pCapitan — live capture, remote capture, compare and batch audits
Capture from your own adapters or a Linux server over SSH, compare two captures, and audit a whole folder.
Only capture networks you own or are allowed to monitor.
Live capture on this computer
Install Wireshark 4.2 or later (the latest version is recommended) with Npcap on Windows, or give your user capture permission on Linux (sudo usermod -aG wireshark $USER, then log in again). Open 📡 Live capture, choose an adapter, optionally a capture filter and limits, and click Start. Views refresh every few seconds, and a pop-up warns you at once about serious new findings.
If the capture stops at once with an error, update Wireshark first: older versions (for example 3.x) may not start a live capture. pCapitan shows a notice on the Live capture page when your Wireshark is older than 4.2.
Remote capture over SSH
On the 📡 Live capture page, under remote capture:
- Enter the host, port and user, and a password or private key. They are used for the connection only and never stored.
- On the first connection, compare the host key fingerprint with the server’s and click It matches: trust and connect.
- Choose the interface and limits, and click ● Start remote capture.
The server needs tcpdump, and root or sudo. If a server was reinstalled and its key changed, pCapitan refuses to connect until you click forget the old key and confirm the new one.
Compare two captures
⚖️ Compare captures shows what changed between two captures (before and after), or what a firewall or router did between its two sides: dropped packets, NAT, forged resets, QoS and MSS changes, and the time spent inside the device.
Batch audit
🗂️ Batch audit analyses every capture in a folder (up to 500) and gives one table with a verdict per capture, plus what the captures have in common: the same attacker, indicator or compromised device. Export it as CSV or a printable report.
