Reports and Command Line

Report formats

Report → Generate Report asks for an output folder, the formats and the language, and writes a new folder PCAP_Report_<date>_<time> containing:

File	Content
report.html	Single self-contained page: summary, findings, charts and searchable / sortable tables for hosts, connections, DNS, HTTP, TLS, ports and protocols. Nothing is loaded from the Internet.
report.pdf	A4 document with summary, findings, main charts and the most relevant tables.
report.json	Capture information, summary, findings (with parameters) and every table, for scripts.
csv/*.csv	One CSV per table, with English headers.

The report covers the displayed packets (the current display filter is recorded in it) and includes the SHA-256 of the capture file. Optionally the full packet list can be added to the JSON / CSV output.

Command line

pcap-report [capture] [--no-gui] [-o DIR] [--format html,pdf,json,csv] [-f FILTER]
            [--lang en|es] [--packets] [--no-mask] [--fail-on high|medium|low|info] [-q]

Option	Meaning
capture	file to open (GUI) or analyse (--no-gui)
--no-gui	analyse without opening a window; prints a summary and the findings
-o DIR	also write a report into a new folder under DIR
--format	report formats, comma-separated (default html)
-f FILTER	display filter applied before analysis
--lang	language of the report and messages
--packets	include every packet in the JSON / CSV report
--no-mask	show captured passwords in clear
--fail-on SEV	exit with status 3 if a finding of that severity or worse exists
-q	quiet: print only errors and report paths

Exit status: 0 success, 2 invalid input (missing file, bad filter, unknown format), 3 findings at or above --fail-on.

Examples

# quick triage on a server without a display
pcap-report /tmp/capture.pcapng --no-gui

# nightly job: HTML + JSON report of the day's capture
pcap-report /data/today.pcap.gz --no-gui -q -o /srv/reports --format html,json

# alert when a capture contains high-severity findings
pcap-report capture.pcap --no-gui -q --fail-on high || echo "check the capture!"