The Acorn application guide

PCAP Analyser

A 23-packet training capture produced HTTP objects, password-adjacent strings and a timing-based beaconing candidate. Inspect those leads against the packets. Readable TLS server names do not mean the encrypted content was recovered.

Constructed test example

Review extracted objects and network leads

Example input

A constructed packet capture with DNS, unencrypted HTTP and a TLS ClientHello.

Result or controls shown

Demonstrated protocol-detail views, HTTP objects and a report; extracted strings remain unvalidated leads.

The unchanged PCAP Analyser report records 23 constructed packets, 13 exported HTTP objects, 12 password-adjacent strings and one timing-based beaconing candidate. These outputs are investigative leads from an offline training capture.

Enlarge the screenshot to read the source records.

Examination steps

Steps to review in your evaluation

Select the capture and inspect available protocol summaries.
Review DNS names, HTTP objects and TLS server-name metadata in context.
Check extraction limits and corroborate timing or string-based leads before reporting.

Related application guides

Start with your requirements

Request an application demo

Tell us the source type and task you want to examine. We can plan a demo using suitable training material. Do not send confidential evidence.