Built for the ticket,
not the protocol spec.
A packet capture already contains the answer. The problem is that reading one is a skill, the pressure is on, and the person who needs the answer is usually not the person who can spend an hour in a packet list. This tool reads the capture and writes down what happened, in sentences.
What it is
A pcap/pcapng analyzer that runs entirely on the server it is installed on. You upload a capture, it follows every TCP stream by sequence number, reads the handshakes, the TLS negotiation and certificates, the DNS lookups, the HTTP requests, the ARP and the ICMP errors — and then it tells you, per conversation, whether it was healthy, degraded or broken, and why. Then it lets you filter the whole capture by source IP, destination IP or protocol.
- No account, no email, no tracking. There is nothing to sign up for.
- Nothing leaves the host. No CDN, no webfont, no analytics, no third-party API.
- Captures clear themselves after a couple of quiet hours, and can be cleared on demand.
- It says what it cannot know. A capture filtered to one host cannot prove the far end stayed silent — so the report says exactly that, instead of inventing a fault.
Who it is for
The engineer holding the ticket
“It works from here but not from there.” The report names the stream, the stage and the reason — refused, dropped, reset after data, certificate expired, name never resolved.
Whoever owns the firewall
Palo Alto writes four captures for one session. Upload the set and they are analysed together rather than one at a time.
Anyone handed a .pcap
You do not need to know what a duplicate ACK means. The finding explains what it is evidence of, and what it is not.
Honest limits
- It reads what was captured. A truncated capture (-s 96) cannot yield certificates, and the report will say so rather than guess.
- TLS 1.3 encrypts the certificate. The handshake is still analyzed; the certificate cannot be, by design of the protocol, and this is stated rather than skipped over.
- It is a reader, not a sniffer. It never touches your network — it only reads the file you give it.
- Very large captures are bounded by this host’s memory and time limits. Cut a big one down with a filter first.
Check something else next
The other modules look at the same target from a different angle.