Catch hackers. Red handed.

The fastest way to make sense of network traffic.

Analyze a PCAP or monitor live traffic in Red Hand Analytics, where activities, endpoints, DNS, flows, and connections come together in one investigation.

Analyze a PCAP Monitor live traffic View an example investigation
Red Hand Analytics Activities overview with suspicious findings and report metrics

Red Hand Analytics

Get the entire network story.

Start with a finding, then move through the endpoints, requests, traffic, and connections that explain it without losing context.

Activities

Surface suspicious and noteworthy behavior, with the evidence behind every detection.

View example

Endpoints

See who communicated, then add reputation, ownership, and threat-intelligence context.

View example

DNS

Review resolvers, noisy clients, unresolved requests, conflicting answers, and unusual DNS data exchange.

View example

Data flows

Follow upload, download, and internal traffic to identify unusually large transfers.

View example

Connection patterns

Find repeated and long-running communications that isolated events can hide.

View example

Connection evidence

Filter, sort, and inspect the individual connections behind each observation.

View example

Two ways into Red Hand Analytics

Investigate a captured moment or watch behavior develop.

PCAP Analyzer and Red Hand Collector feed the same investigation experience. Choose based on how you have the traffic and how long you need to observe it.

A packet capture file and Red Hand Collector feeding network and process evidence into Red Hand Analytics
Comparison of Red Hand Collector and PCAP Analyzer
Choose your inputWhat changes CollectorContinuous visibility PCAP AnalyzerAnalyze a capture
Analysis experienceActivities, endpoints, DNS, flows, and connections remain connected.Red Hand AnalyticsRed Hand Analytics
Observation windowHow much time the analysis can cover.ContinuousSnapshot in time
Process visibilityIdentify the application responsible for a connection.YesNo
DeploymentWhat is needed before analysis begins.Lightweight endpoint installationNo endpoint installation
Choose your starting pointBoth open in Red Hand Analytics. Install Collector Analyze a PCAP

Product changelog

What’s new in Red Hand.

Meaningful new capabilities and improvements, with a direct path to try each one.

New
Documentation

Red Hand Analytics documentation is now live

Screen-by-screen guidance now explains the analysis workspace, its core concepts, and the evidence available in every report.

Read update
Improved
Red Hand Analytics

My Reports has a new home

A rebuilt report history brings PCAP and Collector reports together with clearer status, expiration visibility, sorting, and server-side paging.

Read update
Improved
PCAP Analyzer

A clearer path from PCAP to investigation

The PCAP Analyzer now makes uploading, creating a useful capture, and understanding the resulting investigation easier from the first visit.

Read update
View the product changelog

From the community

From the Red Hand community.

Practical network analysis notes, field-tested ideas, and discussions from r/redhand.

Loading community highlights…
Browse all resources

Contact

Talk to Red Hand.

Have a question about a capture, Red Hand Collector, or Red Hand Analytics? Send us a note.

You’ll hear directly from the Red Hand team.