PCAP Analysis FAQ

Native .pcap and .pcapng packet-capture files from Ethernet, Linux cooked (SLL), raw IP or loopback interfaces, including PCAPNG files that mix them. Wi-Fi monitor-mode (802.11 radiotap), USB and Bluetooth captures are not supported. Compressed archives (ZIP, RAR, 7-Zip, gzip) are not accepted; unpack them first.

Yes: 20 MB for the free summary, single reports and packs; 25 MB on the Starter subscription; 50 MB on Pro and Advanced. A larger capture can usually be trimmed to the problem window — see how to reduce PCAP file size — or contact us about a custom plan.

Choose Troubleshooting when something is slow or failing: the report looks for packet loss, latency, DNS and application errors and says which part of the network is at fault. Choose Security Audit when you want to know whether the capture shows threats, exposed credentials or attacker activity. Each report also lists what it sees of the other kind.

The free summary is ready in about two minutes for most captures. The PDF report is generated right after checkout, usually within a few minutes.

The verdict, the risk or network health score, and the problems or findings by name and severity, with a traffic overview. You can stop there; nothing is charged.

A single $9 payment covers one capture’s PDF report: a one-page executive summary, every problem or finding with its evidence and the affected hosts and times, fix steps with an owner and a deadline, the asset inventory, what was checked and what the capture could not show, and the capture’s SHA-256 with a report ID. No recurring fees. See a sample report.

The free summary says so, together with what was checked. A clean-scan PDF for a client or an auditor costs $2; a capture without findings is never charged $9.

Yes. Our terms let you use, copy and share each report you obtain, including with your clients. Signed-in accounts can print the client’s organization and a TLP label on every report.

Yes. You can request a full refund within 7 calendar days of your most recent payment through the contact page.

Report packs of 5, 15 or 30 reports (credits never expire) and monthly or yearly subscriptions, as shown on the pricing page.

A PDF report (A4 by default, US Letter in your account settings) with the same structure every time: executive summary; scope, evidence and limitations; findings; remediation roadmap; coverage; assets and capture quality; appendices with the event log and the methodology.

For uploads without an account, both the original file and its PDF report remain on our servers for 24 hours, after which they are permanently deleted. Reports you save to your account are kept for 30 days (on the Advanced plan, while you are subscribed); you can delete them at any time.

Both the capture and its report are erased 24 hours after upload. You’ll need to re-upload the PCAP and run a new analysis.

It contains what is needed to act on a finding: IP and MAC addresses, host names and times. Passwords and other secrets are masked. Captures and reports are stored encrypted in Amazon S3 (us-west-2) and deleted on the schedule above.

The report never prints them in full: only the first and last character and the length, for example S******! (11), which proves the exposure without handing anyone the password. The capture you upload still contains them, so it is kept only for the retention period above.

Only the minimal billing details (card, country, email) required by our payment processor, Stripe.

A Rust engine parses the protocols and runs detection rules for 69 MITRE ATT&CK techniques and the network health checks. Every finding keeps the frames and values it rests on. The findings, evidence and scores come from those rules; an AI language model only writes the summary text from them. Thresholds and scoring are listed in each report’s methodology appendix.

Yes, on the Advanced plan. Create an API key in your profile and use the REST API to upload a capture, check its status and download the PDF report from CI, scripts or your own tools.

Yes. Manage or cancel your plan from your account; a cancelled plan stays active until the end of the billing period.