User Guide
Opening a capture
Use File → Open Capture, File → Open Recent, the toolbar, or drag a file onto the window. Reading and analysis run in the background; use Pause, Resume or Cancel on the toolbar for large files. Supported: pcap (micro/nanosecond), pcapng (several interfaces), and both gzip-compressed.
The filter bar
The display filter at the top applies to every tab: statistics, tables and charts are recomputed for the displayed packets. The field turns green when the expression is valid. See Display Filters. Almost every table offers filter by this row on double-click or right-click.
Tabs
| Tab | Use it to |
|---|---|
| Dashboard | Get the overall picture: volume, duration, throughput, number of hosts and connections, findings by severity and the main charts. Click the findings card to jump to Security. |
| Packets | Inspect individual packets. Rows are coloured like Wireshark (problematic TCP segments in red on black). The lower panes show the full protocol tree and a hex dump. Right-click → Follow Stream reads the whole conversation. |
| Security | Review findings. Each one explains what was seen, lists source, target, time and evidence, and gives a recommendation. Show evidence packets applies a filter with the relevant packets. |
| Connections | See every TCP/UDP connection from client to server with upload/download bytes, duration, handshake RTT, retransmissions, duplicate ACKs, zero windows, resets and final state. Only problems hides healthy connections; the summary line gives the median RTT and retransmission rate. |
| Hosts | Inventory every address: name (learnt from DNS answers, DHCP and mDNS), MAC address, internal or external, OS guess from TTL, traffic, number of peers and services it offered. |
| DNS | Every query with its answer, response code and latency; top domains, response codes and query types. |
| HTTP | Every request with its response status, content type, size, latency and user agent. |
| TLS | Every handshake with server name (SNI), negotiated version and cipher, ALPN and JA3/JA3S client/server fingerprints. Outdated versions and weak ciphers are shown in red. |
| Ports / Protocols | Port usage with service names, and transport / application protocol distribution. |
| I/O Graph | Traffic over time as packets, bytes or bits per second, with a selectable interval and up to three extra series defined by display filters (e.g. tcp.analysis.flags). |
| Charts | A gallery of ready-made charts; the toolbar zooms, pans and saves images. |
| Log | Messages from the application (loading, filters, exports, errors). |
Follow Stream
Shows the payload of a TCP or UDP connection as it was exchanged, client data in red and server data in blue, as ASCII, hex dump or raw hex, for the whole conversation or one direction. Filter This Stream displays its packets; Save as writes the raw bytes to a file.
Exporting
- File → Save Displayed Packets: writes the displayed packets to a new capture file, byte for byte.
- File → Export: packets, connections, hosts or findings as CSV.
- Report → Generate Report: see Reports and Command Line.
Settings
- View → Theme: system, light or dark.
- View → Language: English or Spanish.
- Analysis → Detection Settings: thresholds of the security detections (see Security Detections).