Netcap

No entries match these filters. Clear filters

1. v0.13.0 Oct 9, 2026 · issue 100

   Netcap v0.13.0 adds cross-protocol evidence linking and capture-time DNS context with new CLI flags and a /api/evidence/related endpoint.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v0.13.0 https://github.com/dreadl0ck/netcap.git
   # already have the repo? check out this version:
   $ git checkout v0.13.0

   └──▷ TRY IT
   Capture from a PCAPPCAPA packet capture, recorded network packets that can be inspected later. Analysts use it to reconstruct communication and investigate protocol behavior or suspicious traffic. file with DNS resolution context enabled so that detection rules can match on the DNS name that resolved a connection's destination.
   copy

   $ ./net capture -read traffic.pcap --service --dns-resolution-context

   Limit cross-protocol evidence linking to a 30-minute window and cap results at 100 links per query to reduce memory use on large captures.
   copy

   $ ./net capture -read traffic.pcap --service --evidence-links --evidence-links-window 30m --evidence-links-max-links 100

   • Adds --evidence-links flag (env NC_EVIDENCE_LINKS) to enable/disable cross-protocol evidence linking in the web UI and via /api/evidence/related.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Adds --dns-resolution-context flag (env NC_DNS_RESOLUTION_CONTEXT) to snapshot matched UDPUDPA network protocol that sends individual messages without guaranteeing delivery or order. Applications trade built-in reliability for less overhead and can add their own recovery. DNS answers onto Connection records for use in capture-time detection rules.
   • Adds --evidence-links-window flag (env NC_EVIDENCE_LINKS_WINDOW, default 1 h) to bound the maximum time between a DNS answer and a connection when linking evidence.
   • Adds --evidence-links-max-records flag (env NC_EVIDENCE_LINKS_MAX_RECORDS, default 1,000,000) to cap the number of records indexed per output directory before truncation is reported.
   • Adds --evidence-links-max-links flag (env NC_EVIDENCE_LINKS_MAX_LINKS, default 500) to limit related records returned per query.

   +4 more show less

   • Adds GET /api/evidence/related API endpoint and net investigate related subcommand to retrieve cross-protocol evidence timelines linking DNS, connections, protocol records and alerts.
   • Adds Settings → Features UI panel to toggle evidence linking and network detections independently at runtime.
   • Binds related-evidence references to audit-file content hashes and enforces capture interface/VLAN scope and bounded time windows, withholding ambiguous joins instead of guessing.
   • Enforces per-directory index and result limits that report truncation when exceeded.

   9 details in Everything

2. v0.10.3 Oct 5, 2026 · issue 096

   Netcap v0.10.3 ships faster native DPI with worker-owned nDPInDPIAn open-source deep packet inspection library maintained by ntop that classifies network traffic by protocol and application, giving cyber tools visibility into what flows are actually carrying beyond port numbers. contexts, bundled DB-IP Lite geolocation, and a rebuilt mutual-TLS 1.3 distributed collection wire format.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v0.10.3 https://github.com/dreadl0ck/netcap.git
   # already have the repo? check out this version:
   $ git checkout v0.10.3

   └──▷ TRY IT
   Run a live capture with DPI using four worker contexts to balance throughput against native memory use.
   copy

   $ sudo ./net capture -iface en0 -dpi-workers 4

   Generate a pinned TLS identity for a new distributed capture agent before connecting it to a collector.
   copy

   $ net agent -gen-keypair -cert agent.crt -key agent.key

   Start the agent with the collector's fingerprint pinned, flushing batches every 2 seconds.
   copy

   $ net agent -cert agent.crt -key agent.key -server-fingerprint <collector-sha256> -flush-interval 2s

   • Adds -dpi-workers flag (env NC_DPI_WORKERS) to set the number of worker-owned nDPI contexts; one context minimizes native memory, automatic mode uses up to eight.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Adds -geoProviders flag to select among bundled geolocation providers (e.g. dbip,geolite2); DB-IP Lite City data is now included in database downloads.
   • Adds net agent -gen-keypair flag (env NC_GEN_KEYPAIR) to write a new agent certificate and key and print its fingerprint, replacing the former gen-config flow.
   • Adds net agent -cert (env NC_CERT, default agent.crt), -key (env NC_KEY, default agent.key), and -server-fingerprint (env NC_SERVER_FINGERPRINT) flags for pinned mutual-TLS 1.3 agent identity in distributed capture.
   • Adds -flush-interval (env NC_FLUSH_INTERVAL, default 5s) and -max-pending (env NC_MAX_PENDING) flags to the agent subcommand for batching control over the new TLS wire format.

   +1 more show less

   • Upgrades native DPI to go-dpi v1.5.0 with incremental per-worker flow state and a ten-observation inspection budget, reducing microbenchmark latency from 98.75 µs to 17.42 µs per flow (10-packet case).
   • Adds -dpi-workers flag (env NC_DPI_WORKERS) to set the number of worker-owned nDPI contexts; one context minimizes native memory, automatic mode uses up to eight.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Adds net agent -gen-keypair flag (env NC_GEN_KEYPAIR) to write a new agent certificate and key and print its fingerprint, replacing the former gen-config flow.
   • Adds net agent -cert (env NC_CERT, default agent.crt), -key (env NC_KEY, default agent.key), and -server-fingerprint (env NC_SERVER_FINGERPRINT) flags for pinned mutual-TLS 1.3 agent identity in distributed capture.
   • Adds -flush-interval (env NC_FLUSH_INTERVAL, default 5s) and -max-pending (env NC_MAX_PENDING) flags to the agent subcommand for batching control over the new TLS wire format.

   2 more in Everything

   └──▷ BREAKING ON UPGRADE

   • !Distributed collection uses a new TCPTCPA network protocol that delivers a reliable, ordered stream of bytes between two endpoints. It detects lost data and retransmits it./TLS 1.3 wire format incompatible with v0.10.2 and earlier — net agent and net collect must be upgraded together.
   • !The gen-config / NC_GEN_CONFIG agent flag is removed; use gen-keypair / NC_GEN_KEYPAIR instead, and configure pinned agent identities with -cert, -key, and -server-fingerprint.
   • !Upgraded installations are prompted to fetch netcap.sqlite because database downloads now use the DB-IP Lite layout, replacing the previous bleve-based database sources.
3. v0.10.0 Oct 4, 2026 · issue 095

   Netcap v0.10.0 replaces bleve vulnerability indexes with a single SQLite+FTS5FTS5A full-text search extension built into SQLite that lets tools index and query large bodies of text efficiently, with ranking and phrase-match support, without an external search engine. database, cutting disk use from 4.1 GB to 299 MB.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v0.10.0 https://github.com/dreadl0ck/netcap.git
   # already have the repo? check out this version:
   $ git checkout v0.10.0

   └──▷ TRY IT
   After upgrading to v0.10, download and verify the new SQLite vulnerability database before running any vuln lookups.
   copy

   $ net util -download-dbs

   Rebuild netcap.sqlite locally from downloaded NVDNVDThe National Vulnerability Database, maintained by NIST, is the U.S. government repository of CVE records enriched with CVSS scores and metadata; cyber tools query it to drive vulnerability prioritization. and exploit-db feeds, for air-gapped or custom database workflows.
   copy

   $ net util -index all

   • Switches vulnerability and exploit lookups from nvd.bleve and exploit-db.bleve to a single netcap.sqlite (SQLite + FTS5) database, shrinking disk usage from ~4.1 GB to 299 MB.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Adds net util -download-dbs to fetch the new layout 2 database from https://dbs.netcap.io/dbs/v2/ with sha256 verification.
   • Updates net util -index to accept any value (e.g. -index all) and rebuild netcap.sqlite from NVD and exploit-db feeds via the new BuildVulnDB path.
   • Results are now capped at 10 hits ordered by BM25BM25The classic keyword-ranking formula behind traditional search engines. Hybrid search combines it with embedding similarity so exact terms and meaning both count. score, replacing bleve's score-threshold filtering.
   • Switches vulnerability and exploit lookups from nvd.bleve and exploit-db.bleve to a single netcap.sqlite (SQLite + FTS5) database, shrinking disk usage from ~4.1 GB to 299 MB.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Adds net util -download-dbs to fetch the new layout 2 database from https://dbs.netcap.io/dbs/v2/ with sha256 verification.

   2 more in Everything

   └──▷ BREAKING ON UPGRADE

   • !Vulnerability database format changed: nvd.bleve and exploit-db.bleve are no longer read; you must run net util -download-dbs after upgrading to fetch the new netcap.sqlite (layout 2) from https://dbs.netcap.io/dbs/v2/.
   • !The https://dbs.netcap.io/dbs/latest endpoint now serves a frozen bleve revision and is no longer rebuilt; netcap v0.10+ must use the v2 URL.
   • !net util -index no longer calls IndexData; it now calls BuildVulnDB and rebuilds netcap.sqlite — passing a specific index name has no effect; any value (e.g. -index all) rebuilds both NVD and exploit-db.
4. v0.9.15 Sep 27, 2026 · issue 088

   Netcap v0.9.15 adds Roaring bitmapRoaring bitmapA compressed bitmap data structure that stores sets of integers in three container types to keep memory low while enabling fast set operations like union, intersection, and membership tests. indexes for Community IDCommunity IDA vendor-neutral network flow hashing standard, maintained by Corelight, that produces a consistent identifier for a connection across different tools so analysts can correlate events from disparate data sources., certificate, fingerprint, and timeline facets — cutting filtered counts from ~2.6 ms to ~29 µs.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v0.9.15 https://github.com/dreadl0ck/netcap.git
   # already have the repo? check out this version:
   $ git checkout v0.9.15

   └──▷ TRY IT
   Run the pinned Wireshark sample corpus regression suite to validate all 22 pcappcapA packet capture, recorded network packets that can be inspected later. Analysts use it to reconstruct communication and investigate protocol behavior or suspicious traffic./pcapng captures after a build or config change.
   copy

   $ make test-wireshark

   • Prefilters audit streams with Community ID bitmaps, enabling fast record selection without full-file scans.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Reuses Roaring indexes for multi-ID records and fingerprints across the table, menu, and four charts via generation-checked snapshots.
   • Indexes certificate and timeline correlation facets, including exact host=<ip> and repeatable communityId=<value> timeline facets with per-track postings, cursor pagination, nearest-event lookup, and duration overlap; falls back to exact scanning above a 32 MiB per-capture bitmap cap.
   • Indexes aggregated vulnerability and exploit pivots in the web UI.
   • Includes database notices in every archive path.

   +1 more show less

   • Tests NETCAP against a checksum-pinned Wireshark sample corpus of 22 representative pcap/pcapng captures (including all nine PROTOS robustness captures) via make test-wireshark.
   • Prefilters audit streams with Community ID bitmaps, enabling fast record selection without full-file scans.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Indexes certificate and timeline correlation facets, including exact host=<ip> and repeatable communityId=<value> timeline facets with per-track postings, cursor pagination, nearest-event lookup, and duration overlap; falls back to exact scanning above a 32 MiB per-capture bitmap cap.
   • Indexes aggregated vulnerability and exploit pivots in the web UI.
   • Tests NETCAP against a checksum-pinned Wireshark sample corpus of 22 representative pcap/pcapng captures (including all nine PROTOS robustness captures) via make test-wireshark.

   2 more in Everything

5. v0.9.13 Sep 24, 2026 · issue 085

   Netcap v0.9.13 adds a DNP3DNP3A serial and TCP/IP communication protocol used in industrial control systems, especially power grids and water utilities, to let control software poll and command field devices like sensors and switches. point-map flag, per-message timestamps, and a fully rewritten DNP3 decoder for ICSICSIndustrial Control Systems — hardware and software that monitor and control physical processes like power grids, pipelines, and manufacturing lines, making them a target for cyber tools focused on operational technology environments. traffic.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v0.9.13 https://github.com/dreadl0ck/netcap.git
   # already have the repo? check out this version:
   $ git checkout v0.9.13

   └──▷ TRY IT
   Resolve raw DNP3 point indexes to named tags during capture of an OT network PCAPPCAPA packet capture, recorded network packets that can be inspected later. Analysts use it to reconstruct communication and investigate protocol behavior or suspicious traffic. — useful when correlating alerts to specific field devices.
   copy

   $ net capture -read ot-traffic.pcap --dnp3-point-map points.csv

   Do the same on a live interface with the point map supplied via environment variable, e.g. in a containerised sensor deployment.
   copy

   $ NC_DNP3_POINT_MAP=/etc/netcap/points.csv sudo net capture -iface eth0

   • Adds --dnp3-point-map flag (env NC_DNP3_POINT_MAP) to net capture, accepting a CSV of outstation, group, index, and name to resolve DNP3 point indexes to human-readable labels.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Adds util -decoders now reports every stream decoder, covering all 40+ registered decoders instead of a partial list.
   • Timestamps each FTP, IMAP, and IRC message from the individual packet that carried it, rather than from the connection.
   • Timestamps each HTTP request and response individually, rather than once per connection.
   • Gives IEC 62351 records their own per-record timestamp and traffic direction across all four decoding paths.

   +3 more show less

   • Rewrites the DNP3 decoder to produce only frames and objects actually present in captured traffic.
   • Improves decoder selection to pick the decoder that required the most evidence rather than the one bound to the lowest port number.
   • Validates full TACACS+ and SSH signatures including confusable edge cases.
   • Adds --dnp3-point-map flag (env NC_DNP3_POINT_MAP) to net capture, accepting a CSV of outstation, group, index, and name to resolve DNP3 point indexes to human-readable labels.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   7 more in Everything

6. v0.9.1 Sep 20, 2026 · issue 081

   Netcap v0.9.1 adds an MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. server for LLMLLMA large language model, a neural network trained on large amounts of text to recognize patterns and generate language. Applications use it for tasks such as answering, summarizing and writing code.-driven PCAPPCAPA packet capture, recorded network packets that can be inspected later. Analysts use it to reconstruct communication and investigate protocol behavior or suspicious traffic. analysis, ModbusModbusA serial communication protocol originally developed by Modicon in 1979 for connecting programmable logic controllers, now widely used in industrial control systems; cyber tools target it to monitor or interact with OT environments. threat-hunting rules, S7comm OT detection, and Hyperscan acceleration.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v0.9.1 https://github.com/dreadl0ck/netcap.git
   # already have the repo? check out this version:
   $ git checkout v0.9.1

   └──▷ TRY IT
   Hunt for unauthorized S7comm operations (logic download, PLC stop) on an OT network PCAP, with an allowlist of known-good engineering workstations to suppress false positives.
   copy

   $ ./net capture -read ot-traffic.pcap --rules rules/examples/s7comm_hunt.yml --approved-workstations 10.0.1.50,10.0.1.51

   Start service mode and preload a directory of historical PCAPsPCAPsA packet capture, recorded network packets that can be inspected later. Analysts use it to reconstruct communication and investigate protocol behavior or suspicious traffic. for immediate LLM-driven analysis via the MCP server.
   copy

   $ ./net capture --service --service-preload-dir /data/forensics/pcaps

   • Adds --modbus-rtu-endpoints flag (env: NC_MODBUS_RTU_ENDPOINTS) to specify a comma-separated allowlist of RTU-over-TCPTCPA network protocol that delivers a reliable, ordered stream of bytes between two endpoints. It detects lost data and retransmits it. destinations (IP:port or [IPv6IPv6The current version of the Internet Protocol, standardized by the IETF, using 128-bit addresses to replace the exhausted IPv4 space. Cyber tools target it because modern networks run dual-stack or IPv6-only.]:port) for Modbus RTU stream decoding.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Adds --service-preload-dir flag (env: NC_SERVICE_PRELOAD_DIR) to specify a directory of PCAPs to preload when running in service mode (defaults to <service-data-dir>/pcaps).
   • Adds --approved-workstations flag for loading an approved-workstation allowlist used by detection rules via the IsApprovedWorkstation expression helper.
   • Adds an MCP (Model Context ProtocolModel Context ProtocolModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface.) server for LLM-driven PCAP analysis, exposing tools including query_audit_records, get_chart_data, extract_iocs_from_file, get_image_exif, lookup_cve, resolve, lookup_dhcp_fingerprint, get_live_capture_status, stop_live_capture, delete_session, and wait_for_session.
   • Adds lookup_cve MCP tool that fetches real NVDNVDThe National Vulnerability Database, maintained by NIST, is the U.S. government repository of CVE records enriched with CVSS scores and metadata; cyber tools query it to drive vulnerability prioritization. vulnerability data with caching.

   +17 more show less

   • Adds netcap://session/{id}/graph MCP resource for session graph access.
   • Adds Prometheus metrics endpoint at /mcp/metrics for the MCP server.
   • Adds ?sessionId / ?inputFile query parameters for per-request session selection across the web UI and MCP server.
   • Adds source-to-distinct-destination cardinality (fan-out) detection and record-time thresholds to the detection rule engine.
   • Adds IsBusinessHours and HourOfDay time-of-day helpers to the detection rule expression engine.
   • Adds GeoIPGeoIPA database that maps IP addresses to geographic locations; tools use it to attribute traffic or alerts to countries, cities, or ASNs without querying external services. enrichment to Connection records.
   • Adds OT/ICSICSIndustrial Control Systems — hardware and software that monitor and control physical processes like power grids, pipelines, and manufacturing lines, making them a target for cyber tools focused on operational technology environments. threat-hunting rules for Siemens S7commSiemens S7commA Siemens industrial protocol used by SIMATIC S7 PLCs to exchange programming, diagnostic, and process data, giving cyber tools a way to inspect or interact with Siemens automation networks. mapped to CISA AA26-231A, covering write, logic download, logic theft, PLC stop, and CPUCPUThe main general-purpose processor in a computer. It runs application instructions and coordinates work with memory and other hardware. restart function codes; ships rules/examples/s7comm_hunt.yml.
   • Adds S7CommPlus cleartext framing parsing and a PayloadObscured flag to the S7comm stream decoder.
   • Adds structured Modbus PDU decoding with threat-hunting rules covering all remaining Modbus function codes, pairing reads with writes via ordered correlation.
   • Adds optional Hyperscan/Vectorscan prefilter for nmap service probes (~2.2× faster), CMSCMSA web content management system for creating and managing digital content without writing code directly; cyber tools use CMS platforms to host documentation, portals, or reporting dashboards quickly./web framework detection (~1.4×), and the rule-engine MatchesPattern operator (up to ~6× on miss-heavy traffic); build with -tags hyperscan.
   • Adds NC_DBS_SKIP_SOURCES environment variable to skip specific data sources during database rebuild.
   • Adds a /health readiness endpoint to the database (dbs) HTTP listener, available before the initial rebuild completes.
   • Adds configurable dashboard landing page with built-in security views to the web UI.
   • Adds server-side filter, sort, and pagination plus a per-row community-ID cap to the /api/fingerprints endpoint.
   • Adds 19 fuzz targets for packet and stream parsers.
   • Adds worker-owned TCP pools, replacing the global assembly lock with per-worker pool ownership for concurrent capture.
   • Makes offline capture output deterministic: the same PCAP now produces identical audit records across runs.
   • Adds --modbus-rtu-endpoints flag (env: NC_MODBUS_RTU_ENDPOINTS) to specify a comma-separated allowlist of RTU-over-TCPTCPA network protocol that delivers a reliable, ordered stream of bytes between two endpoints. It detects lost data and retransmits it. destinations (IP:port or [IPv6IPv6The current version of the Internet Protocol, standardized by the IETF, using 128-bit addresses to replace the exhausted IPv4 space. Cyber tools target it because modern networks run dual-stack or IPv6-only.]:port) for Modbus RTU stream decoding.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Adds --service-preload-dir flag (env: NC_SERVICE_PRELOAD_DIR) to specify a directory of PCAPs to preload when running in service mode (defaults to <service-data-dir>/pcaps).
   • Adds --approved-workstations flag for loading an approved-workstation allowlist used by detection rules via the IsApprovedWorkstation expression helper.
   • Adds an MCP (Model Context ProtocolModel Context ProtocolModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface.) server for LLM-driven PCAP analysis, exposing tools including query_audit_records, get_chart_data, extract_iocs_from_file, get_image_exif, lookup_cve, resolve, lookup_dhcp_fingerprint, get_live_capture_status, stop_live_capture, delete_session, and wait_for_session.
   • Adds lookup_cve MCP tool that fetches real NVDNVDThe National Vulnerability Database, maintained by NIST, is the U.S. government repository of CVE records enriched with CVSS scores and metadata; cyber tools query it to drive vulnerability prioritization. vulnerability data with caching.

   +9 more show less

   • Adds netcap://session/{id}/graph MCP resource for session graph access.
   • Adds Prometheus metrics endpoint at /mcp/metrics for the MCP server.
   • Adds ?sessionId / ?inputFile query parameters for per-request session selection across the web UI and MCP server.
   • Adds IsBusinessHours and HourOfDay time-of-day helpers to the detection rule expression engine.
   • Adds OT/ICSICSIndustrial Control Systems — hardware and software that monitor and control physical processes like power grids, pipelines, and manufacturing lines, making them a target for cyber tools focused on operational technology environments. threat-hunting rules for Siemens S7commSiemens S7commA Siemens industrial protocol used by SIMATIC S7 PLCs to exchange programming, diagnostic, and process data, giving cyber tools a way to inspect or interact with Siemens automation networks. mapped to CISA AA26-231A, covering write, logic download, logic theft, PLC stop, and CPUCPUThe main general-purpose processor in a computer. It runs application instructions and coordinates work with memory and other hardware. restart function codes; ships rules/examples/s7comm_hunt.yml.
   • Adds optional Hyperscan/Vectorscan prefilter for nmap service probes (~2.2× faster), CMSCMSA web content management system for creating and managing digital content without writing code directly; cyber tools use CMS platforms to host documentation, portals, or reporting dashboards quickly./web framework detection (~1.4×), and the rule-engine MatchesPattern operator (up to ~6× on miss-heavy traffic); build with -tags hyperscan.
   • Adds NC_DBS_SKIP_SOURCES environment variable to skip specific data sources during database rebuild.
   • Adds a /health readiness endpoint to the database (dbs) HTTP listener, available before the initial rebuild completes.
   • Adds 19 fuzz targets for packet and stream parsers.

   8 more in Everything

7. v0.9.0 Apr 9, 2026 · release notes

   Netcap v0.9.0 adds a protobuf wire-format stream decoder, YARA and Magika support, device enrichment, and additional protocol coverage.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v0.9.0 https://github.com/dreadl0ck/netcap.git
   # already have the repo? check out this version:
   $ git checkout v0.9.0

   • Adds generic protobuf wire format stream decoder for dissecting protobuf-encoded traffic.
   • Adds YARA and Magika support for file-type identification and malware detection in captured traffic.
   • Adds device enrichment with discovery fields and refined credential harvesters.
   • Supports additional protocols for broader network traffic classification.
   • Adds software report generation.

   +1 more show less

   • Provides pre-built binaries with Deep Packet Inspection (nDPInDPIAn open-source deep packet inspection library maintained by ntop that classifies network traffic by protocol and application, giving cyber tools visibility into what flows are actually carrying beyond port numbers./libprotoident) for macOS ARM64ARM64The 64-bit instruction set architecture from ARM Holdings, used in modern mobile chips, Apple Silicon, and cloud server CPUs; tools target it to run natively on those platforms without emulation overhead. and Linux AMD64 (glibc and musl), plus DPI-free builds including Windows AMD64.

   6 details in Everything

8. v0.7.6 Oct 25, 2025 · release notes

   Netcap v0.7.6 adds per-execution performance metrics, TCPTCPA network protocol that delivers a reliable, ordered stream of bytes between two endpoints. It detects lost data and retransmits it. stream size limits, and multi-file processing summaries.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v0.7.6 https://github.com/dreadl0ck/netcap.git
   # already have the repo? check out this version:
   $ git checkout v0.7.6

   • Adds extensive performance metrics and a performance.log file written on every execution, with improved error handling and feedback.
   • Adds stream size limits for TCP reassembly to bound memory consumption during large captures.
   • Adds a summary table at the end of multi-file processing runs, with panic catching and logging to file.
   • Adds a Windows AMD64 build (no-DPI), expanding platform support beyond macOS and Linux.
   • Adds musl-based Linux builds for Alpine Linux and minimal container environments.

   5 details in Everything

9. v0.7.5 Oct 25, 2025 · release notes

   Netcap v0.7.5 adds DPI results for more record types, a decoder tree view, wildcard multi-file input, and a new dpi-modules flag.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v0.7.5 https://github.com/dreadl0ck/netcap.git
   # already have the repo? check out this version:
   $ git checkout v0.7.5

   └──▷ TRY IT
   Inspect all available decoders and their encapsulation hierarchy before deciding what to capture or filter.
   copy

   $ net util -decoders

   • Adds DPI results to additional audit record types, broadening protocol/application classification coverage beyond previously supported records.
   • New --dpi-modules flag lets practitioners configure which DPI frameworks (nDPInDPIAn open-source deep packet inspection library maintained by ntop that classifies network traffic by protocol and application, giving cyber tools visibility into what flows are actually carrying beyond port numbers., libprotoident, etc.) are used during analysis.
   • New net util -decoders subcommand displays an overview of all available decoders and their encapsulation levels, including a tree view.
   • Supports providing multiple input PCAPPCAPA packet capture, recorded network packets that can be inspected later. Analysts use it to reconstruct communication and investigate protocol behavior or suspicious traffic./audit files via wildcard or shell expansion for batch processing.
   • Populates IPProfile.Applications field with DPI-derived application data.

   +1 more show less

   • CSV output now uses semicolon as the default field separator, with commas used to separate multi-values within a field.

   6 details in Everything

   └──▷ BREAKING ON UPGRADE

   • !The CSV default separator is changed to semicolon (previously comma); pipelines or scripts parsing netcap CSV output with comma delimiters will break.
10. v0.7.0 Oct 22, 2025 · release notes

    Netcap v0.7.0 integrates a DB hosting server, daily IOCIOCAn indicator of compromise, an observable clue that may point to malicious activity, such as a suspicious file hash or domain. It is evidence to investigate, rather than proof by itself. feeds from dbs.netcap.io, and upgrades nDPInDPIAn open-source deep packet inspection library maintained by ntop that classifies network traffic by protocol and application, giving cyber tools visibility into what flows are actually carrying beyond port numbers. to v4.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.7.0 https://github.com/dreadl0ck/netcap.git
    # already have the repo? check out this version:
    $ git checkout v0.7.0

    └──▷ TRY IT
    Pull the latest IOC databases from dbs.netcap.io before a threat-hunting session so detections are up to date.
    copy

    $ net util -download-dbs

    • Adds integrated DB hosting server into the netcap binary; databases are now served from dbs.netcap.io by default and regenerated daily with the latest IOCsIOCsAn indicator of compromise, an observable clue that may point to malicious activity, such as a suspicious file hash or domain. It is evidence to investigate, rather than proof by itself..
    • New net util -download-dbs command to pull the latest IOC databases on demand.
    • Supports self-hosted DB generation service as an alternative to the default dbs.netcap.io.
    • Upgrades nDPI from v3 to v4 (v4.14) with updated go-dpi bindings and libprotoident, expanding deep packet inspection coverage.
    • Switches from the unmaintained dreadl0ck/gopacket fork to the actively maintained gopacket/gopacket fork.

    5 details in Everything

11. v0.6.7 Jan 22, 2022 · release notes

    Netcap v0.6.7 adds the publish-module subcommand.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.6.7 https://github.com/dreadl0ck/netcap.git
    # already have the repo? check out this version:
    $ git checkout v0.6.7

    └──▷ TRY IT
    Publish a custom module package for distribution.
    copy

    $ netcap publish-module <module_path>

    • Adds publish-module command to the CLI.

    1 detail in Everything

12. v0.6.6 Sep 16, 2021 · release notes

    Adds license-scan report and status output to Netcap

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.6.6 https://github.com/dreadl0ck/netcap.git
    # already have the repo? check out this version:
    $ git checkout v0.6.6

    • Add license scan report and status

    1 detail in Everything

13. v0.6.1 Aug 22, 2021 · release notes

    Netcap v0.6.1 adds support for reading Linux SLL PCAPPCAPA packet capture, recorded network packets that can be inspected later. Analysts use it to reconstruct communication and investigate protocol behavior or suspicious traffic. files

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.6.1 https://github.com/dreadl0ck/netcap.git
    # already have the repo? check out this version:
    $ git checkout v0.6.1

    • Adds LinkTypeLinuxSLL PCAP file support to the capture engine

    1 detail in Everything

14. v0.4.4 Feb 24, 2020 · release notes

    New -list-interfaces flag for live capture tools and configurable buffer size via membuf.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.4.4 https://github.com/dreadl0ck/netcap.git
    # already have the repo? check out this version:
    $ git checkout v0.4.4

    • Adds -list-interfaces flag to all live capture tools in Netcap
    • Makes encoder buffer size configurable via membuf parameter with a new default of 10MB

    2 details in Everything

15. v0.4.3 Feb 17, 2020 · release notes

    Netcap v0.4.3 adds ENIP and Common Industrial Protocol (CIP) capture support

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.4.3 https://github.com/dreadl0ck/netcap.git
    # already have the repo? check out this version:
    $ git checkout v0.4.3

16. v0.4.2 Nov 12, 2019 · release notes

    Adds JSON dump output flag and audit record context

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.4.2 https://github.com/dreadl0ck/netcap.git
    # already have the repo? check out this version:
    $ git checkout v0.4.2

    └──▷ USE IT
    Dump packet capturespacket capturesA packet capture, recorded network packets that can be inspected later. Analysts use it to reconstruct communication and investigate protocol behavior or suspicious traffic. to a file in JSON format for easier parsing.
    shell copy

    netcap dump --json -o output.json

    • Adds --json flag to the dump tool to output capture data as JSON
    • Includes contextual information in generated audit records

    2 details in Everything

17. v0.4.1 Oct 18, 2019 · release notes

    v0.4.1 adds support for compiling in an Ubuntu Docker container

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.4.1 https://github.com/dreadl0ck/netcap.git
    # already have the repo? check out this version:
    $ git checkout v0.4.1

    └──▷ HOW TO FIND IT
    Build netcap inside an Ubuntu Docker environment instead of the previous default or other OS requirements.
    📍# Requires the updated build scripts/configs included in this release; # usage depends on how the tool exposes its build target, # typically: docker build -t netcap . # (See documentation for specific Dockerfile context)
18. v0.4.0 May 8, 2019 · release notes

    Netcap v0.4.0 introduces static analysis, HTTP reverse proxy, and Prometheus metrics

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.4.0 https://github.com/dreadl0ck/netcap.git
    # already have the repo? check out this version:
    $ git checkout v0.4.0

    • Adds static-analyze command for code analysis
    • Bootstraps net.proxy as an HTTP reverse proxy with audit recording
    • Adds Inc() method to the AuditRecord interface for Prometheus metric counting
    • Updates Ethernet, IP, UDPUDPA network protocol that sends individual messages without guaranteeing delivery or order. Applications trade built-in reliability for less overhead and can add their own recovery., and TCPTCPA network protocol that delivers a reliable, ordered stream of bytes between two endpoints. It detects lost data and retransmits it. metrics to expose payload entropy and size as histograms

    4 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The types.CSV interface is renamed to types.AuditRecord
19. v0.3.9 Jan 17, 2019 · release notes

    Netcap v0.3.9 adds payload capture and configurable CSV separators via CLI flags.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.3.9 https://github.com/dreadl0ck/netcap.git
    # already have the repo? check out this version:
    $ git checkout v0.3.9

    └──▷ USE IT
    Capture full payload data for TCPTCPA network protocol that delivers a reliable, ordered stream of bytes between two endpoints. It detects lost data and retransmits it. packets from a PCAPPCAPA packet capture, recorded network packets that can be inspected later. Analysts use it to reconstruct communication and investigate protocol behavior or suspicious traffic. file
    shell copy

    netcap -r traffic.pcap -payload

    Use non-lazy decoding to prevent potential issues with packet data mutability during processing
    shell copy

    netcap -r traffic.pcap --decode-option default

    • Adds -payload flag to enable payload data capture for TCP, UDPUDPA network protocol that sends individual messages without guaranteeing delivery or order. Applications trade built-in reliability for less overhead and can add their own recovery., ModbusTCP, and USB protocols
    • Adds configurable CSV struct separators via command-line flags, changing the default from parentheses/hyphens to other specified characters
    • Allows setting Gopacket DecodeOptions (lazy, default, nocopy) directly via command-line flag

    3 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The field named *Size* on several audit records structures is renamed to *TotalSize* in the protobuf definitions, breaking compatibility with audit records created with version v0.3.8.
20. v0.3.7 Dec 31, 2018 · release notes

    Netcap v0.3.7 adds VXLANVXLANA network encapsulation protocol that wraps Layer 2 Ethernet frames inside UDP packets, extending virtual LANs across Layer 3 networks. Cyber tools use it to simulate or inspect traffic across large-scale virtualized and cloud environments., IPsecIPsecA suite of IETF protocols that authenticate and encrypt IP packets at the network layer, giving cyber tools a standards-based way to build VPNs or secure host-to-host tunnels without modifying applications., and multiple protocol encoders.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.3.7 https://github.com/dreadl0ck/netcap.git
    # already have the repo? check out this version:
    $ git checkout v0.3.7

    • Adds vxlan support for decoding overlay traffic
    • Adds basic ipsec support for handling IPsec packets
    • Adds support for geneve protocol in initRecord func
    • Adds support for ipv6 fragments
    • Adds BFD encoder implementation

    +9 more show less

    • Adds LCM encoder implementation
    • Adds MPLS encoder implementation
    • Adds VRRPv2 encoder implementation
    • Adds modbusTCP encoder implementation
    • Adds ospf v2 and v3 encoders implementation
    • Adds support for EAP protocol
    • Adds support for FDDI
    • Adds support for GRE protocol
    • Adds support for USB

    14 details in Everything