Documentation
Recorded packet capture inspection
Select TShark fields, display filters and decode-as rules over an existing network, USB or Bluetooth capture, and look up installed field names. It does not capture traffic, open an interface or control a device.
- Targets
- Protocol
- Category
- Official REA: investigation guides
- Relationship
- Official REA documentation
- Sources reviewed
Requirements & limits
- Caller-supplied TShark 4.x on Linux with util-linux prlimit; macOS and Windows hosts are refused before inspection. Listed in the rea-agents 6.5.0 release notes.
- Dissector output describes the selected recording, not verified device behavior. Upstream fixtures are generated Ethernet/UDP/DNS and Bluetooth HCI PCAPs and do not cover PCAPNG, USB, BLE ATT or physical capture.
About this entry
The description was reviewed against primary sources.
Primary sources
- docs/packet-captures.md GitHub · morluto/rea · Revision 808339f
- CHANGELOG.md GitHub · morluto/rea · Revision 3b79af2
More in References and learning
- Packet capture summaries · Documentation
- Recorded signal decoding · Documentation
- Browser observation guide · Documentation
- JavaScript and Electron: follow a CSV export · Documentation
- rea-playbook · Learning resource
- rea-lab · Research