PCAP analysis questions

A-Packets is an online PCAP analyzer for fast detection and investigation. Upload a .pcap or .pcapng file and the report brings up what needs attention in the capture, then lets you trace each finding through the hosts, HTTP sessions, carved files, DNS lookups and TLS servers behind it. Public analysis is free for sanitized captures, and private plans or an on-premise build keep sensitive ones private. See real sample reports.

A-Packets reads .pcap and .pcapng files written by Wireshark, tcpdump, dumpcap and similar tools, and a .cap file when it holds libpcap data. Compressed archives are not accepted, and a Windows pktmon .etl file needs converting with pktmon etl2pcap first.

Public analysis is free for files up to 25 MB, with no account required. It creates a public result page, so upload only sanitized captures. Use paid private analysis for sensitive traffic or A-Packets Enterprise when captures must stay inside your infrastructure.

In public mode, anyone can open the report, download the capture and the files carved from it, and find it in the public feed. Private reports stay in your workspace and out of the feed. Choose the mode before you upload, and review the privacy policy and retention details.

Yes. HTTP Headers lists each distinct set of request headers with a filter by method, and the HTTP view pairs every request with its response, status and the start of the body. HTTPS payloads are not decrypted.

Open Ports lists, per host, the TCP ports that answered a connection attempt in the capture, named from the standard port list rather than from banners. Servers lists the DNS, DHCP and LDAP servers clients used. A capture only shows the traffic it holds, so this is not a port scan.

Yes. The Network graph shows every IP address and what it talked to; click a host for its country, NetBIOS name and OS where the traffic reveals them. Ethernet lists MAC addresses with their vendors, and SMB and SSDP show devices announcing themselves.

Yes, from 802.11 captures: access points and their SSIDs, the networks clients probe for, broadcast and client-to-client frames, and captured WPA/WPA2 handshakes. A capture taken on an ordinary connected interface carries Ethernet frames instead, so record in monitor mode to see 802.11.

Yes, from HTTP. Images land in Pictures, PDFs and Office files in Documents, and every other saved body sits under its request in the HTTP view, with gzip and chunked encoding undone. Files sent over TLS, FTP, SMB or email are not carved; see extract files from a PCAP for the transfers that need Wireshark.

Yes, when they crossed without TLS. The Credentials view lists cleartext logins from protocols such as FTP, Telnet, HTTP Basic, SMTP, IMAP and SNMP, and challenge-response hashes from NTLM, Kerberos and Digest, with the client and server of each. Logins inside TLS stay hidden, and web form logins appear in the HTTP view. Follow the cleartext password audit to confirm and fix an exposure.

Yes. The Professional and Advanced plans include a REST API key for uploading captures and fetching results from your own scripts. Scheduling stays in your integration; A-Packets does not monitor traffic continuously. See the plan features.

Yes, the parts that are not encrypted: server names, protocol versions, cipher suites and certificate chains, with flags for expired or self-signed certificates and Heartbleed attempts. A-Packets does not decrypt TLS payloads, so files and logins inside TLS sessions stay out of reach.

Processing time depends on capture size, traffic complexity and server load. The upload page shows progress and links the report when processing completes.

Use A-Packets to find what needs attention and the hosts, sessions, logins and files involved, then open the same file in Wireshark or tshark for frame-level confirmation at the host, port and time the report points to. The sample reports show both steps, and online PCAP analyzers compared covers the jobs where Wireshark alone is the better tool.

Private files can be deleted by you. Public files can be removed via the contact form. See full retention detail for automatic deletion windows.

An account is where private analysis lives: with a Pack or a subscription, reports stay in your workspace and out of the public feed, and you can manage or delete them. Professional and Advanced also raise the file limit to 50 and 100 MB; Starter keeps the 25 MB of public analysis.

Your card is charged immediately for the first billing period (monthly or yearly). You’re then billed automatically on the same calendar day every period unless you cancel.

Yes. Cancelling stops future renewals, but you keep all subscription features until the current period ends. No prorated refunds are applied.

No. Your analysis-run quota and private-storage slots reset on the first day of each new billing cycle.

A Pack is a one-time bundle of analysis credits, each good for one private run. Each pack has its own file-size limit; compare the current private credit packs before choosing.

Packs expire 6 months (180 days) after purchase. Unused credits disappear on the expiry date.

No. Packs sit on top of any subscription and are consumed only when your subscription limits are full or a file exceeds your plan's size limit.

Private reports generated with a Pack are kept 30 days from the time of analysis. After 30 days they're automatically deleted.

No. A credit is consumed when the analysis completes, regardless of whether you later delete the report.

Yes. Upgrade to a subscription with permanent private storage, or download the report before the 30-day window ends.