Packet Inspector for Windows 0.1.7+win.1

Windows test prerelease 0.1.7+win.1 carries the Linux 0.1.9 HTTP/LDAP detector prefilters and duplicate-payload reduction into the native Windows package. It also reconciles final Npcap post-filter queued packets with packets delivered to the analyzer, treats unavailable or wrapped capture statistics as incomplete, and reports worker batch reservations and queue pressure.

The native Windows suite passed 709 tests with 9 expected platform skips and 30 subtests. A bounded Npcap loopback run processed 160/160 queued packets, recorded all 12 fixed synthetic HTTP Basic findings, reported zero Npcap drops and drained all batch reservations. Three offline runs of a private 20,000-frame Win11 fixture averaged 4.16 seconds versus 7.15 seconds for 0.1.6+win.3, with the same 23 findings and no reported gaps or drops. The deployment ZIP passed its checksum manifest, offline setup and installed 42-frame Win11 replay checks.

This is a test prerelease. Npcap does not implement interface-drop statistics, and these bounded tests do not establish physical-adapter or sustained line-rate capture, live SMB/LDAP capture by the Windows sensor, encrypted-payload visibility or universal credential detection. See WINDOWS-VALIDATION.md and COVERAGE.md for measured scope.

Download the ZIP and accompanying .sha256 asset. GitHub's automatic source archives do not include the bundled offline wheel.

Packet Inspector for Windows 0.1.6+win.3

Packet Inspector for Windows 0.1.6+win.3 corrects HTTP byte-range classification. Luhn-valid numeric offsets in Range and Content-Range headers no longer appear as payment-card candidates; card-shaped values elsewhere in tested headers and bodies remain detectable. This is a Windows test prerelease and does not change Kali's Linux installation.

The native Windows suite passed 700 tests, 9 expected platform skips and 28 subtests. The deployment ZIP passed its SHA-256 and all 91 internal checks, contains one offline wheel and source archive, and installed offline from the extracted package. Installed replay of a separate 42-frame Win11-origin PNG HTTP capture processed 42/42 frames, produced the expected PNG and two cookie findings, and ended complete with zero reported drops. Native Win11 HTTP/LDAP/SMB authentication was separately observed by the Linux sensor; this release does not claim live Windows capture qualification on those protocols or sustained zero-loss operation.

Download the attached deployment ZIP and .zip.sha256 file. GitHub's automatic source archives do not contain the offline wheel. See WINDOWS-VALIDATION.md and COVERAGE.md for measured coverage and limits.

Packet Inspector for Windows 0.1.6+win.2

Packet Inspector for Windows 0.1.6+win.2 corrects the PNG test attribution in 0.1.6+win.1. The earlier 12-packet capture was Kali-to-Linode traffic replayed on Windows. A separate, fresh 42-frame Win11-to-Linode image transfer was intercepted through Kali and replayed on Windows with a complete verdict: one high-confidence PNG file-signature finding with complete server-to-Win11 packet provenance, plus two medium-confidence cookie candidates. The original Win11 HTTP authentication matrix was a separate live test.

The release retains the 0.1.6 detection changes: bounded cleartext HTTP/1 PNG, JPEG, GIF, WebP, PDF, and ZIP prefix identification; more accurate Bearer, cookie, and JWT labels; and the earlier SMB2 zero-SessionId, VLAN, replay, and TCP keepalive fixes. File findings store metadata and provenance, not file bodies. The independent restricted raw capture ring is unchanged.

The native Windows suite passed 695 tests, 9 expected skips, and 28 subtests. The attached deployment ZIP passed SHA-256 verification and all 91 internal manifest checks, installed offline in a fresh environment, and replayed both PNG captures with complete verdicts and zero reported drops. Use the attached ZIP and checksum; GitHub's automatic source archives do not contain the offline wheel.

This is a test prerelease. A file signature shows a prefix, not a verified complete transfer. Encrypted, compressed, chunked, HTTP/2/3, and most multipart bodies remain outside the file-signature coverage; token shape does not prove validity. Physical-adapter and sustained-load qualification remain open for intended Windows deployments.

Packet Inspector Windows 0.1.6-win.1 (test release)

Superseded by 0.1.6+win.2. The packaged 0.1.6+win.1 validation text mislabeled a Kali-origin PNG capture as Win11-origin. The replacement corrects that provenance and adds a separate verified live Win11 PNG test. Use the newer ZIP for deployment.

Packet Inspector for Windows 0.1.6+win.1 is a test prerelease with bounded cleartext HTTP/1 file-signature identification and more accurate Bearer, cookie, and JWT labels. It retains the 0.1.5 SMB2 zero-SessionId, VLAN capture, offline replay, and TCP keepalive fixes. PNG, JPEG, GIF, WebP, PDF, and ZIP findings contain observed type, bounded header metadata, and packet provenance, not file bodies; the independent raw capture ring is unchanged. Binary file bodies with verified signatures are excluded from credential-text scanning.

Native Windows validation passed 695 tests with 9 expected skips and 28 subtests. The deployment ZIP passed its external SHA-256 and all 91 internal checks, installed offline in a fresh environment, and replayed a real 12-packet Kali-to-Linode PNG capture with one high-confidence, correctly attributed finding and a complete verdict. In three synthetic benchmark runs, the authentication hot path was about 3% slower than the released 0.1.5 baseline, with the same 5,000 findings each run; this is not a live throughput guarantee.

Use the attached ZIP and SHA-256 file; GitHub's automatic source archive does not contain the offline wheel or launchers. File signatures prove only a prefix was seen, not that a complete transfer succeeded. This tracker does not classify encrypted, compressed, chunked, HTTP/2/3, or most multipart bodies. JWT signatures, issuers, and current validity are not checked. Physical-adapter capture and sustained traffic still require validation on the intended Windows sensor.

Packet Inspector Windows 0.1.5-win.1 (test release)

Packet Inspector for Windows 0.1.5+win.1 is a test prerelease of the Windows capture and viewer package. It includes the shared-engine SMB2 zero-SessionId NetNTLM correlation fix, lossless bounded offline replay, VLAN-aware default capture filter, protocol-label corrections, and the TCP keepalive overlap-warning fix.

The native Windows suite passed 670 tests with 9 expected skips and 28 subtests. Npcap VLAN and loopback checks passed; a fresh offline installation from this ZIP captured 12/12 synthetic loopback logins and replayed all 132 raw-ring packets with zero queue drops. The full GitHub regression workflow passed on Python 3.11 and 3.13.

Use the attached deployment ZIP and SHA-256 file. GitHub's automatic source archive does not include its offline wheel or launchers. Physical-adapter SMB/LDAP interception, sustained traffic, and the intended assessment mix still require validation on the target Windows sensor. Correctly encrypted payloads, including LDAPS and TLS, cannot be inspected without authorized decrypted traffic.

Packet Inspector Windows 0.1.4-win.1 (test release)

Windows test release of Packet Inspector, derived from the Linux 0.1.4 engine.

Download Packet-Inspector-Windows-0.1.4-win1.zip and its .zip.sha256 file from the assets below. The deployment ZIP includes Windows launchers, an offline-install wheel, source, documentation, and an internal SHA-256 manifest. GitHub's automatic source archives do not include the bundled wheel.

Start

1. Install 64-bit Python 3.11+, Wireshark/dumpcap, and Npcap separately.
2. Verify the ZIP checksum and extract the complete archive into a local folder controlled by your Windows account.
3. Run SETUP.cmd, then LIST-INTERFACES.cmd and START-PACKET-INSPECTOR.cmd. Explicitly select your authorized adapter.
4. The default dashboard binds to 127.0.0.1:8766 without a token. Press Ctrl+C once and wait for the final drain and verdict when stopping.

Use the current Windows guide for checksum verification, installation, replay, access controls, and build instructions. The Windows README provides an overview, and release notes describe this version. Documentation on main has been clarified since the original publication; the attached deployment ZIP and its checksum are unchanged.

Recorded validation — 16 September 2026

• 649 tests passed; 10 documented platform/backend skips.
• 200 separate synthetic loopback logins produced 200 findings; analyzer capture and raw-ring replay each counted 2,200 packets.
• Installed PowerShell launchers, endpoint display, loopback viewer, real console Ctrl+C, restricted exports, and offline replay passed.

This is a test prerelease. Physical Ethernet/Wi-Fi, live Windows SMB/LDAP, sustained load, and long-duration capture still require deployment-specific acceptance. See WINDOWS-VALIDATION.md and VALIDATION-REPORT.md. A healthy process or complete verdict does not establish universal detection or zero loss. Encrypted application payloads are not decrypted.

Original deployment ZIP SHA-256

2c4490c01b621439b8bb1b154fd4c108e58e992b1000130b329554294fbace28  Packet-Inspector-Windows-0.1.4-win1.zip