1. Load a capture
Awaiting CSV. No data loaded.
2. Set investigative thresholds
Each rule triggers when its capture-wide count is strictly greater than the selected threshold. These counts are not packets-per-second rates; severity indicates investigative priority rather than a verdict.
Full capture dashboard
Metrics and top-10 rankings always describe the entire loaded capture, unaffected by alert filters.
3. Filter investigative alerts
How to Think Like an Analyst
- Confirm authorization and capture scope.
- Establish duration, collection point and expected host roles.
- Check completeness and unavailable fields before drawing conclusions.
- Compare full-capture counts with normal operational behavior.
- Inspect an alert’s packets, protocols and peers in Wireshark.
- Seek benign explanations; correlate authorized logs and activity.
- Record evidence, uncertainty and next steps—never label a host malicious from a count alone.
Export from Wireshark
Open an authorized capture. Choose File → Export Packet Dissections → As CSV. Choose all packets or a deliberately scoped displayed subset. Include Source, Destination and Protocol columns; Length, Info, Time and No. are optional. Disable address/port name resolution for numeric port details. Explicit destination port columns are preferred. CSV is not PCAP or PCAPNG.
The ICMP rule combines ICMP and ICMPv6, including neighbor discovery. DNS counts include response and retry packets, so they should not be read as query totals. Port analysis uses explicit numeric destination ports or numeric TCP/UDP “source > destination” prefixes in the Info field. Partial coverage can undercount port diversity; without reliable port data, the rule is unassessable. Mean packet length likewise requires valid length data. Interpret these capture-wide summaries in light of duration and normal operations: the tool does not inspect TCP flags, calculate rates or establish a baseline.