What problem does it solve? Analyzing packet captures in CTF and forensic scenarios often stalls when analysts reason from isolated packets instead of reconstructed sessions, missing the decoded content and behavioral links that prove the challenge path. ## Core Features & Use Cases - Session Mapping: Groups traffic into sessions by endpoints, ports, TLS handshakes, DNS lookups, and long-lived streams while flagging missing coverage, retransmits, and asymmetric routing. - Protocol Decoding: Reassembles TCP streams and UDP conversations, then recovers framing, message order, custom headers, compression, encryption boundaries, and transferred objects. - Behavior Correlation: Maps packet sequences to host events, malware branches, login flows, uploads, exfiltration steps, or command channels. - Use Case: Given a CTF capture with a suspected custom C2 channel, rebuild the stream, decode the framing and commands, extract the transferred artifact, and prove which packet sequence triggered the host behavior. ## Quick Start Analyze this PCAP file by reconstructing its sessions, decoding the application protocol, and showing which packet sequence proves the challenge behavior.
