Use cases
PCAP analysis use cases
Six tasks analysts bring to a packet capture, from opening a pcapng in the browser to triaging an infected host. Each page works its task through several public sample captures, shows the checks in A-Packets and in Wireshark or tshark, and says what a capture cannot tell you.
Pick the task in front of you
-
Viewing captures
Open a PCAP file online
Open a pcap or pcapng file in the browser without Wireshark, find the view that answers your first question, and share the result safely.
-
Credential exposure
Cleartext password audit
Run a cleartext password audit from packet captures: where to capture, what counts as exposed, a fix for each protocol and the retest.
-
File carving
Extract files from a PCAP
What a capture can give back: files carved from HTTP, what needs Wireshark's export, what TLS seals, and how to keep each file's origin.
-
DNS
DNS tunneling in a PCAP
Tell a DNS tunnel from a subdomain sweep and ordinary lookups with four sample captures, the DNS view and three tshark counts.
-
Layer 2
ARP spoofing in a PCAP
Two ARP poisonings that leave very different traces, one false alarm, and the checks in A-Packets and Wireshark that catch both.
-
Incident response
Malware traffic analysis
Triage an infected host across five malware families: the arrival, the command channel, what left the network and what to hand over.
Use cases and sample reports
The sample reports take one capture each and tell its story frame by frame. The pages here go the other way: one task across several captures, so you can see which signs hold from one sample to the next and which belong to a single file. Every number comes from a public capture, counted in its A-Packets report or with tshark on the original file, and every screenshot is the report as the engine at apackets.com produced it. When a capture cannot answer a question, such as what a file sent over HTTPS contained, the page says so.
To get the same report for your own traffic, upload a capture. Public analysis suits samples and sanitized captures; for production or incident traffic, use a private plan or the on-premise build. Longer investigations of single infections are on the blog.