Capture

What it does: a simple live packet analyzer — like a lightweight Wireshark built into the toolkit. Point a wired or wireless interface at a switch SPAN/monitor port (or just watch your own machine's traffic), and it decodes packets in real time: time, source, destination, protocol, length, and a short info line (TCP flags, the app protocol behind a port, ARP who-has, and so on). Filter with a BPF expression, and export everything to a standard .pcap you can open in Wireshark for a deeper dissection.

Setup on Windows: install Npcap (npcap.com), the capture driver Wireshark uses, and tick "WinPcap API-compatible mode" during install. The tool detects a missing driver and shows a notice.

Setup on Linux: it uses libpcap (usually preinstalled; else install libpcap0.8 on Debian/Ubuntu or libpcap on Fedora/Arch) plus a one-time grant: sudo ./install-linux.sh from the unpacked folder. The tool detects a missing piece and shows a notice.

Reading a SPAN port: on the switch, mirror the source port(s)/VLAN to a destination port (Cisco: `monitor session 1 source interface Gi1/0/5` + `monitor session 1 destination interface Gi1/0/24`), patch your NIC into that destination port, pick the interface here, and Start. For wireless you see your own adapter's traffic (true over-the-air/monitor-mode sniffing is adapter-dependent).

BPF filters (optional): `tcp port 443`, `host 10.0.0.5`, `arp`, `udp port 53`, `vlan 20`, `not broadcast`.

Safe to run: yes — it only LISTENS (promiscuous receive); it never transmits or changes anything. But only capture where you're authorized — sniffing traffic you don't own can be a policy or legal problem. Everything stays on this machine.

Reading results: click a packet for its details. The stats line counts packets per protocol, so you can spot what's dominating a link; export to .pcap when you need Wireshark's full dissectors.

The OSI model / packet structure — what you're looking at: every packet is nested headers, each an OSI layer. On the wire, left to right:

• L2 Ethernet — source/destination MAC + EtherType. (Who, physically, on this segment.)
• L3 IP — source/destination IP, TTL, protocol. (Which hosts, across networks.)
• L4 TCP/UDP — source/destination ports + TCP flags/sequence. (Which service, and the conversation's state.)
• L5–7 Payload — the application data (DNS query, HTTP request, TLS handshake…).

Capture peels these and shows src, dst, protocol, and a summary; the layer that names the packet (ARP > TCP/UDP > IP > Ethernet) is what appears in the Protocol column.

What it decodes: the protocol (named from the port — DNS, DHCP, HTTP, SSH …), source and destination with ports, TCP flags, and ARP who-has / is-at. It doesn't dissect payloads (no DNS response codes, DHCP message types or retransmission analysis) — export to Wireshark for that. That's still enough to spot:

• DNS that never answers — UDP/53 queries going out with nothing coming back.
• TCP problems — lots of [RST] (refused/dropped), or repeated [SYN] with no [SYN,ACK] (port blocked/unreachable).
• Duplicate IP / ARP issues — two MACs answering for one IP, or an ARP storm.
• DHCP that gets no reply — UDP/67-68 from the client and nothing back from a server.
• Broadcast/multicast floods — one protocol dominating the stats line.
• Cleartext you shouldn't see — Telnet/FTP/HTTP where TLS was expected.

Export & analyze elsewhere: hit Export .pcap for a standard capture file (the first 20,000 packets of a run). Open it in Wireshark (full dissectors, Follow-Stream, expert info) or EtherPeek/Omnipeek. Browser tools like a-packets.com or CloudShark upload the file to a third party — only use them for traffic you're allowed to share. The .pcap is portable: capture here on-site, analyze later or hand it to someone else.

Saved captures are NOT redacted: a .pcap is the raw traffic, so any clear-text password, SNMP community or token that crossed the wire is in the file. Treat it like the traffic itself, and only hand it to someone you'd let see that.