Documentation
Recorded packet capture inspection
Select TShark fields, display filters and decode-as rules over an existing network, USB or Bluetooth capture, and look up installed field names. It does not capture traffic, open an interface or control a device.
Requirements and limitations
- Caller-supplied TShark 4.x on Linux with util-linux prlimit; macOS and Windows hosts are refused before inspection. Listed in the rea-agents 6.5.0 release notes.
- Dissector output describes the selected recording, not verified device behavior. Upstream fixtures are generated Ethernet/UDP/DNS and Bluetooth HCI PCAPs; PCAPNG, USB, BLE ATT and physical capture are not established by them.
About this entry
- Type
- Documentation
- Category
- Official REA: investigation guides
- Relationship
- Official REA documentation
- Targets
- Protocol
Sources reviewed
The description was reviewed against primary sources. This does not establish runtime testing, security auditing or verified compatibility.