PCAP Search
Search across your library, shared captures, and any public archive exposed by your deployment from one bar.
What the search bar matches
- Names and metadata. Capture name, description, owner, file size, timestamps, SHA hashes.
- Tags and comments.
tagname: incidentor a free-text keyword in comments. - DNS and TLS. Queries, responses, and SNI values (e.g.,
dns.qry.name:example.com). - Prepared protocol fields. Depending on what background processing has already prepared for that capture, the library can also accept protocol-oriented filters such as
ip.addr == 10.0.0.5orudp.port == 53.
Use the Search tips dialog for examples.
Examples
- Capture name:
origname:"fast-open.pcapng" - Owner:
username:alice - Tags:
tagname:malware - Size or bitrate:
filesize:[90000 TO *]ordatabitrate:[1000 TO *] - DNS/SNI:
dns.qry.name:api.example.comortls.handshake.extensions_server_name:*.cloudflare.com - Protocol filters:
ip.proto == 1,udp.port == 53,tcp.port == 443
When a packet-oriented filter is available, the table can show how many packets in each capture match. Click Show matches to open those packets directly.
Tips and caveats
- Search coverage depends on background processing having finished for that capture.
- If a field is missing right after upload, wait for processing to complete and refresh the view.
- Always compare to a value in the PCAP list (e.g.,
tcp.analysis.flags == 1instead of justtcp). - Replace characters like
:with wildcards if needed:eth.src == "00\\:07\\:50*"; IPv6 addresses work with full strings or prefixes.