Skip to content

v0.9.13

Choose a tag to compare

View all tags
@dreadl0ck dreadl0ck released this 24 Sep 21:53
· 121 commits to master since this release
v0.9.13
9e91ddc

📦 Available Builds

Build OS Architecture DPI Support Description
netcap-v0.9.13-darwin-arm64 macOS ARM64 ✅ Yes Full DPI support with nDPI
netcap-v0.9.13-linux-amd64-libc Linux AMD64 ✅ Yes glibc-based with DPI
netcap-v0.9.13-linux-amd64-musl Linux AMD64 ✅ Yes musl-based with DPI (Alpine)
netcap-nodpi-v0.9.13-darwin-arm64 macOS ARM64 ❌ No Static build, no DPI
netcap-nodpi-v0.9.13-linux-amd64-libc Linux AMD64 ❌ No glibc-based, no DPI
netcap-nodpi-v0.9.13-linux-amd64-musl Linux AMD64 ❌ No musl-based, no DPI
netcap-nodpi-v0.9.13-windows-amd64 Windows AMD64 ❌ No Windows build

🔍 Choosing the Right Build

  • With DPI (netcap-*): Choose if you need Deep Packet Inspection features (protocol classification, application detection)
  • Without DPI (netcap-nodpi-*): Choose for basic packet capture and analysis, smaller binary size
  • libc vs musl: Use libc for standard Linux distros (Ubuntu, Debian, CentOS). Use musl for Alpine Linux or minimal containers

Installing on macOS via homebrew

Builds distributed via homebrew are built with DPI support.
You need to install the libprotoident and ndpi libraries via homebrew.

  $ brew install libprotoident ndpi
  $ brew tap dreadl0ck/formulas
  $ brew install netcap

Afterwards try running 'net' in your terminal.

📚 Documentation

⚠️ Notes

  • On macOS/Linux, you may need to grant necessary permissions: sudo chmod +x net
  • Live capture requires root/administrator privileges
  • Verify checksums with checksums.txt before use

Changelog

  • f98841e Claim midstream conversations again: detection was run on zero bytes
  • 9126800 Correct the record on f98841e, and document how decoder selection can fail
  • 75534c1 Decode selection existed twice, and the two copies had drifted
  • d41c9cd Fix the DNP3-SA framing in the IEC 62351 reader, and stop guessing at objects
  • c768814 Fix three CodeQL alerts: two quadratic regexes and an unrestricted GITHUB_TOKEN
  • 82c5a84 Fix two misspellings in the QUIC confidence comment
  • 5c30474 Give IEC 62351 records their own time and direction, on all four paths
  • 4f7a52c Give records their own timestamp and the direction they travelled in
  • e0c77f6 Measure the timestamp and direction defects across every reader
  • 11f7435 Measure which decoder claims which protocol, for all 29
  • 86c5600 Pick the decoder that required the most evidence, not the one with the low port
  • 6638eff Rank a guessed QUIC header below a structural one, and restore protobuf over UDP
  • 145f5bb Repair GitHub links broken by the relayout, and three that predate it
  • ffcdecb Report every stream decoder in util -decoders, and drop the dead Modbus layer
  • cbca611 Rewrite the DNP3 decoder: it was reporting frames and objects nobody sent
  • 4ad2019 Stop four decoders claiming ICS traffic they cannot parse
  • a671d8f Stop parseDNP3SAObject restating the name table it is handed
  • a299dee Timestamp each FTP, IMAP and IRC message from the packet that carried it
  • 08115d7 Timestamp each HTTP request and response, not each connection
  • 7e47da3 Validate the whole TACACS+ and SSH signatures, and test the confusable cases
  • c767d38 netcap-ui 0.9.5
  • 9e91ddc v0.9.13 release

Full Changelog: v0.9.12...v0.9.13

Assets 6
Loading