What's new

The biggest changes in recent versions. The app tells you when a new one is out.

Version 2.5: a desktop app

PCAPNG Analyzer now comes as one file for Windows, macOS and Linux, as well as the Docker image.

No Docker needed

Download, run, and your browser opens on the app, already signed in. It only accepts connections from your own computer. Download it.

Scoop and Homebrew

Install and update it with one command on Windows, macOS or Linux. How.

Update notices

The app checks once a day for a newer version and tells you. The check sends nothing about you or your captures, and you can turn it off. Details.

Version 2.0: a diagnosis, not just statistics

Version 2 turned PCAPNG Analyzer from a capture viewer into a diagnosis tool. Existing installs upgrade with a normal image pull: the database migrates itself, and your history, notes and settings carry over.

A diagnosis, not just statistics

Network health rates DNS, TCP and HTTP as good, warning or poor and names the worst offenders. Every finding now explains itself: what it means, when it's usually harmless and what to check next. Free shows the health summary and a preview of what was found.

History that means something

Trends across your captures, “first seen” findings for hosts, domains, certificates and ports your network has never used, and a timeline for any address or domain. Pro.

Deeper decode, on every tier

Follow any TCP or UDP stream. Decode QUIC server names, DHCP, SSH, Kerberos, LDAP, SMB and NTP, see the devices and services found, and fingerprint TLS clients with JA3 and JA4.

Reports you can hand over

Incident reports open with an executive summary and carry your logo, company name and a case reference. You can also make a sanitized copy of a capture to send to a vendor. Pro. See a sample.

Wired into your tools

Local alerts for serious findings, SIEM export as JSON Lines, API tokens for scripts and CI, and threat lists that now take file hashes and JA3, JA4 and HASSH fingerprints. Pro.

Windows-network findings

New detections for cleartext LDAP passwords, SMB1, Kerberos tickets that can be cracked offline, bursts of failed logons and NTP monlist probes, among 44 kinds of finding in all. Pro.