Download Latest Version
Netcap v0.13.0 -- linked hunting evidence source code.zip (316.1 MB)
Add to Preferred Sources
| Name | Modified | Size | Downloads / Week |
|---|---|---|---|
| Parent folder | |||
| checksums.txt | 2026-10-07 | 855 Bytes | |
| netcap-third-party-source-v0.10.4.tar.gz | 2026-10-07 | 225.9 MB | |
| netcap-nodpi-v0.10.4-linux-amd64-libc.tar.gz | 2026-10-07 | 30.1 MB | |
| netcap-nodpi-v0.10.4-linux-amd64-musl.tar.gz | 2026-10-07 | 30.1 MB | |
| netcap-nodpi-v0.10.4-darwin-arm64.tar.gz | 2026-10-07 | 33.3 MB | |
| netcap-nodpi-v0.10.4-windows-amd64.tar.gz | 2026-10-07 | 35.0 MB | |
| netcap-v0.10.4-darwin-arm64.tar.gz | 2026-10-07 | 33.4 MB | |
| netcap-v0.10.4-linux-amd64-libc.tar.gz | 2026-10-07 | 30.1 MB | |
| netcap-v0.10.4-linux-amd64-musl.tar.gz | 2026-10-07 | 30.1 MB | |
| Netcap v0.10.4 -- FlightSim-qualified network detections source code.tar.gz | 2026-10-07 | 314.0 MB | |
| Netcap v0.10.4 -- FlightSim-qualified network detections source code.zip | 2026-10-07 | 315.8 MB | |
| README.md | 2026-10-07 | 1.1 kB | |
| Totals: 12 Items | 1.1 GB | 0 | |
Adds bounded capture-time DNS DGA/tunneling, ICMP tunneling, TCP scans, SMTP fan-out, SSH transfer/nonstandard-port and protocol/policy findings, with versioned destination intelligence and analyst evidence. All 15 pinned FlightSim scenarios are qualified from an egress-disabled lab at 1/2/4/8 workers. C2 intelligence requires configured indicators; encrypted contents and malicious intent are not inferred. Shared UI 0.10.0 is published separately.
Includes macOS ARM64 DPI/no-DPI, Linux AMD64 glibc/musl DPI/no-DPI, Windows AMD64 no-DPI and corresponding third-party sources; verify checksums.txt. DPI binaries require their native dependencies. Hosted CI could not start due to the GitHub billing lock; artifacts were built and checked locally.
For the Ubuntu DPI container use dreadl0ck/netcap:ubuntu-v0.10.4-r1 (digest sha256:22024914ee98b65331863e2732fd125350a44a833628f3d9f5b6f0668de9e81e). The original ubuntu-v0.10.4 image omitted libprotoident/libtrace runtime dependencies; r1 includes the complete dependency chain and passes startup smoke testing. Published archives and the original versioned image were not overwritten.
