Netcap Files

Netcap v0.12.0 adds capture-time hunting evidence: fields and views that answer common hunts directly, without post-processing.

What's new

• DNS transaction pairing. DNS records carry TransactionStatus (query, retransmission, answered, late, unsolicited, reordered), RTT and QueryTransmissions. Use them to find slow or failing resolvers, retried lookups and queries that were never answered. Queries and responses are matched by endpoints, DNS ID and first question name/type/class, separately for each capture context and VLAN, with bounded state.
• DNS over TCP. A new stream decoder parses DNS over TCP, including messages split across segments or packed together in one segment. These messages get the same pairing fields as UDP.
• DCE/RPC operations and outcomes. Requests, responses and faults carry ContextID, the interface, OperationName and FaultStatus. Hunt on the remote call that was made, such as directory replication or service creation, and on whether it failed. Attribution follows the order in which data was delivered and stops at stream gaps rather than guessing.
• Periodic connection detection (c2.beacon). This network detection flags a source that opens connections to the same service at regular intervals. Defaults: the latest 8 connection starts, a mean interval of at least 10 s and jitter ≤ 0.1, within 1 h. Retransmitted SYNs are ignored, and the alert shows the measured interval and jitter. Updates and monitoring traffic are also periodic, so treat an alert as a lead.
• Producer–consumer ratio. Connection records carry ProducerConsumerRatio, a value from -1 to 1 that shows whether a host mostly sent (uploads, staging) or mostly received data.
• More precise rules.
• The bundled DCE/RPC rules now match specific operations: DCSync, SAMR account enumeration, remote service and scheduled-task creation, and remote registry writes.
• After Hours Data Transfer now applies its business-hours condition.
• Two rules are renamed to describe what they actually measure: Symmetric External Connection and DNS Multi-Question Message.
• Web UI.
• Domains shows median RTT and counts of retried, late, unanswered and reordered queries for each domain.
• Connections shows the producer–consumer ratio.
• Alerts shows the beacon measurements.

New protobuf fields are appended (DNS 33–35, DCERPC 17–20, Connection 64), so existing audit records still decode unchanged.

Docker images: dreadl0ck/netcap:alpine-v0.12.0, dreadl0ck/netcap:ubuntu-v0.12.0. The @dreadl0ck/netcap-ui 0.12.0 package contains the new views.

📦 Available Builds

🔍 Choosing the Right Build

• With DPI (netcap-*): Choose if you need Deep Packet Inspection features (protocol classification, application detection)
• Without DPI (netcap-nodpi-*): Choose for basic packet capture and analysis, smaller binary size
• libc vs musl: Use libc for standard Linux distros (Ubuntu, Debian, CentOS). Use musl for Alpine Linux or minimal containers

Installing on macOS via homebrew

Builds distributed via homebrew are built with DPI support. You need to install the libprotoident and ndpi libraries via homebrew.

  $ brew install libprotoident ndpi
  $ brew tap dreadl0ck/formulas
  $ brew install netcap

Afterwards try running 'net' in your terminal.

📚 Documentation

• Full Documentation
• Installation Guide
• Command Reference

⚠️ Notes

• On macOS/Linux, you may need to grant necessary permissions: sudo chmod +x net
• Live capture requires root/administrator privileges
• Verify checksums with checksums.txt before use

Full Changelog: https://github.com/dreadl0ck/netcap/compare/v0.11.0...v0.12.0