Skip to content

In-browser network forensics

PCAP Parser

Open a .pcap or .pcapng capture and get conversations, DNS, HTTP, TLS ClientHello (SNI, JA3/JA4), extracted files, an IOC list and any cleartext credentials — Wireshark-lite for triage. Parsed in your browser with WebAssembly, nothing uploaded.

  • pcap · pcapng
  • Rust → WebAssembly
  • Nothing uploaded

Drop a .pcap or .pcapng capture here

Classic pcap (both byte orders, µs / ns) and pcapng are supported, whatever the file extension. Folders and ZIP archives of captures work as-is. Large captures are streamed in chunks, so they never have to fit in memory twice.

A synthetic capture of a fictional intrusion — no real traffic.

100% client-side: captures are parsed by WebAssembly in your browser and never uploaded.

Collection guide

How to get your capture

Never recorded traffic before? Pick the easiest route for your system, copy the command, reproduce the activity, then drop the file in the box above.

  1. Capturetcpdump, pktmon or Wireshark
  2. Drop it here.pcap / .pcapng, a folder or a ZIP
  3. Stays in your browserParsed locally, nothing uploaded

Linux

Needs: sudo rights and tcpdump (apt install tcpdump / dnf install tcpdump).

bash
sudo tcpdump -i any -s 0 -w /tmp/capture.pcap

Reproduce the activity, then press Ctrl+C. -i any records every interface, -s 0 keeps whole packets. Drop /tmp/capture.pcap.

macOS

Needs: Nothing to install; an admin account (sudo asks for your password).

zsh
sudo tcpdump -i en0 -s 0 -w /tmp/capture.pcap

en0 is the main interface on most Macs (list them with ifconfig). Ctrl+C stops the capture; drop /tmp/capture.pcap.

Windows · pktmon (built in)

Needs: Windows 10 2004 or later, Windows 11 or Server 2022; terminal opened with Run as administrator.

1 · Startcmd / PowerShell
mkdir C:\triage
pktmon start --capture --comp nics --pkt-size 0 --file-name C:\triage\capture.etl
2 · Stop and convertcmd / PowerShell
pktmon stop
pktmon etl2pcap C:\triage\capture.etl --out C:\triage\capture.pcapng

Run step 2 once the activity is reproduced, then drop C:\triage\capture.pcapng (the .etl itself can't be read here). --comp nics records each packet once, --pkt-size 0 keeps whole packets.

Gotchas

  • Keep whole packets. pktmon logs only the first 128 bytes of each packet unless you add --pkt-size 0, and a small snaplen cuts payloads, so files, HTTP bodies and credentials can't be rebuilt.
  • Stop the capture before you copy the file: a capture still being written arrives truncated or zero-filled. Decompress .gz / .zst first; a ZIP is fine as-is.
  • Capture where the traffic flows: a host only sees its own packets (use a SPAN / mirror port or the firewall for others), and TLS stays encrypted — you get SNI and JA3/JA4, not the content.

What is a PCAP capture?

A packet capture (.pcap or .pcapng) is a recording of network traffic, produced by tools such as Wireshark, tcpdump, tshark or dumpcap. Each frame is stored with a timestamp and the bytes seen on the wire, from the link layer up.

pcapng is the newer format: one file can hold several capture interfaces, each with its own link type and timestamp resolution, plus metadata and even decryption secrets. This tool reads both, decodes Ethernet/VLAN, Linux cooked (SLL/SLL2), raw IP and loopback links, and follows IPv4/IPv6, TCP, UDP and ICMP.

What it reconstructs

  • Conversations: every 5-tuple flow with packet and byte counts per direction, first/last seen and duration.
  • DNS, HTTP and TLS: queries and answers; requests and responses with host, URI, status, user-agent and content-type; ClientHello SNI, ALPN and JA3/JA4 fingerprints.
  • Extracted files: HTTP bodies rebuilt after TCP reassembly, gzip/deflate decoded, hashed with SHA-256 and downloadable.
  • Credentials, IOCs and a protocol hierarchy: HTTP Basic, form and FTP logins in clear, NTLM handshakes as hashcat lines, and a de-duplicated indicator list.

Why it matters in an investigation

  • A single capture often holds the whole story: which host talked to which server, what was downloaded or exfiltrated, and which credentials crossed the wire.
  • Cleartext HTTP Basic / FTP passwords and NTLMv1/v2 challenge-response handshakes can be extracted directly — the NTLM output is ready for hashcat (mode 5500 / 5600).
  • TLS is encrypted, but the ClientHello is not: SNI reveals the destination, and JA3/JA4 fingerprints let you cluster clients and spot malware or tooling that reuses a stack.
  • Flags point at large outbound transfers, executable and archive downloads, DNS to rarely-seen or random-looking names, and services on non-standard ports.

Limitations

  • Encrypted payloads (TLS, SSH, QUIC, encrypted SMB3) are not decrypted — only what is visible in the clear is reported.
  • TCP reassembly is best-effort: retransmissions and out-of-order segments are handled, but bytes the capture never recorded (snaplen, dropped packets) are reported as gaps.
  • QUIC/HTTP3, IP defragmentation and deep SMB file carving are not implemented yet (see the README TODO).
  • Heuristic flags are hints for triage, not conclusions — always confirm in the raw data.

How to get a capture

  • Wireshark or tshark: File → Save As .pcapng, or `tshark -w capture.pcapng`.
  • tcpdump: `tcpdump -i eth0 -w capture.pcap` (add `-s0` to keep full packets, not just headers).
  • Windows: `pktmon` or `netsh trace` (convert the .etl to .pcapng first), or Wireshark's dumpcap.
  • Decompress .gz / .zst captures before dropping them, and keep the full frames (no snaplen) when you can, so bodies reassemble completely.

FAQ

Is my capture uploaded anywhere?

No. The analyzer is Rust compiled to WebAssembly and runs in a Web Worker in your browser. The file is read in slices on your machine; there is no upload endpoint.

How large a capture can it handle?

The file is streamed in chunks through an incremental parser, so it never has to fit in memory twice. Very large captures still take time and browser memory for the results, and per-list caps protect the page — the tool tells you when a cap is hit.

What is JA3 / JA4, and why show both?

They are fingerprints of a TLS ClientHello: JA3 is the classic MD5 of the cipher/extension list, JA4 is the newer, more robust FoxIO format. Because TLS content is encrypted, these fingerprints (plus the SNI) are often the best way to identify a client or malware family.

Can it really recover passwords?

Only ones sent without real protection: HTTP Basic and form logins over plain HTTP, FTP USER/PASS, and NTLM handshakes. NTLM passwords are not in the packets, but the challenge-response is exported as a hashcat line you can crack offline.

How is this different from Wireshark?

It is not a replacement — it is a fast triage view that runs in the browser with no install. It answers "what happened in this capture" (conversations, DNS, HTTP, TLS, files, IOCs, credentials) in seconds; for packet-level analysis, open the same file in Wireshark.

How to read DNS in a packet capture: queries and responses, result codes, rare and random-looking domains, and high-level signs of DNS tunnelling, with limits.
What a JA3 fingerprint is, how JA4 differs, why Chrome's extension-order randomization broke JA3 stability, and how defenders use TLS fingerprints in triage.
A fair comparison of Wireshark, tshark, NetworkMiner, Zeek, Zui and PCAP Parser for pcap analysis: strengths, limits, and which tool fits which job.