New: Packet Analysis tab ("Advanced Traffic Analyzer")
A full deep-packet capture and analysis module, between Connections and Macro Topology:
- Live Capture - disk-backed (SQLite, WAL mode), filterable, virtually-scrolled packet table that doesn't spike RAM or freeze on long captures, plus a Contextual Insights panel that translates the selected packet's TCP flags / ICMP codes into plain English.
- Process Attribution - real-time process/PID attribution per packet, plus passive ARP/mDNS/LLMNR/NetBIOS neighbor discovery.
- Domain resolution (DNS + TLS SNI) - cross-references plaintext DNS responses and the TLS ClientHello's SNI field, so domains still resolve even under DNS-over-HTTPS. Flags restricted/adult-content domains.
- Anomaly Timeline - a live sparkline with statistical-outlier highlighting; click to jump straight to those packets.
- Blast Radius - a hub-and-spoke map of every remote host you've talked to, color-coded by proxy/hosting/restricted-content flags.
- ETA Classification - heuristic categorization of encrypted flows (e.g. "Media Streaming", "Interactive Shell", "Potential Malware Beaconing").
- Remediation - send a TCP RST to drop a connection, or block/unblock a remote IP at the Windows Firewall, with a persistent "Blocked IPs" list that survives the UAC-elevation restart.
- Four capture modes: Host, Gateway, Promiscuous / SPAN, and zero-config ARP Discovery.
Also: the admin-elevation relaunch (used by IP/process blocking throughout the app) now uses pythonw.exe instead of python.exe when running from source, so no console window flashes for the user.
See FEATURES.md and HOWTO.md for full details.
Since the executable isn't code-signed, Windows SmartScreen may show an "Unrecognized app" warning the first time you run it - click More info -> Run anyway. For full functionality (packet capture, firewall blocking), right-click the .exe and choose Run as administrator.