{
  "added_at": "2026-10-17",
  "additional_evidence_urls": [
    "https://github.com/morluto/rea/blob/3b79af28e80785afce9f5998d8f03289402a1847/CHANGELOG.md"
  ],
  "category": "workflow-guides",
  "description_en": "Summarize a saved pcap or pcapng file’s endpoints, DNS questions and addresses, TLS SNI, protocol stacks and HTTP URIs into paged Evidence views. It does not capture traffic or fetch recorded targets.",
  "description_zh": "把已保存 pcap/pcapng 文件中的端点、DNS 查询与地址、TLS SNI、协议栈和 HTTP URI 汇总为可分页的 Evidence 视图；不抓取流量，也不访问记录中的目标。",
  "entry_url": "https://awesomerea.org/resources/rea-pcap-summaries/",
  "entry_url_zh": "https://awesomerea.org/zh/resources/rea-pcap-summaries/",
  "evidence_url": "https://github.com/morluto/rea/blob/808339f0b1cf3837445f392b5d5f1f362d64a27d/docs/pcap-analysis.md",
  "group": "rea",
  "id": "rea-pcap-summaries",
  "json_url": "https://awesomerea.org/resources/rea-pcap-summaries/record.json",
  "kind": "documentation",
  "markdown_url": "https://awesomerea.org/resources/rea-pcap-summaries/index.md",
  "markdown_url_zh": "https://awesomerea.org/zh/resources/rea-pcap-summaries/index.md",
  "name": "Packet capture summaries",
  "name_zh": "抓包摘要",
  "record_type": "resource",
  "relationship": "official-documentation",
  "requirements": [
    "Caller-supplied Wireshark 4.x tshark and capinfos. Capture inspection needs Linux with util-linux prlimit or Windows Job Objects; macOS reports a capability gap. Listed in the rea-agents 6.5.0 release notes.",
    "Upstream’s current verification used Linux, Node 24.18.0 and Wireshark 4.0.17; actual Windows execution is unverified. Summaries do not establish decrypted payloads, process identity or the absence of unrecorded traffic."
  ],
  "requirements_zh": [
    "需自行提供 Wireshark 4.x 的 tshark 和 capinfos。检查抓包需要带 util-linux prlimit 的 Linux，或使用 Job Object 的 Windows；macOS 会报告能力缺口。rea-agents 6.5.0 的发布说明已列出此功能。",
    "上游当前验证使用 Linux、Node 24.18.0 和 Wireshark 4.0.17，Windows 实际执行尚未验证。汇总结果不能证明解密后的内容或进程身份，也不能证明不存在未记录的流量。"
  ],
  "targets": [
    "protocol"
  ],
  "url": "https://github.com/morluto/rea/blob/main/docs/pcap-analysis.md",
  "verification": "source-reviewed",
  "verified_at": "2026-10-17"
}