> For the complete documentation index, see [llms.txt](https://docs.netcap.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.netcap.io/start-here/commands.md).

# Commands

Choose the public Go command for the job.

Go v0.16.2 registers the commands below in `cmd/net/main.go`. Run `net -h` and `net COMMAND -h` for their installed options. The executable is `net`; version inspection is `net --version`, not a `version` subcommand.

| Command       | Job                                                                          | Guide                                                                                                  |
| ------------- | ---------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------ |
| `capture`     | PCAP/PCAPNG, live packets and local/upload WebUI                             | [Packet collection](/capture-and-inspect/packet-collection.md)                                         |
| `dump`        | Read audit files, discover fields, filter and emit CSV/JSON                  | [Record inspection](/capture-and-inspect/filtering-and-export.md)                                      |
| `triage`      | Inspect capture-derived `Hosts.json` identities                              | [Hosts and identity](/investigate-evidence/host-identity.md)                                           |
| `investigate` | Flow queries, related records, evidence exports and bounded experiments      | [Evidence](/investigate-evidence/evidence.md), [flow analysis](/investigate-evidence/flow-analysis.md) |
| `util`        | Interfaces, schemas, timestamps and database operations                      | [Database updates](/enrichment/database-updates.md)                                                    |
| `mcp`         | Stdio Model Context Protocol server                                          | [AI agents](/integrations-and-operations/mcp.md)                                                       |
| `licenses`    | Distribution license/notice information                                      | [License](/reference/license.md)                                                                       |
| `agent`       | TLS-authenticated remote sensor                                              | [Distributed collection](/integrations-and-operations/distributed-collection.md)                       |
| `collect`     | Receive agent batches                                                        | [Distributed collection](/integrations-and-operations/distributed-collection.md)                       |
| `export`      | Prometheus-oriented audit metrics exporter                                   | [Metrics](/integrations-and-operations/metrics.md)                                                     |
| `proxy`       | HTTP/HTTPS reverse proxy records                                             | [HTTP proxy](/integrations-and-operations/http-proxy.md)                                               |
| `label`       | Suricata/custom mappings for dataset labels                                  | [Labeling](/integrations-and-operations/audit-record-labeling.md)                                      |
| `transform`   | Maltego transform integration                                                | [Maltego](/integrations-and-operations/maltego-integration.md)                                         |
| `inject`      | Linux NFQueue inline manipulation                                            | [Response actions](/firewall-and-response/firewall_response_actions.md)                                |
| `split`       | Read-only capture inspection, bounded packet subsets and time shards         | [Packet evidence](/investigate-evidence/evidence.md#export-packet-evidence)                            |
| `firewall`    | Explicit WAF, protocol gateways, policy control and scoped Linux enforcement | [Application firewall](/firewall-and-response/application_firewall.md)                                 |

`split` and `firewall` ship in the v0.16.2 `net` archives; the v0.15.2 archive does not expose them. `analyze` remains unregistered. A source directory or legacy completion result alone does not establish an executable interface.

The standalone `netcap-firewall` executable accepts `serve`, `validate`, `healthcheck`, `gateway`, `network` and its other subcommands directly; `net firewall` accepts the same subcommands with the prefix. Its `version` subcommand is separate from the capture executable's `net --version`. The [v0.16.2 release](https://github.com/dreadl0ck/netcap/releases/tag/v0.16.2) publishes separate standalone Linux amd64/arm64 firewall archives.

## Common operations

The [offline grouped rule evaluator](/investigate-evidence/rules_engine.md#offline-grouped-thresholds) (`investigate rules`) ships in v0.16.2. It is absent from the v0.15.2 release binary. The [sensor bundle commands](/integrations-and-operations/sensor-bundles.md) are a separate completed-output workflow from live agent transport. v0.16.2 also includes [scoped capture rules](/investigate-evidence/rules_engine.md#scoped-capture-time-rules) and the explicit `investigate deliver-alerts` [webhook outbox](/investigate-evidence/rules_engine.md#durable-webhook-delivery).

```sh
net util -interfaces
net capture -overview
net capture -read example.pcap -out analysis -dpi=false -geoDB=false
net dump -read analysis/UDP.ncap.gz -fields
net dump -read analysis/UDP.ncap.gz -json
net triage -read analysis -json
net investigate related -read analysis -type Connection -ordinal 0
```

Only query a type/ordinal that exists in your capture. For advanced commands, the [generated MCP catalogue](/integrations-and-operations/tools.md) is a different interface, not a CLI alias list. The source command/flag registrations are the reference for scripting.