Netcap Files

📦 Available Builds

🔍 Choosing the Right Build

• With DPI (netcap-*): Choose if you need Deep Packet Inspection features (protocol classification, application detection)
• Without DPI (netcap-nodpi-*): Choose for basic packet capture and analysis, smaller binary size
• libc vs musl: Use libc for standard Linux distros (Ubuntu, Debian, CentOS). Use musl for Alpine Linux or minimal containers

Installing on macOS via homebrew

Builds distributed via homebrew are built with DPI support. You need to install the libprotoident and ndpi libraries via homebrew.

  $ brew install libprotoident ndpi
  $ brew tap dreadl0ck/formulas
  $ brew install netcap

Afterwards try running 'net' in your terminal.

📚 Documentation

• Full Documentation
• Installation Guide
• Command Reference

⚠️ Notes

• On macOS/Linux, you may need to grant necessary permissions: sudo chmod +x net
• Live capture requires root/administrator privileges
• Verify checksums with checksums.txt before use

Changelog

• 411c8bab Add book-driven investigation accounting and verifiable evidence exports
• 284ccfd2 Add bounded TLV hypotheses and classified resource experiments
• 9b85c162 Add bounded protocol server, TLS proxy and experiment triage workflows
• e0078ec9 Add byte-exact stream evidence and bounded protocol experiments
• 3ae57c4d Add capture provenance, bounded retention and investigation evidence UI
• ac146265 Add explicit flow windows, distributions and estimated time series
• 1a73c8f8 Add qualified offline TLS session-secret analysis adapter
• 955146fb Add scoped flow export ingestion, health and investigation reports
• c277a903 Add signed sensor-scoped collection imports and retention
• 49637b34 Add strict protocol field hypotheses and stream comparisons
• 7baaf963 Allow direct module downloads when the public proxy refuses CI
• 8d6651af Bundle Ubuntu DPI runtime libraries and smoke-test startup
• e61162e5 Complete FTP data correlation and qualify book network workflows
• 1fd86a38 Complete bounded protocol emulation, isolated mutation and reproduction workflows
• 0965b147 Expose native artifact downloads from shared investigation evidence UI
• e61b5204 Expose routing filters and parser health in investigation interfaces
• 13c16ae5 Expose signed sensor imports and document qualified investigation workflows
• 5e93ea34 Include transitive libtrace dependencies in Ubuntu runtime
• 2ec296c2 Integrate bounded protocol emulation and reproducible experiments
• 4004b987 Integrate qualified NSM book workflows and FTP data extraction
• c7d80255 Keep backpressure qualification portable across TCP receive windows
• 814a78a6 Merge current network detection release into investigation work
• 57f92770 Persist IOC and behavioral qualification alerts through the rules engine
• 2ce5902d Prepare Netcap v0.11.0 investigation release
• ffcba503 Qualify NSM and flow book cases with synthetic packet replay
• 37944eba Qualify all 38 book workflows with scoped integration evidence
• d7d2f838 Qualify paginated recon and export reproducible book case evidence
• 1f590b3b Qualify proxy injection, successful mutations and backpressure
• 92c43dff Resolve retained connection observations by exact snapshot identity
• 21d7328e Retain qualification IOC alerts with portable evidence references

Full Changelog: https://github.com/dreadl0ck/netcap/compare/v0.10.4...v0.11.0