A desktop threat-hunting tool that analyzes Wireshark packet captures with interactive visual dashboards. No command-line expertise required.
macOS (Homebrew):
brew tap BardSec/tap
brew install --cask pcap-detectivemacOS / Windows: Download from Releases.
Entity-centric investigation view that groups findings around hosts, domains, and endpoints. Each thread shows a narrative summary, risk score, related detections, and a timeline of events — so you can investigate an entity, not just browse analyzer tabs.
Every detection now includes a confidence score (0–100) built from weighted indicators, supporting evidence ("Why was this flagged?"), and alternative explanations ("Could also be"). Findings are framed as hypotheses, not conclusions.
One-click "Copy for AI Analysis" button on any investigation thread packages the full context — findings, indicators, timeline, metadata — into a structured prompt you can paste into ChatGPT, Claude, or any AI assistant for guided next steps.
Per-host profiling, DNS baselines, and peer comparison enable metadata-first detection. The tool identifies outliers relative to the capture — hosts with unusual DNS volume, asymmetric traffic, or unique external destinations — even when TLS hides payload content.
Click any IP or domain to jump to its investigation thread. Right-click any IP or domain in any table across all panels to pivot to the Investigation view.
New users can click "Try a sample investigation" in the sidebar to load a bundled PCAP that triggers all major analyzers — no capture file needed to explore the tool.
- C2 Beaconing Detection — Identifies implant heartbeats via coefficient of variation analysis
- DNS Tunneling — Scores query entropy, flags long subdomains, detects suspicious record types
- NTLM Hash Extraction — Parses NTLMSSP exchanges, outputs Hashcat mode 5600 format
- Cleartext Credentials — Detects HTTP Basic Auth, FTP, SMTP AUTH LOGIN, form POST passwords (masked by default, reveal on click)
- Exfiltration Profiling — Flags high-asymmetry outbound flows exceeding 1 MB
- Lateral Movement Detection — Identifies internal-to-internal connections on SMB, RPC, RDP, WinRM, SSH, and Telnet; detects scan patterns across 5+ internal targets
- DGA Detection — Identifies Domain Generation Algorithm activity through entropy analysis and pattern matching
- Data Staging — Detects data collection and preparation patterns before exfiltration
- Suspicious User-Agents — Flags abnormal HTTP User-Agent strings associated with malware and exploitation tools
- PowerShell/WMI Activity — Detects network activity from PowerShell and WMI operations
- Content Filter Bypass — Detects VPN/proxy bypass attempts, unauthorized DNS resolvers, DoH/DoT
- CIPA Compliance — Verifies web traffic passes through recognized content filters
- Student Data Exposure — Scans cleartext traffic for student PII (SSNs, DOBs, student IDs, email patterns) and unencrypted SIS/EdTech API traffic — FERPA/COPPA relevant
- Vendor Traffic — Identifies EdTech vendor connections, flags unencrypted vendor traffic, bulk data exports, and third-party analytics/tracking domains
- Connection Failures — TCP resets, ICMP unreachable, silently dropped SYNs
- DNS Health — NXDOMAIN, SERVFAIL, timeouts, slow queries (>500ms)
- TLS/SSL Inspection — SNI extraction, cert parsing, detection of 24+ SSL-inspection products
- Traffic Timeline — IO graphs, top conversations, endpoint summaries with spike/gap detection
- VLAN Traffic — Detects and maps 802.1Q VLAN-tagged traffic
- DHCP Analysis — Analyzes DHCP request/reply patterns
- Broadcast Storms — Detects excessive broadcast/multicast traffic
- Service Discovery — Identifies network services through protocol analysis
- Financial Services — PCI DSS compliance, FIX/Bloomberg/SWIFT protocol detection
- Healthcare — HIPAA compliance, medical device and protocol detection
- Energy / Utilities — ICS/SCADA protocol detection, IT/OT segmentation analysis
Capture packets directly from the application without needing Wireshark or tcpdump. Select a network interface, set optional packet count and duration limits, and feed the capture straight into the analysis pipeline.
- Python 3.12+
- pip
python3 -m venv venv
source venv/bin/activate
pip install -r requirements.txtpython -m app.mainpyinstaller build/bloodhound.specThe .app bundle will be in dist/.
Live capture requires raw socket access, which varies by platform:
- macOS — BPF access at
/dev/bpf0. Install Wireshark, Xcode Command Line Tools, or add your user to theaccess_bpfgroup. - Windows — Npcap installed with API-compatible mode enabled.
- Linux — Root or
CAP_NET_RAWcapability:sudo setcap cap_net_raw+ep $(which python3)
- Open the application
- Click Try a sample investigation for a guided tour, or Open PCAP File to analyze your own capture
- Browse results across analyzer panels in the sidebar
- Click Investigation to see entity-centric findings with confidence scores and evidence
- Click any IP or domain to pivot between related findings
- Use Copy for AI Analysis on any investigation thread for AI-assisted guidance
- Click Export JSON to save full results
- Python 3.12 — Core language
- PySide6 (Qt 6) — Desktop GUI framework
- Scapy — Packet parsing and protocol analysis
- NumPy — Statistical calculations (CV analysis, entropy scoring)
- cryptography — Certificate parsing and TLS handling
- QtCharts — Interactive data visualizations
- PyInstaller — Standalone binary packaging
MIT