Check a capture in your browser
The free PCAP Toolkit gives DNS, TCP and HTTP ratings, top talkers and a sanitized copy of one capture, worked out in your browser. Nothing is uploaded.
Open the toolkit →PCAPNG Analyzer vs Wireshark: an honest comparison
See where Wireshark is clearly stronger, where a self-hosted report helps, and why the most effective workflow often uses both.
Read the comparison →A practical PCAP triage checklist
Validate capture quality, establish scope, rank traffic and turn broad symptoms into testable packet-level questions.
Read the guide →How to diagnose TCP retransmissions from a PCAP
Separate real retransmissions from capture artefacts, identify the affected flow, and reason about loss, congestion and delay.
Read the guide →Finding DNS latency in a PCAPNG
Pair queries with responses, measure response time, find slow names and distinguish DNS delay from application delay.
Read the guide →Detecting TCP resets with Wireshark and tshark
Find RST packets, identify which endpoint sent them, and use sequence and timing context to explain why.
Read the guide →How to analyse a 5 GB PCAP without opening Wireshark
Use command-line summaries, split targeted subsets, or process the capture in a self-hosted web interface.
Read the guide →Extracting HTTP conversations from PCAPNG
Find clear-text requests and responses, isolate streams, export useful fields, and understand the limits imposed by HTTPS.
Read the guide →PCAP vs PCAPNG: practical differences
Choose a capture format based on interfaces, metadata, timestamp resolution and tool compatibility.
Read the guide →How to identify packet loss from a capture
Use TCP sequence analysis, duplicate acknowledgements and retransmissions without confusing missing capture data for network loss.
Read the guide →How to inspect TLS SNI and certificates in a PCAP
Review visible handshakes, names, versions, cipher suites and certificates without overstating what encrypted traffic reveals.
Read the guide →How to detect beaconing (C2 traffic) in a PCAP
Measure the intervals between connections and lookups, validate regular pairs in Wireshark, and rule out legitimate pollers.
Read the guide →How to sanitize a PCAP before sending it to a vendor
Reduce a capture, strip payloads, remap addresses and check the result for leftover names before it leaves your network.
Read the guide →JA3 and JA4 fingerprints: what they are and how to get them from a PCAP
Recognise client software by how it starts TLS, why JA4 stays stable when JA3 doesn’t, and how to extract and group both.
Read the guide →How to check a PCAP against your threat-intel (IOC) lists
Match addresses, domains, file hashes and TLS fingerprints with tshark, then judge what each hit really means.
Read the guide →How to extract files from HTTP traffic in a PCAP and hash them
Recover downloads and uploads with Export Objects or tshark, hash them, check they’re complete and handle them safely.
Read the guide →How to find cleartext credentials and weak authentication in a PCAP
Audit what your network leaks: passwords in clear-text protocols, SNMP communities, SMB1, NTLMv1 and weak Kerberos tickets.
Read the guide →How to spot DNS tunnelling in a PCAP
Find data hidden in DNS lookups by name length, randomness, unique subdomains per domain and unusual record types.
Read the guide →How to detect ARP spoofing from a packet capture
Find addresses claimed by more than one MAC and unsolicited replies, and rule out failover and virtualisation.
Read the guide →How to build a device inventory from a PCAP
Identify devices passively from MAC vendors, DHCP fingerprints, name announcements, banners and user agents.
Read the guide →How to see server names in QUIC (HTTP/3) traffic
Decrypt QUIC Initial packets to see server names, ALPN and JA4 fingerprints, and know what stays hidden.
Read the guide →How to write an incident report from a packet capture
Structure a report people can act on: executive summary, timeline, checkable findings and evidence slices.
Read the guide →How to find top talkers in a PCAP
Rank endpoints and conversations by packets, bytes and direction, then account for duration and capture-point bias.
Read the guide →Compare PCAP files before and after a network change
Collect a fair pair, normalise unequal durations and validate meaningful protocol, endpoint and application deltas.
Read the guide →Automate PCAP analysis with a watched folder
Configure a Docker bind mount, use a safe file handoff, and manage the storage and capacity implications of auto-ingest.
Read the guide →