View and Analyze PCAP Files

Files need to be uploaded to the server for parsing, and the parsing results are returned to the page through SSE for display. Files are temporarily stored on the server disk.

Files are not permanently stored and will automatically expire after 7 days. You can also manually delete them after analysis is complete.

We limit the web version to analyze files up to 50MB maximum, because large files take time to parse, and the SSE transmission process back to the frontend is also affected by network conditions, requiring too long a wait time. Very large files may not provide a good user experience.

For very large files, we recommend downloading the APP for offline analysis.

To isolate each user's files, you need to sign in to upload PCAP files for analysis.

Why store your files?

Because analysis may not be one-time, you may need to review it repeatedly. Also, after analysis, you may still need it when writing summaries, which avoids multiple uploads.

When you click View to open the analysis page, it will display TCP traffic by default. If the PCAP file contains UDP traffic, you can switch to the UDP traffic view using the toggle in the upper-left corner.

This is because TCP and UDP concepts are fundamentally different. Mixing them together would compromise our goal of keeping the product clean and simple to use.

If the application layer protocol is not a binary protocol, but a plain text protocol like HTTP, it can also be analyzed with ChatTCP.

For example, SMTP, JSON-RPC protocols, etc.