Download Latest Version Netcap v0.13.0 -- linked hunting evidence source code.zip (316.1 MB) Google Add to Preferred Sources
Home / v0.10.3
Name Modified Size InfoDownloads / Week
Parent folder
checksums.txt 2026-10-05 855 Bytes
0
netcap-nodpi-v0.10.3-linux-amd64-libc.tar.gz 2026-10-05 29.9 MB
0
netcap-nodpi-v0.10.3-linux-amd64-musl.tar.gz 2026-10-05 29.9 MB
0
netcap-third-party-source-v0.10.3.tar.gz 2026-10-05 225.9 MB
0
netcap-v0.10.3-linux-amd64-libc.tar.gz 2026-10-05 30.0 MB
0
netcap-v0.10.3-linux-amd64-musl.tar.gz 2026-10-05 30.0 MB
0
netcap-nodpi-v0.10.3-darwin-arm64.tar.gz 2026-10-05 32.4 MB
0
netcap-nodpi-v0.10.3-windows-amd64.tar.gz 2026-10-05 34.1 MB
0
netcap-v0.10.3-darwin-arm64.tar.gz 2026-10-05 32.5 MB
0
README.md 2026-10-05 4.3 kB
0
v0.10.3 source code.tar.gz 2026-10-05 311.5 MB
0
v0.10.3 source code.zip 2026-10-05 313.3 MB
0
Totals: 12 Items   1.1 GB 0

Native DPI performance

Uses go-dpi v1.5.0 with worker-owned nDPI contexts, incremental flow state, a ten-observation inspection budget, bounded tracking, and corrected native cleanup. Consecutive duplicate enrichment calls share progress. Small unidentified first packets are replayed once on promotion.

  • Set -dpi-workers (or NC_DPI_WORKERS) to select context count. One context minimizes native memory; automatic mode uses up to eight.
  • LPI + nDPI synthetic DPI microbenchmarks: 10 unidentified packets, 98.75 to 17.42 microseconds/flow; 100 unidentified packets, 1395.57 to 40.53 microseconds/flow. Whole-capture throughput depends on the workload.
  • At one context, the 32768-single-packet probe used 64.7 MiB peak RSS versus 109.1 MiB for the replay baseline. Eight contexts used 126.2 MiB.
  • Results and reproduction: internal/dpi/performance-results.json and zeus/scripts/benchmark-c-dpi.sh.

Upgrade notes

  • Distributed collection has a new TCP/TLS 1.3 wire format, incompatible with v0.10.2 and earlier. Upgrade net agent and net collect together; configure pinned agent identities. See docs/distributed-collection.md.
  • Database downloads now include attributed DB-IP Lite City geolocation; -geoProviders selects the provider set. Upgraded installations are prompted to fetch netcap.sqlite. See docs/resolvers.md.
  • Clean-runner CI passed native build/vet/race tests, optional JA4+ checks, frontend build, and license validation.

📦 Available Builds

Build OS Architecture DPI Support Description
netcap-v0.10.3-darwin-arm64 macOS ARM64 ✅ Yes Full DPI support with nDPI
netcap-v0.10.3-linux-amd64-libc Linux AMD64 ✅ Yes glibc-based with DPI
netcap-v0.10.3-linux-amd64-musl Linux AMD64 ✅ Yes musl-based with DPI (Alpine)
netcap-nodpi-v0.10.3-darwin-arm64 macOS ARM64 ❌ No Static build, no DPI
netcap-nodpi-v0.10.3-linux-amd64-libc Linux AMD64 ❌ No glibc-based, no DPI
netcap-nodpi-v0.10.3-linux-amd64-musl Linux AMD64 ❌ No musl-based, no DPI
netcap-nodpi-v0.10.3-windows-amd64 Windows AMD64 ❌ No Windows build

🔍 Choosing the Right Build

  • With DPI (netcap-*): Choose if you need Deep Packet Inspection features (protocol classification, application detection)
  • Without DPI (netcap-nodpi-*): Choose for basic packet capture and analysis, smaller binary size
  • libc vs musl: Use libc for standard Linux distros (Ubuntu, Debian, CentOS). Use musl for Alpine Linux or minimal containers

Installing on macOS via homebrew

Builds distributed via homebrew are built with DPI support. You need to install the libprotoident and ndpi libraries via homebrew.

  $ brew install libprotoident ndpi
  $ brew tap dreadl0ck/formulas
  $ brew install netcap

Afterwards try running 'net' in your terminal.

📚 Documentation

⚠️ Notes

  • On macOS/Linux, you may need to grant necessary permissions: sudo chmod +x net
  • Live capture requires root/administrator privileges
  • Verify checksums with checksums.txt before use

Changelog

  • e03ac0d9 Bundle DB-IP Lite geolocation with selectable providers and retire unshippable database sources
  • 974bb21e Date the distributed-mode wire break after v0.10.1
  • e8c633a2 Date the distributed-mode wire break after v0.10.2, which kept the old format
  • 887071a8 Fix database prompt grammar and handle unbuilt frontend in embed tests
  • 0354978e Install archive-test dependencies in the CI builder
  • 285c3d23 Make capture corpus tests independent of local probe databases
  • 08b59cfd Optimize native DPI with worker-owned incremental flow state
  • ac2eb834 Prepare v0.10.3 release with go-dpi v1.5.0
  • 1bdcff2a Prompt for netcap.sqlite on installs upgraded from the bleve layout
  • 24f220ae Rebuild distributed mode on mutually authenticated TLS

Full Changelog: https://github.com/dreadl0ck/netcap/compare/v0.10.1...v0.10.3

Source: README.md, updated 2026-10-05