pCapitan — ask questions, device diaries and the replay
Ask about a capture in plain English, read one device's diary, and play the capture back on the map.
Ask pCapitan
Open 💬 Ask pCapitan and type a question, or click one of the examples. pCapitan understands questions about:
- what happened and which devices are compromised;
- who talked to a device, and what a device did;
- passwords sent in clear text, uploads to the internet and programs downloaded;
- websites visited and names looked up;
- who used a port or an application (Which devices used SSH?, Who used port 445?);
- why the network is slow, and the busiest device;
- who owns an internet address, and which companies’ networks were reached;
- what kind of NAT the network sits behind.
Each answer comes with the evidence table, 🔎 Show these packets, and a link to the full page. You can also type a filter, such as ip.addr == 10.0.0.5.
Device diary
Click any device, then 📔 Diary. The diary tells what that device did in time order, in chapters separated by quiet periods: names it looked up, its biggest conversations, web requests, logins, and attacks it made or suffered (marked 🚨).
Narrated replay
🎬 Narrated replay plays the capture back moment by moment: devices appearing, big conversations starting and attacks, each highlighted on the map with one sentence. Use ▶ Play, the speed menu and the slider. Tick read aloud to hear each sentence.
How the answers are worked out
pCapitan measures the capture into tables, then matches your question against known question patterns, runs a query and fills in a sentence. The same capture always gives the same answer, nothing leaves your computer, and every sentence has its evidence. If a question is phrased in a way pCapitan does not know, it says so and shows examples.
