Network captures (pcap)

Upload a .pcap or .pcapng and logcat.ai decodes it, builds a queryable model of every packet and flow, fingerprints the TLS handshakes, runs threat heuristics, and renders a network dashboard. You investigate it the same way you would a bugreport.

A pcap dashboard: prioritized network-forensics findings (malformed-frame and 802.11 anomaly detection) over the decoded capture, with per-severity charts.
A pcap dashboard: prioritized network-forensics findings (malformed-frame and 802.11 anomaly detection) over the decoded capture, with per-severity charts.

What gets accepted

  • .pcap: classic libpcap captures (tcpdump, Wireshark “Save As pcap”).
  • .pcapng: the modern pcapng container, including multi-interface captures.

Captures are decoded automatically at ingest. You upload the raw binary capture directly, no text export step.

How a capture is analyzed

A capture is decoded into structured, queryable data rather than searched as text, so questions about flows, endpoints, and byte counts get exact answers:

  • Packet and flow model. Every packet and conversation is queryable, so an investigation can run real SQL over the capture (protocols, endpoints, ports, byte counts, timing). Nanosecond-resolution captures are read at full precision.
  • Transport health, errors, ARP and industrial traffic. Retransmissions, resets, duplicate acknowledgements and zero windows per flow; how much of the capture’s TCP payload was sent more than once, the error statuses file-sharing servers returned and the destination-unreachable messages, counted in the findings; those, plus TLS alerts, as tables you can query; ARP activity; and industrial fieldbus operations (Modbus, S7comm) as their own table.
  • TLS fingerprints. JA3 / JA3S client-and-server handshake fingerprints and HASSH SSH fingerprints are computed, so you can identify clients, servers, and tooling even inside encrypted traffic.
  • Threat detection. Rule-based checks flag port/host scanning, beaconing (regular call-home intervals), and DGA-style domain patterns.
  • Ask in English, get exact answers. Quick Search and Deep Research query the decoded capture directly, drilling from a broad question down to the specific flows that answer it.
  • One connection across several captures. In a comparison of captures taken at different points of one network path, Deep Research follows a TCP connection through them hop by hop: the bytes each hop lost, a hop that dropped every packet above a size, and how far apart the captures’ clocks are. Name the captures in path order and the connection’s endpoints in your question. Address translation changes a connection’s endpoints, so a capture taken on the far side of it is compared as a different connection.
  • Network dashboard. The findings render as charts, grouped into what the capture is, what happened and when, what went wrong, and what looks suspicious. A group with nothing to show is left out. See Analysis output & dashboards.
  • Wireless captures. A capture of 802.11 traffic gets the radio layer as well: how a station joined the network, in order and with direction, plus how often frames had to be sent again, how many stations were forced off, how many joins were refused, and the signal strength. Signal is shown only when the capture carries a radio header; without one the tile says it was not measured rather than showing a zero.

Example questions to ask

Ask from the Research tab once the file is analyzed. Reach for Quick Search when you already know what you’re after, Deep Research when you need the root cause.

Quick Search for fast, cited lookups:

  • “What hosts did this device talk to, and over which ports?”
  • “Show me the TLS clients by JA3 fingerprint.”
  • “Which flow moved the most bytes, and to where?”
  • “Was there a port scan in this capture?”

Deep Research for multi-step root-cause investigations:

  • “Is there any beaconing or regular call-home activity?”
  • “Why did the TLS handshakes fail?”
  • “Is this capture consistent with a scan or an attack?”
  • “These three captures were taken along one path, client side first. Which hop lost data on the connection between 2001:db8::5 port 50432 and 2001:db8:20::9 port 443?” (asked of a comparison of the three)

See Quick Search and Deep Research for how the two modes differ.

Capturing a pcap

Any standard capture tool produces an accepted file:

# tcpdump on the device or a mirror port
tcpdump -i any -w capture.pcap

# tcpdump on a specific interface, with a capture filter
tcpdump -i eth0 -w capture.pcapng 'tcp port 443'

Upload the resulting .pcap / .pcapng directly.

Next