Network captures

A packet capture is a recording of traffic. On the Network Map > Capture file page, or from Scan on a phone, upload a .pcap, .pcapng or .cap (up to 512 MB) or a CSV or JSON flow export. Nothing in the recording is run or extracted.

The verdict

The same words as for a file: Dangerous, Suspicious, Low risk or No threats found, with one sentence on what the verdict rests on and every detection written out. A capture is dangerous when it shows an attack happening, such as a scan, lateral movement or contact with a known-bad address; the file itself is safe to hold.

What is looked for

From who talked to whom, how much and how regularly:

• Port scan: one host tries many ports on one target, or one port across many internal hosts.
• Lateral movement: one host reaches several internal hosts on administration ports (SSH, SMB, RDP, WinRM, RPC).
• Regular callback: a host reaches one server on a fixed interval. Updaters and monitoring agents do this too, so the detection says so. Broadcast and multicast (LAN discovery) are not counted.
• Large upload to one destination, and traffic on ports malware often uses.

From inside the packets, counted while the capture is read (payloads are not kept):

• Domains that do not exist: hundreds of “no such domain” answers for different names, the way malware that generates domain names (DGA) looks for its server. Reverse lookups and local names are left out.
• Check-ins: a hundred or more POST requests to one web server. Certificate checks (OCSP) are left out.
• Connections refused again and again, by internet servers.
• Many peers on unusual ports, as peer-to-peer botnets do. Torrent clients do too, so this reads suspicious at most.
• Generated host names: web requests to many mixed-case host names, which browsers never send.

Detections become entries in the alert queue; notes that add nothing to the verdict do not.

Measured

On 14 recordings of ordinary traffic (Stratosphere CTU-Normal: browsing, chat, a user’s day, DNS-only; 2.7 million packets) and 28 of botnets (Stratosphere CTU-Malware), 8 November 2026: no ordinary recording was flagged, and 21 of the 28 botnet recordings were. The seven missed hid their traffic in HTTPS or were too short to show a pattern.

Limits

The first million packets of a capture are analysed and the first 250,000 are kept as flows; the result says when a ceiling was reached. Encrypted traffic is read by its shape only. Captures in a link type only tshark reads (802.11 Wi-Fi) get the traffic-shape detections, not the packet ones.