PCAP Analyzer

PCAP Analyzer (pcap-reportgenerator) is a desktop tool for analysing network captures (.pcap, .pcapng, also gzip-compressed). It is aimed at network administrators and incident responders who need quick answers from a capture: who talked to whom, how healthy the connections were, what was resolved and requested, and whether anything looks suspicious. It can then produce a report to share.

At a glance

• 13 tabs: Dashboard, Packets, Security, Connections, Hosts, DNS, HTTP, TLS, Ports, Protocols, I/O Graph, Charts and Log
• Wireshark-style display filters shared by every tab
• Security findings: port scans, ARP spoofing, cleartext credentials, DNS tunnelling, beaconing and more
• Reports in HTML, PDF, JSON and CSV, from the GUI or the command line
• Fast built-in capture reader (100 000+ packets per second)
• English and Spanish; light and dark themes

Pages

• Installation: requirements and setup
• User Guide: a tour of every tab
• Display Filters: filter syntax and field reference
• Security Detections: what each detection looks for and how to tune it
• Reports and Command Line: report formats and CLI options
• FAQ: common questions and limitations

Source code and README: ariel/pcap-reportgenerator