01
Activities and evidence
Review suspicious and noteworthy behavior, then open the exact connections behind a finding.
Packet capture analysis
The Free Online PCAP Analyzer
by Red Hand
Upload a PCAP and get a connected investigation, not just a packet dump. Explore activities, endpoints, DNS requests, data movement, and the connections behind every finding in Red Hand Analytics.
PCAP file analysis
Upload a PCAP file
Choose a PCAP or PCAPNG file to begin an investigation.
or drop a file anywhere in this area
No registrationPCAP and PCAPNGUp to 100 MB
Raw captures are deleted after processing. Anonymous reports are temporary; free-account reports are kept for 14 days. Create a free account.
Red Hand Analytics
Get the full story from your network traffic, fast.
Behavior-based detection and integrated threat intelligence surface what matters, so you can examine the evidence from different angles and reach a confident conclusion.
02
Endpoints and threat intelligence
Understand who communicated and add domain, ownership, reputation, and threat-intelligence context.
03
DNS, flows, and connections
Trace DNS behavior and data movement, then filter and inspect the connections that explain them.
Need a capture?
How to create a PCAP file on Windows, Linux, or macOS.
Use the commands below to record network traffic with tools included with Windows and macOS, and commonly available on Linux.
Windows 10 and 11
Full Windows guide
Create a PCAP with Packet Monitor
Open Command Prompt or PowerShell as Administrator. Replace <id> with the interface ID identified below.
-
1
Find the capture interface
Run
ipconfig /alland note the MAC address of the adapter with a Default Gateway. Match that address to an interface ID frompktmon list. -
2
Start capturing network traffic
pktmon start -c --comp <id> --pkt-size 0 -s 100 -f cap1.etl-s 100limits the capture file to 100 MB and--pkt-size 0records full packets. -
3
Stop the capture and create a PcapNG file
When you have captured enough traffic, run:
pktmon stop pktmon etl2pcap cap1.etl --out cap1.pcapng
Upload
cap1.pcapngThe packet capture is saved in the current terminal directory.
Linux
Full Linux guide
Create a PCAP with tcpdump
Open a terminal and replace <interface-name> with the network interface identified below.
-
1
Find the capture interface
The interface following
devin the default route is usually the interface you need.ip route | grep default -
2
Capture full packets to a PCAP file
sudo tcpdump -vni <interface-name> -s 0 -w capture.pcap -c 100000-s 0captures complete packets. The capture stops after 100,000 packets; press Ctrl+C to stop it sooner.
Upload
capture.pcapThe PCAP file is saved in the current terminal directory.
macOS
Full macOS guide
Create a PCAP with tcpdump
Open Terminal from Applications > Utilities and replace <interface-name> with the network interface identified below.
-
1
Find the capture interface
The final value on the normal default route is usually the interface you need, such as
en0.netstat -nr | grep default -
2
Capture full packets to a PCAP file
sudo tcpdump -vni <interface-name> -s 0 -w capture.pcap -c 100000Enter your password when prompted. Press Ctrl+C to stop before 100,000 packets.
Upload
capture.pcapThe PCAP file is saved in the current terminal directory.
Ready to investigate?
Upload a PCAP now
Turn your packet capture into a connected investigation.
Upload a PCAP or PCAPNG file to explore activities, endpoints, DNS requests, data flows, and their supporting connections.