pCapitan — your first capture

pCapitan explains a network capture in plain language. Everything runs on your computer: captures are never uploaded.

Open a capture

1. Start pCapitan from the Start menu (Windows) or your applications menu (Linux).
2. Drag a .pcap, .pcapng, .cap or .pcap.gz file onto the Captures page, or type its path and click Analyse. Big files are read where they are, without a copy.
3. When the analysis finishes, the ✨ Overview opens: the risk level, the story of the capture in plain words and the most important findings.

Where to look next

• 🧭 What happened? tells the incident in plain English: which attacks worked, the first device hit, the devices it reached and whether it was still going on.
• 💬 Ask pCapitan answers questions in your own words, such as What did 192.168.1.66 do? or Were any passwords sent in clear text?
• 🖥️ Devices lists every device with its type, maker, network owner and verdict. Click one for its profile and 📔 Diary.
• 📝 Report & export makes a printable report (with your own logo, if you like), filtered captures and CSV or JSON exports.

Optional: install Wireshark

pCapitan works on its own. Installing the free Wireshark adds live capture, the full packet dissection tree, file carving and decryption.

Use Wireshark 4.2 or later; the latest version from wireshark.org is recommended. Older versions (for example the 3.x that some Linux distributions still ship) may fail to start a live capture. On Windows, tick Install Npcap in the Wireshark installer.

The full user guide

The complete guide, with a screenshot of every screen, is in the app under ❓ Help & guide, and as a PDF: pCapitan User Guide (PDF).