{
  "added_at": "2026-10-17",
  "additional_evidence_urls": [
    "https://github.com/morluto/rea/blob/3b79af28e80785afce9f5998d8f03289402a1847/CHANGELOG.md"
  ],
  "category": "workflow-guides",
  "description_en": "Select TShark fields, display filters and decode-as rules over an existing network, USB or Bluetooth capture, and look up installed field names. It does not capture traffic, open an interface or control a device.",
  "description_zh": "用 TShark 字段、显示过滤器和 decode-as 规则检查已有的网络、USB 或蓝牙抓包，并可查询已安装的字段名；不抓取流量、不打开网络接口，也不控制设备。",
  "entry_url": "https://awesomerea.org/resources/rea-packet-captures/",
  "entry_url_zh": "https://awesomerea.org/zh/resources/rea-packet-captures/",
  "evidence_url": "https://github.com/morluto/rea/blob/808339f0b1cf3837445f392b5d5f1f362d64a27d/docs/packet-captures.md",
  "group": "rea",
  "id": "rea-packet-captures",
  "json_url": "https://awesomerea.org/resources/rea-packet-captures/record.json",
  "kind": "documentation",
  "markdown_url": "https://awesomerea.org/resources/rea-packet-captures/index.md",
  "markdown_url_zh": "https://awesomerea.org/zh/resources/rea-packet-captures/index.md",
  "name": "Recorded packet capture inspection",
  "name_zh": "抓包记录检查",
  "record_type": "resource",
  "relationship": "official-documentation",
  "requirements": [
    "Caller-supplied TShark 4.x on Linux with util-linux prlimit; macOS and Windows hosts are refused before inspection. Listed in the rea-agents 6.5.0 release notes.",
    "Dissector output describes the selected recording, not verified device behavior. Upstream fixtures are generated Ethernet/UDP/DNS and Bluetooth HCI PCAPs and do not cover PCAPNG, USB, BLE ATT or physical capture."
  ],
  "requirements_zh": [
    "需在 Linux 上自行提供 TShark 4.x 和 util-linux prlimit；macOS 与 Windows 主机会在检查前被拒绝。rea-agents 6.5.0 的发布说明已列出此功能。",
    "解析结果只反映所选记录，不等于已验证的设备行为。上游测试样例是生成的以太网/UDP/DNS 和蓝牙 HCI PCAP，未覆盖 PCAPNG、USB、BLE ATT 或实际抓包。"
  ],
  "targets": [
    "protocol"
  ],
  "url": "https://github.com/morluto/rea/blob/main/docs/packet-captures.md",
  "verification": "source-reviewed",
  "verified_at": "2026-10-17"
}