> For the complete documentation index, see [llms.txt](https://docs.netcap.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.netcap.io/readme.md).

# Netcap

Network traffic analysis, structured evidence and reproducible investigations.

![Netcap — network traffic analysis](https://1185258105-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-La-SRWxzIGdy_3ynMZH-887967055%2Fuploads%2Fgit-blob-2ba78448cd5f33a5126103b6565062ae9af6595b%2Flogo.png?alt=media)

Netcap turns network packets into typed audit records, then connects protocol observations to hosts, services, files, detections and investigation evidence. Use the `net` executable to analyze PCAP/PCAPNG files, inspect a live interface, browse results locally or supply structured evidence to an AI agent.

These docs cover the **public Go implementation**, released as [v0.16.2](https://github.com/dreadl0ck/netcap/releases/tag/v0.16.2). GitBook's `master` variant follows current source; [releases and migration](/reference/changelog.md) records packaged availability. Check `net --version` and `net capture -h` before using new flags. Historical variants describe older interfaces.

## Start with a question

| Goal                                                         | Guide                                                                                                                                      |
| ------------------------------------------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------ |
| Produce and inspect your first records                       | [First capture](/start-here/quickstart.md)                                                                                                 |
| Follow a complete DNS/HTTP/file/alert investigation          | [Synthetic transfer lab](/start-here/investigation-walkthrough.md)                                                                         |
| Explore captures in a browser                                | [Web interface](/capture-and-inspect/web-interface.md)                                                                                     |
| Identify hosts and observed accounts                         | [Hosts and identity](/investigate-evidence/host-identity.md)                                                                               |
| Explain an alert and recover its evidence                    | [Related evidence](/investigate-evidence/evidence.md)                                                                                      |
| Find unusual connections or learn a baseline                 | [Network detections](/investigate-evidence/network-detections.md), [behavioral monitoring](/investigate-evidence/behavioral-monitoring.md) |
| Automate analysis with an AI client                          | [MCP](/integrations-and-operations/mcp.md)                                                                                                 |
| Integrate records into another tool                          | [CSV/JSON](/capture-and-inspect/filtering-and-export.md), [record format](/develop-and-extend/specification.md)                            |
| Inspect HTTP transactions before a TCP connection closes     | [Incremental transactions](/capture-and-inspect/reassembly.md#incremental-transactions)                                                    |
| Search explicit captures, save queries and review reports    | [Bound analyst workspace](/investigate-evidence/evidence.md#bound-analyst-workspace)                                                       |
| Inspect or split packet evidence without changing the source | [Packet evidence](/investigate-evidence/evidence.md#export-packet-evidence)                                                                |
| Deliver redacted alerts with durable retries                 | [Webhook delivery](/investigate-evidence/rules_engine.md#durable-webhook-delivery)                                                         |
| Gate traffic before it reaches an application                | [Application firewall quickstart](/firewall-and-response/application_firewall.md#quickstart)                                               |

## From packets to evidence

| Stage       | Result                                                                                                               |
| ----------- | -------------------------------------------------------------------------------------------------------------------- |
| Capture     | Packets from a file or visible interface; optional BPF selection                                                     |
| Decode      | Protocol-specific records and higher-level `Connection`, `Host`, `DeviceProfile`, `Software` and `File` observations |
| Enrich      | Local IANA, OUI, GeoIP, UA, HASSH and NVD data where enabled and available                                           |
| Investigate | Rules, network detections, approved behavioral baselines, identity bindings and related-record pivots                |
| Preserve    | Audit files, capture-health manifests and optional packet/stream evidence                                            |

Local capture normally writes one compressed protobuf file per emitted record type, such as `TCP.ncap.gz`. `dump` reads those files; `triage` reads host-identity reports; `investigate` queries and exports bounded evidence. [Commands](/start-here/commands.md) explains the division.

## Understand what was observed

A passive capture sees only traffic reaching its input. Packet loss, truncation, encryption and absent handshake data limit interpretation. Protocol recognition does not imply complete application decoding; a CVE match does not prove exploitation; a connection attempt does not establish authentication failure. Health and completeness fields make these limits inspectable.

Netcap's Go runtime and bounded parsers reduce some implementation risks, but native libpcap/DPI/YARA integrations are part of the build-dependent trust boundary. See [installation](/start-here/installation.md), [capture health](/investigate-evidence/evidence.md) and [service hosting](/capture-and-inspect/web-interface.md#hosting-boundary).

## Source and license

The public Go framework is [GPL-3.0-or-later](/reference/license.md). Dataset and native dependency licenses remain separate. The [public repository](https://github.com/dreadl0ck/netcap) contains source, tests, schemas and release build recipes. This documentation does not describe commercial desktop editions or promise parity with other implementations.