PCAP Forensics
Evidence from before
the attack started.
Most capture tools start recording when detection fires. By then you've missed the first wave. Flowtriq runs a 1,000-packet pre-attack ring buffer continuously. When an incident opens, that buffer becomes the first section of your PCAP: traffic from before the threshold was crossed.
How It Works
The ring buffer captures what others miss
The FTAgent runs a continuous circular ring buffer that holds the last 1,000 packets seen on the monitored interface. It uses libpcap in non-blocking mode with a small per-packet overhead, keeping CPU impact under 0.5% on any modern server.
The moment detection fires, the ring buffer is frozen and flushed to disk as the opening section of a .pcap file. From that point, live capture continues until the incident resolves or 10,000 total packets are captured (whichever comes first).
On incident resolution, the complete PCAP is uploaded to Flowtriq's secure storage. You get a signed download URL valid for 15 minutes, directly from the incident page. Files are retained for 7 days (365 days on Enterprise).
In-Browser Packet Inspector
Inspect individual packets directly in the dashboard
Flowtriq includes a built-in packet viewer and packet inspector that lets you drill down into captured traffic without downloading the PCAP file. Filter by source IP, destination port, protocol, or payload pattern directly in the browser.
The packet drill-down view shows header details, payload previews, and timing for each captured packet. Identify attack signatures, verify source IPs, and understand traffic composition without leaving the Flowtriq dashboard. No download required.
- Filter by source IP, destination IP, port, or protocol
- Payload pattern search across captured packets
- Per-packet header breakdown with timing data
- Sort and paginate through thousands of packets
- Export filtered results or download the full PCAP for Wireshark
No Time Source Dst Port Proto Len
1 0.000s 192.0.2.14 53 UDP 512
2 0.001s 198.51.100.3 53 UDP 512
3 0.001s 203.0.113.88 53 UDP 512
4 0.002s 192.0.2.201 53 UDP 480
Showing 4 of 847 matching packets
Pattern: DNS amplification (ANY query)
Retention & Access
Plans and retention periods
| Plan | Retention | Max file size | Download method |
|---|---|---|---|
| Per Node / Flow Source | 7 days | Unlimited | Signed URL · Console · API |
| Enterprise | Up to 365 days | Unlimited | Signed URL · Console · API · S3 export |
All PCAPs are stored encrypted at rest. Signed download URLs expire after 15 minutes. New URLs can be generated from the incident page at any time within the retention window.
- Encrypted at rest: AES-256 in Flowtriq's secure object storage
- Signed download URLs valid for 15 minutes, regenerable from Console
- Every PCAP download is logged in the tamper-evident audit trail
- Compatible with Wireshark, tcpdump, Zeek, Suricata, and all standard tools
- Enterprise: S3-compatible export to your own bucket for long-term archival
FAQ
Common questions about PCAP
Does running the ring buffer affect my server's performance?
The pre-attack ring buffer uses libpcap in a separate thread with low-priority CPU scheduling. On a modern server, overhead is under 0.5% CPU and approximately 2-4 MB of RAM for the 1,000-packet buffer. It does not intercept or delay traffic in any way; it's a passive read-only capture.
What happens if the attack lasts longer than 10,000 packets?
The PCAP cap is a safety limit to prevent runaway disk usage during very long floods. The captured 10,000 packets (including the pre-attack buffer) contain more than enough forensic data to identify the attack source, type, and tooling. The incident remains open and statistics continue to be reported even after the packet cap is hit.
Can I upload a PCAP for analysis without an active attack?
Yes. You can create a manual incident from the Console and upload your own PCAP file for analysis. Uploaded PCAPs are stored and retained the same way as automatically captured incident PCAPs, and are accessible from the incident detail page with signed download URLs.
Does PCAP capture work on virtual machines and containers?
Yes, provided the FTAgent has permission to open a raw socket (typically CAP_NET_RAW capability or root). On containers, this usually means running with --cap-add NET_RAW. The agent will warn on startup if it doesn't have sufficient privileges for PCAP and will fall back to statistics-only mode.
Is there a file size limit for PCAP captures?
There is no hard file size limit. The capture is bounded by the 10,000-packet cap per incident, which typically produces files between 5 and 50 MB depending on packet sizes. Storage is unlimited on all plans.
Can I trigger a manual PCAP capture without an active attack?
Yes. You can start an on-demand capture from the node detail page in the dashboard. Manual captures use the same 10,000-packet limit and are stored with the same retention and download options as incident-triggered PCAPs.
What happens if an attack is too short for the ring buffer to matter?
Short attacks are exactly where the ring buffer is most valuable. If an attack lasts only a few hundred packets, the 1,000-packet pre-attack buffer often contains more data than the attack itself, giving you full context on what traffic looked like before and during the burst.
Can I download PCAPs programmatically via the API?
Yes. The REST API exposes a PCAP download endpoint per incident. You receive the same signed 15-minute URL that the dashboard generates. This makes it easy to automate PCAP retrieval into your SIEM, forensic tooling, or archival pipeline.
Related Features
PCAP works with every feature
FAQ