Packet Audit 0.1.10 test prerelease

Packet Audit 0.1.10 is a test prerelease for controlled internal assessments.

It adds bounded cleartext SOCKS5 and MQTT credential coverage; prevents recognizable TLS ciphertext from being reported as cleartext credentials; corrects a TDS false positive; adds an opt-in, accounting-safe forwarded-copy suppression for the tested forwarding path; raises default queue slots to 2,048; shows capture loss and backlog prominently; and ships Kali start/stop wrappers.

In an isolated 2× replay on the tested Kali host, all 214,883 expected frames matched the independent raw ring and all three synthetic credentials matched offline ground truth, with zero reported capture/analysis loss. This is a bounded qualification result, not a guarantee of lossless detection at every rate or visibility into encrypted traffic. Existing Kali configuration is preserved during installation, so apply the documented tuning deliberately.

See RELEASE.md, COVERAGE.md, RELIABILITY.md, and QUALIFICATION_2026-09-26.md in the source package for exact methods, limits, and deployment steps.

Packet Audit 0.1.9 test prerelease

Packet Audit 0.1.9 fixes a classification error in the payment-card candidate detector. In a preserved live-capture window, Luhn-valid HTTP byte offsets from Range and Content-Range headers were reported as possible card numbers. The detector now excludes only those numeric offset spans, retaining detection of card-shaped values in other headers and bodies. The earlier evidence is preserved unchanged.

Validation: 607 Kali tests passed. A clean Git pull built and passed wheel/source metadata checks; the detector bytes match in source, wheel and source archive. Strict replays of the 188-, 85,656- and 80,094-frame qualification captures passed their packet, finding, loss and performance gates. A 262-frame native Win11 HTTP NTLM/Negotiate, LDAP and SMB capture still produces the same 11 findings, with exact normalized event identity. In a separate 153,725-frame historical window, findings fell from 80 to 44: independent packet inspection places all 36 removed alerts in HTTP byte-range offsets, with none added. The historical replay remains incomplete for previously reported TCP/HTTP coverage limitations.

This remains a test prerelease. Card-shaped bytes in other binary traffic, including nine candidates inside TLS Certificate handshakes in that historical window, are unvalidated and should not be presented as card data without context. Encrypted application bodies, unsupported protocol variants, sustained zero-loss capture and universal credential coverage are not established. Monitor verdicts and the independent raw capture ring. See the release notes, coverage and reliability guide.

SHA256SUMS.txt covers the attached wheel and source archive.

Packet Inspector 0.1.8 - Kali/Linux test release

Packet Audit 0.1.8 corrects a live-capture shutdown verdict that could report complete while Linux libpcap had accepted more packets than the analyzer received. The final verdict now reconciles accepted, dropped, and captured packet counts; a mismatch or unavailable statistics marks the session incomplete and reports the unresolved difference. It does not label unread buffered packets as confirmed kernel drops. Offline replay is unchanged.

The issue surfaced during a controlled Win11-to-Linode 48 MiB transfer through Kali: an independent 82,788-frame capture and all 38 in-window findings matched replay, but the full-interface session stopped with 84,793 accepted and 84,763 analyzed packets. The 30-packet difference was not detected by 0.1.7's final verdict. A bounded live smoke test of the 0.1.8 wheel reproduced a 2-packet shutdown difference and correctly returned incomplete.

Validation: 602 Kali tests passed; source archive and wheel passed build and metadata checks; the exact supervisor source matched in both packages. A fresh wheel installation passed five readiness checks. Strict replays of the 188-frame qualification, 85,656-frame burst, and 80,094-frame live-repeat fixtures preserved expected findings and packet accounting. The 188-frame replay remains explicitly incomplete for one unsupported HTML response-body type. Finite burst qualification does not establish sustained zero-loss or universal protocol coverage.

Existing Kali configurations retain explicit queue settings. Back up and review /etc/packet-audit/packet-audit.toml before adopting the 0.1.7/0.1.8 queue defaults (1,024 batches and 128 MiB per worker). Keep the independent raw PCAP ring healthy. See release notes, coverage, and reliability.

SHA256SUMS.txt covers the wheel and source archive. This remains a test prerelease.

Packet Inspector 0.1.7 - Kali/Linux test release

Packet Audit 0.1.7 fixes a live analysis-queue loss exposed by a controlled Windows-to-external 48 MiB transfer. The capture path no longer queues a duplicate copy of each unfragmented TCP/UDP payload, and necessary HTTP/LDAP prefilters avoid expensive scans of unrelated binary bytes. The bounded defaults are now 1,024 batches and 128 MiB of captured bytes per worker, with clearer queue-pressure and capture-loop counters.

Validation: 598 Kali tests passed. A fresh wheel install passed readiness and the qualification replay. The exact release source passed strict replays of 188, 85,656 and 80,094 frames with zero analysis drops and expected findings. An isolated live run of the fixed build captured and dispatched 87,144 packets with zero reported capture/analysis drops, zero parser errors and a complete final verdict; all 40 test-flow findings matched an independent replay by detector and packet time.

Existing installations keep their explicit /etc/packet-audit/packet-audit.toml settings. Review and back up that file before adopting the new queue limits. This finite burst result does not establish sustained line-rate or universal protocol coverage: a long enough overload can still fill the bounded queue, which the tool marks incomplete. Keep the independent raw PCAP ring healthy and within its retention window. See release notes, coverage and reliability checks.

SHA256SUMS.txt covers both attached package files. This remains a test prerelease.

Packet Inspector 0.1.6 - Kali/Linux test release

Packet Audit 0.1.6 is a Kali/Linux test prerelease that adds bounded cleartext HTTP/1 file-signature identification and refines session-token labels. The detector reports PNG, JPEG, GIF, WebP, PDF, and ZIP prefixes in request or response bodies with packet provenance and bounded header metadata. It does not include the file body in the finding or change the independent raw PCAP ring. Verified binary bodies are excluded from credential-text scanning so incidental image bytes do not become false login findings.

Explicit short Bearer values are now observed. Generic cookies remain visible without being called confirmed sessions; recognizable session cookie names are candidates. Compact JWT-shaped values require bounded JSON structure for a high-confidence label. This does not verify signatures, issuer, account validity, or current usability.

The release retains the 0.1.5 SMB2 zero-SessionId, VLAN capture, offline replay, classification, and TCP keepalive fixes. File signatures establish only that a prefix was observed, not that a whole transfer completed. This tracker does not classify encrypted, compressed, chunked, HTTP/2/3, or most multipart bodies. See RELEASE.md, COVERAGE.md, and RELIABILITY.md for the full supported matrix and visible coverage limits.

Validation passed 595 Kali tests plus 28 subtests and the 21/21-case synthetic authentication verifier. The original SMB capture, Win11 HTTP matrix, and actual 12-packet PNG transfer replayed with expected findings and zero queue drops or stream gaps. After installation on the local Kali sensor, live PNG, Bearer/cookie/JWT-shaped markers, NXC SMB NetNTLMv2, and cleartext LDAP bind checks all produced the expected findings with complete packet provenance and zero reported capture drops. The 0.1.6 Basic-auth synthetic hot path was about 2% slower than 0.1.5 in three paired runs; this is a regression reference, not a live throughput guarantee.

Packet Inspector 0.1.5 - Kali/Linux test release

Packet Audit 0.1.5 is a Kali/Linux test prerelease. It fixes the SMB2 zero-SessionId correlation failure observed with NXC and Responder, preserves packets during bounded offline replay, admits recognized VLAN-tagged IP traffic with the default capture filter, ignores acknowledged one-byte TCP keepalive probes in overlap warnings, and tightens HTTP versus terminal credential labels.

Validation included 570 tests plus 28 subtests on Kali, a 21/21-case synthetic authentication replay, the original 10,592-packet NXC capture, live NXC-to-Responder SMB attempts, 19 live synthetic non-HTTP flows, and a Win11 browser flow intercepted through Kali. The original SMB capture and both new live SMB attempts produced canonical NetNTLMv2 findings. Tested replays had zero queue drops, stream gaps, or overlap conflicts.

This release identifies evidence visible in cleartext or in supported authentication exchanges. It cannot extract credentials inside correctly encrypted TLS, LDAPS, SSH, QUIC, or out-of-path traffic. Unsupported formats and incomplete coverage are reported rather than silently treated as a complete inspection. Review RELEASE.md, COVERAGE.md, and RELIABILITY.md before use. The source archive includes the Kali installer and service files; the wheel contains the Python engine only.

Packet Inspector 0.1.4 - Kali/Linux test release

Packet Inspector 0.1.4 for Kali/Debian Linux. This first packaged GitHub release includes the native capture integrity fix already committed on 16 September 2026.

Download

• packet_audit-0.1.4.tar.gz — source distribution with the Kali installer, systemd units, configuration, documentation and regression tests. Recommended for host installation.
• packet_audit-0.1.4-py3-none-any.whl — Python engine for a prepared environment; does not install host services, permissions or system dependencies.
• SHA256SUMS.txt — hashes for both attached packages.

Python 3.11+, Linux libpcap and Wireshark/dumpcap are required. The pinned pcapy-ng==1.1.0 dependency builds on the target Linux host and is not bundled in the wheel. Native Windows users should use the separate Windows project.

Download both package files and the manifest, then verify and install from the source distribution:

sha256sum -c SHA256SUMS.txt
tar -xzf packet_audit-0.1.4.tar.gz
cd packet_audit-0.1.4
sudo bash ./scripts/install-kali.sh

The installer prepares the host but does not start or enable capture. Follow the configuration and lifecycle guide.

Changes

• Bounded native next() reads prevent a callback-binding failure from consuming and silently skipping packets.
• Malformed capture records and callback count mismatches fail visibly.
• Native offline regressions verify packet bytes, timestamps, IDs and wire lengths across batch boundaries.
• Complete package metadata, release instructions, security reporting and contribution guidance.

Qualification

This is a test prerelease, not a claim of hardware qualification or lossless operation. Synthetic tests and native offline binding checks do not establish live NIC performance, sustained-load coverage, long-duration capture or systemd recovery on your host. Follow RELIABILITY.md and COVERAGE.md.

Correctly encrypted application traffic is not decrypted. Evidence can contain credentials and personal data; retain it privately. Existing deployments are not automatically upgraded by this release. Licensed under GPL-3.0-or-later.