Analyze PCAP

Documentation

Getting started

Upload Wireshark or tcpdump captures for browser-based analysis. This guide covers formats, privacy, and upcoming workspace options.

Supported formats

  • .pcap — classic libpcap format
  • .pcapng — Wireshark next-generation format (recommended)
  • .cap — common tcpdump export extension

Capture sources (Wireshark installer components)

Upload standard .pcap / .pcapng exports from any of these tools. Live remote capture on our servers is not required — export locally, then upload.

  • TShark / Wireshark / tcpdump — primary supported path (TShark required on our backend for analysis)
  • Androiddump — upload PCAP exported from Android captures
  • Etwdump — Windows ETW traces exported to PCAP
  • SSHDump / CiscoDump / WifiDump — remote or wireless captures saved as PCAP/PCAPNG
  • UDPDump — PCAP from UDP-streamed remote captures

Backend readiness for each component: GET /tools on the API.

Upload guidelines

Public analysis is intended for sanitized lab and evaluation captures. Before uploading, remove or redact sensitive data when possible. Do not upload production traffic containing credentials, PII, or active incident evidence to the public endpoint.

Go to upload →

Private workspace

Private workspaces (coming soon) keep results out of any public feed. Designed for SOC, DFIR, and consulting teams handling client or internal traffic. Options will include ephemeral uploads with auto-delete and retained workspace storage.

On-prem deployment

For regulated, air-gapped, or isolated environments where packet captures cannot leave your infrastructure. Contact us when you need deployment inside your security boundary.

Display calibration

Future releases will support three calibration methods for accurate packet timeline and UI density on your screen:

  1. Auto-detect device — use browser APIs to infer screen characteristics
  2. Screen diagonal — enter monitor size in inches for precise scaling
  3. Credit card calibration — physical reference calibration for pixel-accurate layouts

Privacy

Public uploads may be processed on shared infrastructure. Private and on-prem tiers will offer stronger data isolation. Full privacy policy will be published before production launch.

Terms of service

Terms of service will be published before production launch. You are responsible for ensuring you have permission to analyze uploaded captures.