CapAnalysis

What CapAnalysis is

CapAnalysis is a free web visual tool for examining captured network traffic. It indexes PCAP datasets and presents TCP, UDP, and ESP streams or flows, including geographic views of connections. The viewer can work with individual PCAP files or sets of files. For TCP flows, it reports bytes lost in each direction and total bytes exchanged without counting retransmitted packets. Deep Packet Inspection recognizes more than 140 protocols, allowing flows to be filtered by protocol. Other filters include IP address or port, country, data size, and date and time. An included MaxMind database identifies connection destination countries for IPv4 and IPv6. Users can also import a publicly available PCAP from a URL, including a PCAP inside a ZIP archive. CapAnalysis is open-source software under the GNU General Public License version 2. The installation guide lists Debian and Ubuntu packages in 32-bit and 64-bit versions. After installation, users access the application in a browser at localhost:9877 or the server’s IP address on port 9877. The demo accepts PCAP files up to 20 MB and deletes dataset data at 00:00 UTC on the day after creation.

Who it suits

CapAnalysis suits information security specialists and system administrators who need to inspect PCAP traffic. Students, researchers, hackers, engineers, and developers are also listed as potential users.

Limits

The demo accepts PCAP files up to 20 MB and automatically deletes dataset data at 00:00 UTC on the day after creation.

Getting started

1. Visit the CapAnalysis website.
2. Install the Debian or Ubuntu package for your system’s 32-bit or 64-bit architecture.
3. Open the application in a browser at localhost:9877 or the server’s IP address on port 9877.
4. Load PCAP files, or import a publicly available PCAP by URL, including one in a ZIP archive.

Verdict

Choose CapAnalysis if you need a free tool for indexing and filtering PCAP traffic, with protocol inspection and geographic views. The demo has a 20 MB file limit and removes dataset data the next day, so that route suits only short-lived analysis within those constraints.