Skip to content

v0.10.0

Choose a tag to compare

View all tags
@dreadl0ck dreadl0ck released this 04 Oct 19:49
· 98 commits to master since this release
v0.10.0
54d9dff

⚠️ Breaking change: vulnerability database format

Vulnerability and exploit lookups now read netcap.sqlite (SQLite + FTS5) instead of nvd.bleve and exploit-db.bleve.(https://github.com/dreadl0ck/netcap/blob/v0.10.0/internal/vulndb/SCHEMA.md).

  • Run net util -download-dbs after upgrading. v0.10 fetches layout 2 from https://dbs.netcap.io/dbs/v2/ and verifies its sha256.
  • netcap < v0.10 keeps working against https://dbs.netcap.io/dbs/latest, which now serves a frozen bleve revision and is no longer rebuilt.
  • Old *.bleve directories are no longer read and can be deleted (nvd.bleve alone was 4.1 GB; netcap.sqlite is 299 MB).
  • Lookup results differ slightly: bleve's score thresholds are gone, every hit matches all terms, results are capped at 10 ordered by bm25.
  • net util -index now takes any value (e.g. -index all) and rebuilds netcap.sqlite from the downloaded feeds.

The database server also stopped publishing a tarball that contained a copy of itself, now ships the NVD index it previously only downloaded, and publishes a new revision only after netcap.sqlite was built.

📦 Available Builds

Build OS Architecture DPI Support Description
netcap-v0.10.0-darwin-arm64 macOS ARM64 ✅ Yes Full DPI support with nDPI
netcap-v0.10.0-linux-amd64-libc Linux AMD64 ✅ Yes glibc-based with DPI
netcap-v0.10.0-linux-amd64-musl Linux AMD64 ✅ Yes musl-based with DPI (Alpine)
netcap-nodpi-v0.10.0-darwin-arm64 macOS ARM64 ❌ No Static build, no DPI
netcap-nodpi-v0.10.0-linux-amd64-libc Linux AMD64 ❌ No glibc-based, no DPI
netcap-nodpi-v0.10.0-linux-amd64-musl Linux AMD64 ❌ No musl-based, no DPI
netcap-nodpi-v0.10.0-windows-amd64 Windows AMD64 ❌ No Windows build

🔍 Choosing the Right Build

  • With DPI (netcap-*): Choose if you need Deep Packet Inspection features (protocol classification, application detection)
  • Without DPI (netcap-nodpi-*): Choose for basic packet capture and analysis, smaller binary size
  • libc vs musl: Use libc for standard Linux distros (Ubuntu, Debian, CentOS). Use musl for Alpine Linux or minimal containers

Installing on macOS via homebrew

Builds distributed via homebrew are built with DPI support.
You need to install the libprotoident and ndpi libraries via homebrew.

  $ brew install libprotoident ndpi
  $ brew tap dreadl0ck/formulas
  $ brew install netcap

Afterwards try running 'net' in your terminal.

📚 Documentation

⚠️ Notes

  • On macOS/Linux, you may need to grant necessary permissions: sudo chmod +x net
  • Live capture requires root/administrator privileges
  • Verify checksums with checksums.txt before use

Changelog

  • 474bcc8 Fix categorical sankey stack overflow that killed the server; netcap-ui 0.9.7 uses GridLegacy so MUI 7 lays out item/xs grids at full width
  • 54d9dff Refresh license bundle after the MUI 7 migration
  • c4969ca Replace bleve vulnerability indexes with a shared netcap.sqlite
  • 26a6df9 netcap-ui 0.9.6: header actions shrink instead of overlapping, content starts below the measured app bar, full-width pages, native fullscreen adapter
  • 8c41262 v0.10.0 release

Full Changelog: v0.9.15...v0.10.0

Assets 11
Loading