What Is PcapAI?

Deep Packet Inspection

Full-stack deep packet inspection across every layer — from Ethernet frames and IP headers down to application-layer payloads. Decodes TCP, UDP, DNS, HTTP, HTTPS, FTP, SMB, SMTP, Kerberos, and more. The result is a complete map of every conversation in the capture: who talked to whom, on which protocol, for how long, and how much data was exchanged.

MITRE ATT&CK Threat Detection

Every security finding is mapped to the MITRE ATT&CK framework, giving SOC analysts a standardized taxonomy for communication, escalation, and documentation. The engine covers 60+ techniques — a sample of the most common detections:

• T1071.004 DNS tunneling & C2 over DNS
• T1071.001 C2 beaconing over HTTP/HTTPS
• T1557.002 ARP Cache Poisoning (MITM)
• T1595 Active scanning & reconnaissance
• T1048.003 FTP-based data exfiltration
• T1040 Network sniffing & credential interception
• T1558 Kerberos ticket extraction

These are a sample of the most common detections. The full detection engine covers 60+ MITRE ATT&CK techniques across network-based tactics — from initial reconnaissance and lateral movement to exfiltration and C2 communication.

Credential & Forensic Discovery

Scans application-layer traffic for plaintext credentials, NTLM challenge-response hashes, Kerberos tickets, and session tokens transmitted over unencrypted protocols including HTTP, FTP, SMTP, and SMB. All discovered credentials are immediately masked in the report (displayed as [REDACTED]) — proving the exposure exists without printing the actual secrets, preserving SOC2 and GDPR compliance.

Performance Analytics

Beyond security, PcapAI quantifies network performance degradation automatically. It reports retransmission rates (cases above 60% flagged as critical), calculates per-flow latency, identifies TCP Zero Window events, detects ARP table conflicts causing packet loss, and correlates these metrics to specific hosts and time windows — delivering analysis that would take a network engineer hours to assemble manually.

Automated PDF Security Reports

Every analysis produces a downloadable PDF containing: an executive summary with an overall risk score; a per-finding breakdown with MITRE ATT&CK technique IDs, severity ratings, and remediation steps; flow statistics and protocol distribution tables; and a timeline of detected events. Reports follow a consistent format suitable for compliance auditors, internal security reviews, or client deliverables.

REST API & SIEM Integration

Advanced subscribers can automate the entire workflow via REST API. Common integration patterns: auto-uploading captures from CI/CD pipelines after network tests; feeding captures from intrusion detection systems for automated triage; and pushing report findings into SIEM platforms like Splunk, Elastic SIEM, or Microsoft Sentinel.

MCP Server — Local AI Forensics

For organizations where uploading captures to a cloud endpoint is not acceptable — regulated industries, air-gapped environments, high-sensitivity investigations — PcapAI offers an open-source MCP Server built in Rust. The Model Context Protocol integration allows AI assistants like Claude Desktop to perform deep packet inspection entirely on the local machine. No packet data leaves the device. This architecture resolves the fundamental tension between AI-powered analysis and data privacy in network forensics.