PCAP Analyzer

Leer en español · Wiki

A desktop network-capture analyzer for administrators and incident responders. Open a .pcap / .pcapng file and get, in one window: a Wireshark-style packet list with display filters, connection health, a host inventory, DNS / HTTP / TLS inspection, heuristic security findings, and one-click HTML / PDF / JSON / CSV reports. Everything also works from the command line.

Features

Tab	What it shows
Dashboard	Key figures (packets, volume, throughput, hosts, connections, DNS, TLS), findings by severity, traffic over time, protocol mix, top talkers, TCP health
Packets	Packet list with Wireshark-like colouring (bad TCP in red), full protocol tree and hex dump of the selected packet, right-click to filter or Follow Stream
Security	Findings sorted by severity with explanation, evidence and recommendation; one click shows the evidence packets
Connections	Every TCP/UDP connection oriented client → server: bytes up/down, duration, handshake RTT, retransmissions, duplicate ACKs, zero windows, resets, state; "only problems" toggle
Hosts	Inventory with names learnt passively (DNS answers, DHCP, mDNS), MAC, internal/external, OS guess from TTL, peers, services offered
DNS	Queries matched with responses: answers, response code, latency; top domains, response codes, query types
HTTP	Requests matched with responses: host, URI, status, content type, size, latency, user agent
TLS	Handshakes: SNI, negotiated version and cipher, ALPN, JA3 / JA3S fingerprints; outdated versions highlighted
Ports / Protocols	Port usage with service names; transport and application protocol distribution
I/O Graph	Packets, bytes or bits per second over time, with up to three extra series defined by display filters
Charts	Twelve ready-made charts (zoom, pan and save as image)

Security detections

Port scans, ping / network sweeps, SYN floods, ARP spoofing, rogue DHCP servers, ICMP redirects, credentials sent in clear text (FTP, Telnet, POP3, IMAP, SMTP AUTH, HTTP Basic), unencrypted management protocols, DNS tunnelling, bursts of failed lookups (DGA), periodic beaconing to the Internet, large uploads to external hosts, outdated TLS / weak ciphers, connections to suspicious ports and form data posted over plain HTTP. Thresholds are adjustable in Analysis → Detection Settings, and captured passwords are masked by default.

Display filters

The filter bar applies to every tab at once. It uses a Wireshark-like syntax:

ip.addr == 192.168.1.10
ip.src == 10.0.0.0/8 and tcp.port == 443
dns.qry.name contains "example"      tls.sni matches "\.ru$"
tcp.analysis.retransmission          tcp.flags == S
port 53                              len > 1000 and not tls

Fields include ip.src/dst/addr, eth.*, port, tcp.flags, tcp.seq, tcp.window_size, tcp.analysis.*, dns.qry.name, http.host, tls.sni, icmp.type, vlan.id, len, time, info; operators == != > < >= <= contains matches, and and / or / not with parentheses. Press F1 in the application for the full reference. Double-click (or right-click) a row in almost any tab to filter by it.

More screenshots

Reports

Report → Generate Report (or --format on the command line) writes a timestamped folder with:

• HTML: a single self-contained file (charts embedded, nothing loaded from the Internet) with a navigation sidebar, searchable / sortable tables and light & dark styles;
• PDF: a printable A4 summary with findings, charts and the most relevant tables;
• JSON: every table and finding, machine-readable;
• CSV: one file per table (findings, hosts, connections, DNS, HTTP, TLS, ports, protocols).

Each report records the SHA-256 of the capture file, so it can be tied to the exact evidence.

Also

• Fast: a built-in pcap/pcapng reader and dissector process well over 100 000 packets per second (scapy is only used to build the detail tree of the selected packet). .gz captures open directly.
• Background processing with pause / resume / cancel; drag & drop; recent files.
• English and Spanish interface; light, dark or system theme.

Installation

Requires Python 3.10 or newer.

git clone https://aalejandro.ddns.net/ariel/pcap-reportgenerator.git
cd pcap-reportgenerator
python -m venv .venv
source .venv/bin/activate
pip install -e .

This installs the pcap-report command. Dependencies: PyQt6, matplotlib and scapy.

Usage

Graphical interface

pcap-report                    # open the application
pcap-report capture.pcapng     # open a capture directly

1. Open a capture (File → Open, the toolbar or drag & drop).
2. Check the Dashboard and the Security tab; click a finding and Show evidence packets.
3. Narrow down with display filters; right-click a packet or connection → Follow Stream to read the conversation.
4. Report → Generate Report to save HTML / PDF / JSON / CSV.

Command line

# summary and findings on the terminal
pcap-report capture.pcap --no-gui

# full report in every format, only for HTTPS traffic, in Spanish
pcap-report capture.pcap --no-gui -o reports/ --format html,pdf,json,csv -f "tcp.port == 443" --lang es

# for scripts / monitoring: exit status 3 if a high-severity finding is present
pcap-report capture.pcap --no-gui -q --fail-on high

Run pcap-report --help for every option.

Try it with the sample capture

tools/make_sample_pcap.py generates a synthetic office network capture (fictional addresses and names only) containing ordinary traffic plus one instance of every incident the detectors look for:

python tools/make_sample_pcap.py sample-office.pcap
pcap-report sample-office.pcap

The screenshots in this README were taken from that capture with tools/screenshots.py.

Development

pip install -e ".[test]"
QT_QPA_PLATFORM=offscreen pytest

pcap_report/
  core/                 Qt-free processing
    pcapfile.py         pcap / pcapng / gzip reader and writer
    dissect.py          fast frame → PacketRecord decoder
    proto/              DNS, TLS (JA3) and HTTP parsers
    filters.py          display filter language
    statistics.py       totals, protocols, ports, timeline
    analysis/           flows & TCP expert info, DNS, HTTP/TLS, hosts, security detections
  reporting/            charts and HTML / PDF / JSON / CSV reports
  gui/                  PyQt6 main window, tabs and dialogs
  app.py                command line and GUI entry point
tools/                  sample capture generator, screenshot script
tests/                  pytest suite (runs headless)

See the wiki for the user guide, the filter reference and how each detection works.

Limitations

• Detections are heuristics: treat findings as leads to verify, not as verdicts.
• Encrypted traffic is analysed only through its metadata (SNI, versions, JA3, sizes, timing).
• The whole capture is held in memory; multi-gigabyte captures need a correspondingly large amount of RAM.
• The OS guess is based on TTL and is only shown for hosts on the local network.

License

MIT