Acorn application guide

PCAP Analyser

Review the detail behind a network lead. The supplied example separates readable HTTP material and TLS names from encrypted content the capture does not disclose.

Demonstrated on constructed training data

What cleartext protocol information and timing leads are present in this offline capture?

Start with

A constructed packet capture with DNS, unencrypted HTTP and a TLS ClientHello.

What you can take away

Demonstrated protocol-detail views, HTTP objects and a report; extracted strings remain unvalidated leads.

The unchanged PCAP Analyser report records 23 constructed packets, 13 exported HTTP objects, 12 password-adjacent strings and one timing-based beaconing candidate. These outputs are investigative leads from an offline training capture.

Open the screenshot and choose “View actual size” to read the records at their original resolution.

A practical starting point

How the workflow fits together.

Select the capture and inspect available protocol summaries.
Review DNS names, HTTP objects and TLS server-name metadata in context.
Check extraction limits and corroborate timing or string-based leads before reporting.

Useful next steps

Start with your requirements

Bring a sample question.

Ask us to demonstrate this workflow with suitable public or constructed material. Do not send confidential evidence in an initial enquiry.

Planned for Q1 2027

Be first to hear. Save 10% at launch.

Request Acorn launch news and details of the planned 10% offer. No deposit or purchase commitment.

Notify me at launch ↗

Launch-update requests go to the SQFR team for review. Final offer terms and product availability are still to be confirmed.

About the screenshots and illustrations

Application screens are selected from the September 2026 Acorn screenshot pack. Captions distinguish native setup views, constructed training records and public-corpus results. They are not private client cases, and a displayed control does not establish that every operation was completed.

Relevant public sources include DeepBlueCLI training event logs and Plaso test data. Check the relevant source terms before redistributing an underlying dataset.

Workspace scenes and sector mascot variants are generated illustrations. They do not show actual police, judicial, military or university deployments or endorsements. The original Squirrel Forensics identity is retained.