Documentation
Packet capture summaries
Summarize a saved pcap or pcapng file’s endpoints, DNS questions and addresses, TLS SNI, protocol stacks and HTTP URIs into paged Evidence views. It does not capture traffic or fetch recorded targets.
Requirements and limitations
- Caller-supplied Wireshark 4.x tshark and capinfos. Capture inspection needs Linux with util-linux prlimit or Windows Job Objects; macOS reports a capability gap. Listed in the rea-agents 6.5.0 release notes.
- Upstream’s current verification used Linux, Node 24.18.0 and Wireshark 4.0.17; actual Windows execution is unverified. Summaries do not establish decrypted payloads, process identity or the absence of unrecorded traffic.
About this entry
- Type
- Documentation
- Category
- Official REA: investigation guides
- Relationship
- Official REA documentation
- Targets
- Protocol
Sources reviewed
The description was reviewed against primary sources. This does not establish runtime testing, security auditing or verified compatibility.