DRAGNET · Field Instrument FI-123 · version 1.5.0
An offline reader for packet captures. Open a file, drag the net along the capture, and read what the traffic was doing.
Since v1.1 it rebuilds TCP streams and IP fragments rather than reading one segment at a time, and since v1.2 it reads radiotap and 802.11, which is what lets it read a capture taken off the air.
v1.3 stopped dissecting the whole file. The reader walks the headers once to learn shape and time, and full dissection happens only for what is inside the net, which is what lets a capture of several million packets open at all. Several files can be dropped at once and are read as one timeline.
v1.4 reads deeper: TLS handshakes are reassembled so certificates can be read and checked, client hellos are fingerprinted, and files are carved whole out of cleartext streams and hashed. SNMP, SMB, LDAP, Kerberos, SIP, RTP, QUIC and DHCP are decoded far enough to say something useful about each.
v1.5 is about what happens after the reading. The Evidence station holds the engagement details, lets you give an address a name that the findings then use, records which findings you have accepted and why, compares this capture against a baseline session, and exports the lot for a Test Bench run.
License
GPL-3.0
Vendored libraries
None. Every parser and every pixel in this file is hand written. No build step, no network calls, no external assets.
Privacy
- The capture is read with the browser File API and stays in page memory.
- Exports are produced locally and saved by the browser download path.
- Hashes are computed in the page with hand written SHA-256 and MD5, because a page opened from disk has no access to the browser crypto API.
- The session file carries names, notes and hashes, never payload.
- Payload bytes are never written into the JSON, report or CSV exports, only summaries and headers.
- The Follow stream panel is the one exception, and only when you press its own save button: that file is payload by definition.
Known limitations
- Encrypted payloads are described, not decrypted. Certificates and handshakes are read where the protocol leaves them in the clear, and nothing further. There is no WEP or WPA decryption, no QUIC decryption and no key log support.
- A TLS 1.3 session encrypts its own certificate, so an empty certificate list there is normal rather than suspicious. The reader says so rather than leaving you to wonder.
- Carving works on cleartext streams only. Anything inside TLS is counted and measured, never reconstructed.
- A JA3 fingerprint identifies software, not people or intent. Two machines running the same browser build produce the same fingerprint.
- Protocol recognition for RTP is by shape rather than by port, so an occasional UDP stream may be misread as audio. The codec and the sequence numbers are the check.
- Rebuilt streams are held whole in memory and stop at four megabytes per direction. Past that the counts stay right and the byte view is short.
- Stream decoding covers HTTP and the shape of TLS. Other application protocols are read one packet at a time.
- 802.11 control frames carry fewer addresses than data frames, so some of them name only the receiver.
- Reading 802.11 needs a capture taken in monitor mode. A capture from an ordinary associated interface has already been turned into Ethernet frames by the driver.
- Link types beyond Ethernet, raw IP, Linux SLL, SLL2, BSD loopback, radiotap, Prism and AVS are counted but not dissected.
- The reader indexes up to five million packets and dissects at most three hundred thousand at a time. When a net holds more than that, it says so and reads the first three hundred thousand. Narrow the net to read the rest.
- Fragment reassembly and stream rebuilding work on what is inside the net. A fragment or a segment outside it is not pulled in.
- Named assets, accepted findings and engagement details are kept in this browser for the capture you have open, and in the session file you save. They are not identity, they are your notes.
Feedback
Send notes and captures that break it to the Field Instruments feedback channel at greenshoegarage.com.