Capture (live packet analyzer)

What it does: a simple live packet analyzer — like a lightweight Wireshark built into the toolkit. Point a wired or wireless interface at a switch SPAN/monitor port (or just watch your own machine's traffic), and it decodes packets in real time: time, source, destination, protocol, length, and a short info line (TCP flags, the app protocol behind a port, ARP who-has, and so on). Filter with a BPF expression, and export everything to a standard .pcap you can open in Wireshark for a deeper dissection.

Setup — the one requirement: a capture DRIVER. On Windows install Npcap (npcap.com) — the exact driver Wireshark uses — and tick "WinPcap API-compatible mode" during install. The tool detects a missing driver and shows a notice. macOS/Linux use the built-in libpcap/BPF.

Reading a SPAN port: on the switch, mirror the source port(s)/VLAN to a destination port (Cisco: `monitor session 1 source interface Gi1/0/5` + `monitor session 1 destination interface Gi1/0/24`), patch your NIC into that destination port, pick the interface here, and Start. For wireless you see your own adapter's traffic (true over-the-air/monitor-mode sniffing is adapter-dependent).

BPF filters (optional): `tcp port 443`, `host 10.0.0.5`, `arp`, `udp port 53`, `vlan 20`, `not broadcast`.

Safe to run: yes — it only LISTENS (promiscuous receive); it never transmits or changes anything. But only capture where you're authorized — sniffing traffic you don't own can be a policy or legal problem. Everything stays on this machine.

Reading results: click a packet for its details. Watch the protocol mix in the stats line to spot what's dominating a link; export to .pcap when you need Wireshark's full dissectors.

The OSI model / packet structure — what you're looking at: every packet is nested headers, each an OSI layer. On the wire, left to right:

• L2 Ethernet — source/destination MAC + EtherType. (Who, physically, on this segment.)
• L3 IP — source/destination IP, TTL, protocol. (Which hosts, across networks.)
• L4 TCP/UDP — source/destination ports + TCP flags/sequence. (Which service, and the conversation's state.)
• L5–7 Payload — the application data (DNS query, HTTP request, TLS handshake…).

Capture peels these and shows src, dst, protocol, and a summary; the layer that names the packet (ARP > TCP/UDP > IP > Ethernet) is what appears in the Protocol column.

What a simple analyzer can diagnose (once the driver's installed) — you don't need deep dissection for most tickets:

• DNS failures — queries with no response, or SERVFAIL/NXDOMAIN (watch UDP/53).
• TCP problems — lots of [RST] (resets = refused/dropped), repeated [SYN] with no [SYN,ACK] (port blocked/unreachable), or retransmissions (loss/latency).
• Duplicate IP / ARP issues — two MACs answering for one IP, or an ARP storm.
• DHCP trouble — Discover/Request with no Offer/Ack (no address coming).
• Broadcast/multicast floods — one host or protocol dominating the stats line.
• Who's talking — top talkers and which protocols own the link.
• Cleartext you shouldn't see — Telnet/FTP/HTTP where TLS was expected.

Export & analyze elsewhere: hit Export .pcap for a standard capture file. Open it in Wireshark (full dissectors, Follow-Stream, expert info), EtherPeek/Omnipeek, or — without installing anything — a browser tool like a-packets.com or CloudShark. The .pcap is portable: capture here on-site, analyze later or hand it to someone else.