Inspect network packet capture (.pcap, .pcapng) files in client browser memory. Deconstruct protocol stacks from Ethernet and IPv4/IPv6 down to TCP/UDP, DNS queries, and HTTP headers with deep hex dump payload inspection.
In digital forensics and incident response (DFIR), host artifacts (such as event logs, registry keys, and prefetch files) document what occurred on an endpoint. However, network packet captures (PCAP) provide the indisputable, wire-level record of communications that traversed the perimeter.
Whether analyzing malicious beaconing from Cobalt Strike, command-and-control (C2) channel interactions, or exfiltration via covert protocols, forensic examiners rely on packet captures to establish ground truth.
A standard classic Libpcap file begins with a 24-byte Global Header followed by sequentially stored packet records:
Begins with magic number 0xA1B2C3D4 (or 0xD4C3B2A1 for byte-swapped captures). Defines major/minor version (2.4), timezone offset, timestamp accuracy, maximum snapshot length (snaplen), and link-layer type (1 = Ethernet).
Precedes every individual packet. Contains a 32-bit timestamp in seconds (Unix Epoch), a 32-bit timestamp in microseconds, the captured packet slice length (incl_len), and the original packet length on the wire (orig_len).
Decodes 14-byte Ethernet II frames (Source/Dest MAC, EtherType 0x0800 IPv4) and 20-byte IPv4 headers (TTL, IP ID, Protocol 6 TCP / 17 UDP, Source and Destination IP addresses).
TCP flags (SYN, ACK, RST, FIN, PSH) expose scan reconnaissance and connection state. DNS query strings uncover domain-generation algorithms (DGA) and covert tunneling channels.
| Attack Vector | Wire Protocol Indicators | Forensic Detection Method |
|---|---|---|
| DNS Tunneling & Exfiltration | High volume of UDP 53 packets with long, randomized subdomains (e.g., [base64].c2.domain.com) |
Filter for DNS queries; measure subdomain Shannon entropy and aggregate byte volume transferred over port 53. |
| Cleartext Credential Harvesting | Unencrypted HTTP (TCP 80), FTP (TCP 21), or Telnet (TCP 23) transmissions | Search payload byte streams for keywords: password=, Authorization: Basic, USER, PASS. |
| Port Scanning & Reconnaissance | Rapid sequence of TCP packets with only the SYN flag set, targeting sequential destination ports |
Identify burst of unmatched SYN requests followed by RST/ACK rejects or no responses. |
| ARP Spoofing & MitM | Excessive unsolicited ARP reply packets claiming a duplicate MAC for the default gateway IP | Map IP-to-MAC associations across time; flag conflicting MAC addresses for the router interface. |
ArrayBuffer and DataView) to parse packet records in memory. It comfortably handles standard triage captures (5 MB to 50 MB, representing tens of thousands of packets) without browser lag. For multi-gigabyte continuous packet captures, desktop tools like Wireshark or tshark are recommended.
ts_sec (seconds since January 1, 1970 UTC) and ts_usec (microseconds). The analyzer calculates the relative time offset from the first packet in the capture to display elapsed seconds with microsecond precision.
0x0A0D0D0A), Interface Description Blocks, and Enhanced Packet Blocks (0x00000006), extracting the contained Ethernet frames identically to classic PCAP files.