and FTP logins in clear, NTLM handshakes as hashcat lines, and a de-duplicated indicator list.
Why it matters in an investigation
- A single capture often holds the whole story: which host talked to which server, what was downloaded or exfiltrated, and which credentials crossed the wire.
- Cleartext HTTP Basic / FTP passwords and NTLMv1/v2 challenge-response handshakes can be extracted directly — the NTLM output is ready for hashcat (mode 5500 / 5600).
- TLS is encrypted, but the ClientHello is not: SNI reveals the destination, and JA3/JA4 fingerprints let you cluster clients and spot malware or tooling that reuses a stack.
- Flags point at large outbound transfers, executable and archive downloads, DNS to rarely-seen or random-looking names, and services on non-standard ports.
Limitations
- Encrypted payloads (TLS, SSH, QUIC, encrypted SMB3) are not decrypted — only what is visible in the clear is reported.
- TCP reassembly is best-effort: retransmissions and out-of-order segments are handled, but bytes the capture never recorded (snaplen, dropped packets) are reported as gaps.
- QUIC/HTTP3, IP defragmentation and deep SMB file carving are not implemented yet (see the README TODO).
- Heuristic flags are hints for triage, not conclusions — always confirm in the raw data.
How to get a capture
- Wireshark or tshark: File → Save As .pcapng, or `tshark -w capture.pcapng`.
- tcpdump: `tcpdump -i eth0 -w capture.pcap` (add `-s0` to keep full packets, not just headers).
- Windows: `pktmon` or `netsh trace` (convert the .etl to .pcapng first), or Wireshark's dumpcap.
- Decompress .gz / .zst captures before dropping them, and keep the full frames (no snaplen) when you can, so bodies reassemble completely.
FAQ
Is my capture uploaded anywhere?
No. The analyzer is Rust compiled to WebAssembly and runs in a Web Worker in your browser. The file is read in slices on your machine; there is no upload endpoint.
How large a capture can it handle?
The file is streamed in chunks through an incremental parser, so it never has to fit in memory twice. Very large captures still take time and browser memory for the results, and per-list caps protect the page — the tool tells you when a cap is hit.
What is JA3 / JA4, and why show both?
They are fingerprints of a TLS ClientHello: JA3 is the classic MD5 of the cipher/extension list, JA4 is the newer, more robust FoxIO format. Because TLS content is encrypted, these fingerprints (plus the SNI) are often the best way to identify a client or malware family.
Can it really recover passwords?
Only ones sent without real protection: HTTP Basic and form logins over plain HTTP, FTP USER/PASS, and NTLM handshakes. NTLM passwords are not in the packets, but the challenge-response is exported as a hashcat line you can crack offline.
How is this different from Wireshark?
It is not a replacement — it is a fast triage view that runs in the browser with no install. It answers "what happened in this capture" (conversations, DNS, HTTP, TLS, files, IOCs, credentials) in seconds; for packet-level analysis, open the same file in Wireshark.