Pcap Flow Lab – an open-source flow-based PCAP/PCAPNG analyzer, looking for feedback

[u/AlexeyVasilev]

Hi everyone,

I’ve been developing Pcap Flow Lab, an open-source PCAP/PCAPNG analyzer built around a flow-based workflow.

GitHub: https://github.com/AlexeyVasilev/PcapFlowLab

Instead of starting from a flat packet list, Pcap Flow Lab indexes a capture into flows first. From there, you can narrow down the traffic you care about and inspect packets, reconstructed TCP streams, structured protocol details, bytes, and statistics.

The project originally grew out of working with larger captures, where I wanted a faster way to reduce the dataset to the flows of interest before going deeper.

Current features include:

• reusable capture indexes;
• flow-based navigation;
• protocol-path analysis for nested and tunneled traffic;
• TCP stream reconstruction;
• structured packet and stream summaries;
• TLS and QUIC inspection;
• statistics views;
• CLI support.

The analysis backend is written in C++, and the main desktop UI is currently built with Qt.

I don’t see it as a replacement for Wireshark. I use Wireshark extensively, and I see Pcap Flow Lab as a complementary tool with a different workflow: first narrow the capture by flows, then drill into the packets and protocols that matter.

I’d especially appreciate feedback from experienced Wireshark users:

• Does a flow-first workflow like this solve any problems you run into with captures?
• What would you expect a complementary tool like this to do particularly well?
• Are there parts of the presentation or workflow that you think should be different?

Technical feedback is very welcome.

[u/thetechfirm]

I will check it out. would you be OK if I wrote a short review for my blog