Netcap — The Cyber Toolchain

Netcap v0.13.0

Fri, 09 Oct 2026 18:26:08 GMT

Netcap v0.13.0 adds cross-protocol evidence linking and capture-time DNS context with new CLI flags and a `/api/evidence/related` endpoint.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds `--evidence-links` flag (env `NC_EVIDENCE_LINKS`) to enable/disable cross-protocol evidence linking in the web UI and via `/api/evidence/related`.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds `--dns-resolution-context` flag (env `NC_DNS_RESOLUTION_CONTEXT`) to snapshot matched UDP DNS answers onto Connection records for use in capture-time detection rules. • Adds `--evidence-links-window` flag (env `NC_EVIDENCE_LINKS_WINDOW`, default 1 h) to bound the maximum time between a DNS answer and a connection when linking evidence. • Adds `--evidence-links-max-records` flag (env `NC_EVIDENCE_LINKS_MAX_RECORDS`, default 1,000,000) to cap the number of records indexed per output directory before truncation is reported. • Adds `--evidence-links-max-links` flag (env `NC_EVIDENCE_LINKS_MAX_LINKS`, default 500) to limit related records returned per query. • Adds `GET /api/evidence/related` API endpoint and `net investigate related` subcommand to retrieve cross-protocol evidence timelines linking DNS, connections, protocol records and alerts. • Adds `Settings → Features` UI panel to toggle evidence linking and network detections independently at runtime. • Binds related-evidence references to audit-file content hashes and enforces capture interface/VLAN scope and bounded time windows, withholding ambiguous joins instead of guessing. • Enforces per-directory index and result limits that report truncation when exceeded. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/netcap

Netcap v0.10.3

Mon, 05 Oct 2026 22:09:03 GMT

Netcap v0.10.3 ships faster native DPI with worker-owned nDPI contexts, bundled DB-IP Lite geolocation, and a rebuilt mutual-TLS 1.3 distributed collection wire format.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds `-dpi-workers` flag (env `NC_DPI_WORKERS`) to set the number of worker-owned nDPI contexts; one context minimizes native memory, automatic mode uses up to eight.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds `-geoProviders` flag to select among bundled geolocation providers (e.g. `dbip,geolite2`); DB-IP Lite City data is now included in database downloads. • Adds `net agent -gen-keypair` flag (env `NC_GEN_KEYPAIR`) to write a new agent certificate and key and print its fingerprint, replacing the former `gen-config` flow. • Adds `net agent -cert` (env `NC_CERT`, default `agent.crt`), `-key` (env `NC_KEY`, default `agent.key`), and `-server-fingerprint` (env `NC_SERVER_FINGERPRINT`) flags for pinned mutual-TLS 1.3 agent identity in distributed capture. • Adds `-flush-interval` (env `NC_FLUSH_INTERVAL`, default 5s) and `-max-pending` (env `NC_MAX_PENDING`) flags to the agent subcommand for batching control over the new TLS wire format. • Upgrades native DPI to go-dpi v1.5.0 with incremental per-worker flow state and a ten-observation inspection budget, reducing microbenchmark latency from 98.75 µs to 17.42 µs per flow (10-packet case). Breaking changes: • Distributed collection uses a new TCP/TLS 1.3 wire format incompatible with v0.10.2 and earlier — `net agent` and `net collect` must be upgraded together. • The `gen-config` / `NC_GEN_CONFIG` agent flag is removed; use `gen-keypair` / `NC_GEN_KEYPAIR` instead, and configure pinned agent identities with `-cert`, `-key`, and `-server-fingerprint`. • Upgraded installations are prompted to fetch `netcap.sqlite` because database downloads now use the DB-IP Lite layout, replacing the previous bleve-based database sources. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/netcap

Netcap v0.10.0

Sun, 04 Oct 2026 19:49:52 GMT

Netcap v0.10.0 replaces bleve vulnerability indexes with a single SQLite+FTS5 database, cutting disk use from 4.1 GB to 299 MB.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Switches vulnerability and exploit lookups from `nvd.bleve` and `exploit-db.bleve` to a single `netcap.sqlite` (SQLite + FTS5) database, shrinking disk usage from ~4.1 GB to 299 MB.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds `net util -download-dbs` to fetch the new layout 2 database from `https://dbs.netcap.io/dbs/v2/` with sha256 verification. • Updates `net util -index` to accept any value (e.g. `-index all`) and rebuild `netcap.sqlite` from NVD and exploit-db feeds via the new `BuildVulnDB` path. • Results are now capped at 10 hits ordered by BM25 score, replacing bleve's score-threshold filtering. Breaking changes: • Vulnerability database format changed: `nvd.bleve` and `exploit-db.bleve` are no longer read; you must run `net util -download-dbs` after upgrading to fetch the new `netcap.sqlite` (layout 2) from `https://dbs.netcap.io/dbs/v2/`. • The `https://dbs.netcap.io/dbs/latest` endpoint now serves a frozen bleve revision and is no longer rebuilt; netcap v0.10+ must use the v2 URL. • `net util -index` no longer calls `IndexData`; it now calls `BuildVulnDB` and rebuilds `netcap.sqlite` — passing a specific index name has no effect; any value (e.g. `-index all`) rebuilds both NVD and exploit-db. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/netcap

Netcap v0.9.15

Sun, 27 Sep 2026 14:33:03 GMT

Netcap v0.9.15 adds Roaring bitmap indexes for Community ID, certificate, fingerprint, and timeline facets — cutting filtered counts from ~2.6 ms to ~29 µs.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Prefilters audit streams with Community ID bitmaps, enabling fast record selection without full-file scans.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Reuses Roaring indexes for multi-ID records and fingerprints across the table, menu, and four charts via generation-checked snapshots. • Indexes certificate and timeline correlation facets, including exact `host=` and repeatable `communityId=` timeline facets with per-track postings, cursor pagination, nearest-event lookup, and duration overlap; falls back to exact scanning above a 32 MiB per-capture bitmap cap. • Indexes aggregated vulnerability and exploit pivots in the web UI. • Includes database notices in every archive path. • Tests NETCAP against a checksum-pinned Wireshark sample corpus of 22 representative pcap/pcapng captures (including all nine PROTOS robustness captures) via `make test-wireshark`. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/netcap

Netcap v0.9.13

Thu, 24 Sep 2026 21:53:25 GMT

Netcap v0.9.13 adds a DNP3 point-map flag, per-message timestamps, and a fully rewritten DNP3 decoder for ICS traffic.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds `--dnp3-point-map` flag (env `NC_DNP3_POINT_MAP`) to `net capture`, accepting a CSV of outstation, group, index, and name to resolve DNP3 point indexes to human-readable labels.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds `util -decoders` now reports every stream decoder, covering all 40+ registered decoders instead of a partial list. • Timestamps each FTP, IMAP, and IRC message from the individual packet that carried it, rather than from the connection. • Timestamps each HTTP request and response individually, rather than once per connection. • Gives IEC 62351 records their own per-record timestamp and traffic direction across all four decoding paths. • Rewrites the DNP3 decoder to produce only frames and objects actually present in captured traffic. • Improves decoder selection to pick the decoder that required the most evidence rather than the one bound to the lowest port number. • Validates full TACACS+ and SSH signatures including confusable edge cases. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/netcap

Netcap v0.9.1

Sun, 20 Sep 2026 21:15:57 GMT

Netcap v0.9.1 adds an MCP server for LLM-driven PCAP analysis, Modbus threat-hunting rules, S7comm OT detection, and Hyperscan acceleration.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds `--modbus-rtu-endpoints` flag (env: `NC_MODBUS_RTU_ENDPOINTS`) to specify a comma-separated allowlist of RTU-over-TCP destinations (IP:port or [IPv6]:port) for Modbus RTU stream decoding.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds `--service-preload-dir` flag (env: `NC_SERVICE_PRELOAD_DIR`) to specify a directory of PCAPs to preload when running in service mode (defaults to `/pcaps`). • Adds `--approved-workstations` flag for loading an approved-workstation allowlist used by detection rules via the `IsApprovedWorkstation` expression helper. • Adds an MCP (Model Context Protocol) server for LLM-driven PCAP analysis, exposing tools including `query_audit_records`, `get_chart_data`, `extract_iocs_from_file`, `get_image_exif`, `lookup_cve`, `resolve`, `lookup_dhcp_fingerprint`, `get_live_capture_status`, `stop_live_capture`, `delete_session`, and `wait_for_session`. • Adds `lookup_cve` MCP tool that fetches real NVD vulnerability data with caching. • Adds `netcap://session/{id}/graph` MCP resource for session graph access. • Adds Prometheus metrics endpoint at `/mcp/metrics` for the MCP server. • Adds `?sessionId` / `?inputFile` query parameters for per-request session selection across the web UI and MCP server. • Adds source-to-distinct-destination cardinality (fan-out) detection and record-time thresholds to the detection rule engine. • Adds `IsBusinessHours` and `HourOfDay` time-of-day helpers to the detection rule expression engine. • Adds GeoIP enrichment to Connection records. • Adds OT/ICS threat-hunting rules for Siemens S7comm mapped to CISA AA26-231A, covering write, logic download, logic theft, PLC stop, and CPU restart function codes; ships `rules/examples/s7comm_hunt.yml`. • Adds S7CommPlus cleartext framing parsing and a `PayloadObscured` flag to the S7comm stream decoder. • Adds structured Modbus PDU decoding with threat-hunting rules covering all remaining Modbus function codes, pairing reads with writes via ordered correlation. • Adds optional Hyperscan/Vectorscan prefilter for nmap service probes (~2.2× faster), CMS/web framework detection (~1.4×), and the rule-engine `MatchesPattern` operator (up to ~6× on miss-heavy traffic); build with `-tags hyperscan`. • Adds `NC_DBS_SKIP_SOURCES` environment variable to skip specific data sources during database rebuild. • Adds a `/health` readiness endpoint to the database (`dbs`) HTTP listener, available before the initial rebuild completes. • Adds configurable dashboard landing page with built-in security views to the web UI. • Adds server-side filter, sort, and pagination plus a per-row community-ID cap to the `/api/fingerprints` endpoint. • Adds 19 fuzz targets for packet and stream parsers. • Adds worker-owned TCP pools, replacing the global assembly lock with per-worker pool ownership for concurrent capture. • Makes offline capture output deterministic: the same PCAP now produces identical audit records across runs. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/netcap

Netcap v0.9.0

Thu, 09 Apr 2026 21:27:52 GMT

Netcap v0.9.0 adds a protobuf wire-format stream decoder, YARA and Magika support, device enrichment, and additional protocol coverage. • Adds generic protobuf wire format stream decoder for dissecting protobuf-encoded traffic. • Adds YARA and Magika support for file-type identification and malware detection in captured traffic. • Adds device enrichment with discovery fields and refined credential harvesters. • Supports additional protocols for broader network traffic classification. • Adds software report generation. • Provides pre-built binaries with Deep Packet Inspection (nDPI/libprotoident) for macOS ARM64 and Linux AMD64 (glibc and musl), plus DPI-free builds including Windows AMD64. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/netcap

Netcap v0.7.6

Sat, 25 Oct 2025 16:52:25 GMT

Netcap v0.7.6 adds per-execution performance metrics, TCP stream size limits, and multi-file processing summaries. • Adds extensive performance metrics and a `performance.log` file written on every execution, with improved error handling and feedback. • Adds stream size limits for TCP reassembly to bound memory consumption during large captures. • Adds a summary table at the end of multi-file processing runs, with panic catching and logging to file. • Adds a Windows AMD64 build (no-DPI), expanding platform support beyond macOS and Linux. • Adds musl-based Linux builds for Alpine Linux and minimal container environments. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/netcap

Netcap v0.7.5

Sat, 25 Oct 2025 00:06:17 GMT

Netcap v0.7.5 adds DPI results for more record types, a decoder tree view, wildcard multi-file input, and a new dpi-modules flag. • Adds DPI results to additional audit record types, broadening protocol/application classification coverage beyond previously supported records. • New `--dpi-modules` flag lets practitioners configure which DPI frameworks (nDPI, libprotoident, etc.) are used during analysis. • New `net util -decoders` subcommand displays an overview of all available decoders and their encapsulation levels, including a tree view. • Supports providing multiple input PCAP/audit files via wildcard or shell expansion for batch processing. • Populates `IPProfile.Applications` field with DPI-derived application data. • CSV output now uses semicolon as the default field separator, with commas used to separate multi-values within a field. Breaking changes: • The CSV default separator is changed to semicolon (previously comma); pipelines or scripts parsing netcap CSV output with comma delimiters will break. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/netcap

Netcap v0.7.0

Wed, 22 Oct 2025 23:38:15 GMT

Netcap v0.7.0 integrates a DB hosting server, daily IOC feeds from dbs.netcap.io, and upgrades nDPI to v4. • Adds integrated DB hosting server into the netcap binary; databases are now served from dbs.netcap.io by default and regenerated daily with the latest IOCs. • New `net util -download-dbs` command to pull the latest IOC databases on demand. • Supports self-hosted DB generation service as an alternative to the default dbs.netcap.io. • Upgrades nDPI from v3 to v4 (v4.14) with updated go-dpi bindings and libprotoident, expanding deep packet inspection coverage. • Switches from the unmaintained dreadl0ck/gopacket fork to the actively maintained gopacket/gopacket fork. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/netcap

Netcap v0.6.7

Sat, 22 Jan 2022 15:41:00 GMT

Netcap v0.6.7 adds the `publish-module` subcommand. • Adds `publish-module` command to the CLI. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/netcap