Self-hosting guide

Everything you need to run PCAPNG Analyzer on your own server - nothing lives on our servers except license checks. Your capture files never leave your machine. Takes about 15 minutes if you already have a server and a domain name.

What you need first

• A server (VPS, home server, whatever) with Docker and the docker compose plugin installed.
• A domain name (or subdomain) pointed at that server's IP address - an "A record" in your DNS settings. This is required for HTTPS, which is required because the login page sends a password.
• Your license key, if you're running Pro (emailed to you after purchase) - the Free tier needs no key at all.

1. Set up the deploy directory

SSH into your server, then:

mkdir -p ~/pcapng-deploy
cd ~/pcapng-deploy
openssl rand -base64 32 > admin-password
chmod 600 admin-password

That file holds the password your admin account starts with - there's no built-in default anymore, so the app won't boot without it. Keep this file; you'll need to read it in step 4.

Create ~/pcapng-deploy/Caddyfile - replace pcap.example.com with your real domain. Caddy gets you a free, auto-renewing HTTPS certificate with zero extra steps:

pcap.example.com {
    reverse_proxy pcapng-analyzer:8088
    request_body {
        max_size 5120MB
    }
}

Create ~/pcapng-deploy/docker-compose.yml:

services:
  pcapng-analyzer:
    image: smathieson/pcapng-analyzer:latest
    restart: unless-stopped
    environment:
      # Tells the app it's behind a reverse proxy, so it trusts the
      # proxy's "this request was HTTPS" header for cookie security.
      TRUST_X_FORWARDED_FOR: "1"
      # The password from admin-password (step 1) - required on a fresh
      # install, since there's no built-in default anymore.
      AUTH_INITIAL_PASSWORD_FILE: /run/secrets/admin_password
      # Turns licensing on. Same value for every customer -- it just
      # points the app at our license account; your own license key
      # is what you'll enter in Settings once it's running.
      KEYGEN_ACCOUNT_ID: "54d7e608-a563-40ab-aaf0-658ee06b2110"
    volumes:
      - pcap-data:/data
    secrets: [admin_password]
    networks: [internal]
    # No "ports:" here on purpose -- only Caddy is reachable from the
    # internet. This keeps the app off any port but 443.

  caddy:
    image: caddy:2-alpine
    restart: unless-stopped
    ports:
      - "80:80"
      - "443:443"
    volumes:
      - ./Caddyfile:/etc/caddy/Caddyfile:ro
      - caddy-data:/data
      - caddy-config:/config
    networks: [internal, default]

networks:
  internal:
    internal: true

volumes:
  pcap-data:
    name: pcap-data
  caddy-data:
    name: pcap-caddy-data
  caddy-config:
    name: pcap-caddy-config

secrets:
  admin_password:
    file: ./admin-password

Running Free and don't want licensing wired up at all? Just remove the KEYGEN_ACCOUNT_ID line - the app runs exactly the same, it just never checks for a key.

2. First boot

cd ~/pcapng-deploy
docker compose pull
docker compose up -d
docker compose logs -f pcapng-analyzer   # watch it start, then Ctrl-C

You should see listening on http://0.0.0.0:8088 in the logs.

3. Firewall

Only ports 80 and 443 need to be open - the app itself (8088) is never exposed directly:

sudo ufw allow OpenSSH
sudo ufw allow 80/tcp
sudo ufw allow 443/tcp
sudo ufw enable

4. First sign-in

Visit https://pcap.example.com (your real domain). Sign in as admin, using the password you generated in step 1:

cat ~/pcapng-deploy/admin-password

The app forces you to set a new password immediately, before anything else is reachable.

5. Enter your license key (Pro only)

Settings → License → paste the key you were emailed → Activate. It's checked immediately, so you'll see it unlock on the spot: the anomaly detectors, watched-folder auto-ingest, the 5 GB upload cap, and unlimited history.

If it ever shows as unlicensed unexpectedly, hit Recheck on that same page before contacting support - most often it's a temporary network blip on the server's side, and it self-heals within the grace period.

Keeping it backed up

Everything that matters - captures, analysis results, your login - lives in the pcap-data Docker volume. Back it up with:

docker run --rm -v pcap-data:/data -v "$PWD":/backup alpine \
  sh -c "tar czf /backup/pcap-backup-$(date +%F).tar.gz -C /data ."

Put that in a cron job (e.g. daily) if you want it automatic. To restore, untar the backup into a fresh pcap-data volume before first boot.

Updating to a new version

cd ~/pcapng-deploy
docker compose pull
docker compose up -d

Your data volume is untouched - nothing to migrate by hand.

Need help?

Email [email protected] - include your license key (if you have one) and, if something's broken, the output of docker compose logs pcapng-analyzer. Refunds: full refund within 14 days of purchase, no questions asked, same email address.