FAQ

Can it capture live traffic? No. It analyses saved captures. Record them with tcpdump -w file.pcap, dumpcap or Wireshark.

Why do the Security tab and counters change when I apply a filter? Every tab, including the detections, is computed for the displayed packets only. Clear the filter to see the findings for the whole capture. TCP problem markers (retransmissions etc.) are always computed on the whole capture.

How large a capture can it handle? Reading runs at well over 100 000 packets per second, but the whole capture is kept in memory: plan for roughly the capture size plus a few hundred bytes per packet. Filter large captures first (e.g. tcpdump -r big.pcap -w small.pcap host 10.0.0.5) if memory is short.

Can it decrypt TLS? No. Encrypted sessions are analysed through their metadata: server name (SNI), versions, cipher, ALPN, JA3/JA3S fingerprints, sizes and timing.

What is JA3? A fingerprint (MD5 hash) of how a TLS client says hello: versions, ciphers and extensions. The same application usually produces the same JA3, so an unusual JA3 on your network deserves a look.

Why are passwords shown with asterisks? So reports can be shared safely. Disable masking in Analysis → Detection Settings or with --no-mask.

The OS column is empty for some hosts. The guess uses the initial TTL and is only shown for internal hosts; for remote hosts the TTL has been reduced by routers and is unreliable.

Where are the settings stored? In Qt's standard location, ~/.config/pcap-reportgenerator/PCAP Analyzer.conf on Linux.