Documentation
Packet capture summaries
Summarize a saved pcap or pcapng file’s endpoints, DNS questions and addresses, TLS SNI, protocol stacks and HTTP URIs into paged Evidence views. It does not capture traffic or fetch recorded targets.
- Targets
- Protocol
- Category
- Official REA: investigation guides
- Relationship
- Official REA documentation
- Sources reviewed
Requirements & limits
- Caller-supplied Wireshark 4.x tshark and capinfos. Capture inspection needs Linux with util-linux prlimit or Windows Job Objects; macOS reports a capability gap. Listed in the rea-agents 6.5.0 release notes.
- Upstream’s current verification used Linux, Node 24.18.0 and Wireshark 4.0.17; actual Windows execution is unverified. Summaries do not establish decrypted payloads, process identity or the absence of unrecorded traffic.
About this entry
The description was reviewed against primary sources.
Primary sources
- docs/pcap-analysis.md GitHub · morluto/rea · Revision 808339f
- CHANGELOG.md GitHub · morluto/rea · Revision 3b79af2
More in References and learning
- Recorded signal decoding · Documentation
- Browser observation guide · Documentation
- JavaScript and Electron: follow a CSV export · Documentation
- rea-playbook · Learning resource
- rea-lab · Research
- Flutter build identification · Documentation