Updates & Blogs

• Tickets: each ticket says which client wants to reach which server. The packet takes the colour of the client; the server wears the colour of the destination.
• Run & collect: collect a diamond to unlock a device, use the green spring pads to reach high ledges, and avoid bugs and sparks.
• Configure: open the unlocked device and fix it — routes and next hops, firewall rules, STP and port security, DNS records, masks, gateways, DHCP, MTU/MSS over an IPsec tunnel.
• Send: packets hop device by device. A drop shows the reason and the culprit; a hostile packet must be blocked.
• Capture: a Wireshark-style analyzer with filters and real hex helps in the later levels — the boss level gives no hints at all.

Every switch, router, firewall and server has a separate management port (Mgmt0) on a dedicated out-of-band (OOB) network — the dotted teal cables above the data cables. It is independent of production, so it keeps working when the data plane is broken. That is exactly why real networks have one.

At the start of every hall you find the NOC desk and the OOB switch. Press T (or E at the desk) and you get an SSH-style terminal: ssh R1, then a small Cisco-like CLI with modes, Tab completion, ? help, show running-config, ping and traceroute. The graphical consoles and the terminal share the same state — use whichever you like.

14 levels take you from missing static routes through firewalls, spanning tree, port security, TTL and routing loops, IPsec/MTU, DNS, subnet masks, DHCP and a fibre cut to a blind boss level.

Pet Networks (press P on the title screen) are random scenarios on four networks, from a Garage Lab to an Enterprise map: either a factory-blank network you design from scratch, or a running network that broke overnight — fix my network! One to three communications, hidden twists, an optional time limit.

• Dark, Light or System — Settings on the Mac and on Linux / Windows (Options on iPhone) lets you follow the desktop theme or force light or dark, whichever way your desktop is set.
• The Circle and the Infrastructure Map stay black; text, icons, lists and charts are adjusted so they stay readable in light mode.

• Type expert and a group or message into the search bar to find Expert findings without leaving the Circle; the Help page for the Circle explains the syntax.

• Connection card (Mac): a conversation with TCP quality, several sockets or Expert findings now uses the full height of the Circle and follows the window size.
• Linux / Windows footer: while a capture is read, the frame counter is on the bottom bar and Stop sits at the right, as on the Mac.
• About and Help text on Linux and Windows no longer says “this Mac”.

• Core and UI are now separate. Reading, dissection, analysis, TCP quality and Expert all live in one Rust core with no UI code in it.
• Mac and iOS: SwiftUI stays the interface. The Mac app already runs its analysis on the Rust core in this build (Apple silicon).
• Linux and Windows: one native app (Rust, egui) draws the same view models — it never re-implements the analysis. Linux ships today; Windows follows from the same code.
• The result: a fix or a new Expert rule is written once and shows up on every platform.

• Native desktop app for Ubuntu 24.04 (x86_64 download; the installer also supports aarch64); it also targets Fedora, Debian 13, Arch and openSUSE.
• Everything you know from the Mac: Circle with Hosts / Services / Infrastructure Map layouts, Conversation details with TCP session health and quality charts, Decode with display filter, Follow TCP Stream, Expert Alerts, Gauges with the quality timeline, Compare Conversations, Sanitize and PDF reports.
• Live capture from an interface and PCAP over IP; one-time capture permission with setcap, no need to run as root.
• Signed installer: a self-extracting .run that checks your machine, verifies the GPG signature and installs for you or for everyone (a .deb is included too). It comes as one .zip download with all the installers (.run, .deb, .tar.gz), checksums, signatures and a short readme.

• 600 MB capture, 1.2 million frames: 1 min 7 s before, 5 s now. Moving the analysis from Swift to Rust was the key.
• A conversation index makes connection details open instantly even on huge captures, and Decode jumps straight to the selected conversation wherever it sits in the file.
• Captures of 200 MB or more ask for Light or Full analysis; progress shows conversations, applications and frames found so far, with a Stop button. The footer reports how long the analysis took.

• New header with endpoint blocks (name, address, MAC, port), stat chips, a direction split bar and protocol pills; ports show their share of traffic.
• Application messages are drawn as a two-lifeline sequence diagram; identical neighbours collapse to ×N.
• Copy capture filter gives a BPF for the pair, narrowed to tcp port or udp port when a socket is selected.

• Jumbo / giant frames now count the bytes actually stored in the capture. A larger PCAP “original length” left by snaplen or Linux GRO/GSO is no longer a jumbo frame: a 1514-byte frame stays under the 1518 threshold. Decode still shows the claimed original length when it is larger.
• New Expert Alerts page (Mac) with Link, Network, Transport, Application and All tiles. Tiles include notes; the Circle chips still count warnings and errors only.
• Hide a finding for one conversation, or suppress the alert type — from the Expert tiles on Linux and the alert list on the Mac.

• Half-open SYN, service, FIN, Christmas-tree, NULL, ACK, UDP and User-Agent scans are raised as warnings on the connection band (L4+).
• An ARP sweep is raised on the network band (L3).
• Nmap is named when the time window and the volume match.
• The demo capture contains one Nmap SYN scan (ports 22, 80, 443, 8080) and one Christmas-tree scan (FIN+PSH+URG on ports 21, 23, 25, 110, 143) — open it and look at the Expert Alerts.

• Gauges are clickable: Hosts, Protocols and TCP health apply the matching Circle filter; problem conversations sit beside the quality timeline.
• Sanitize on save: Save and Save Session ask whether to scrub the capture first.
• Report logo: add your own PNG/JPEG to the PDF cover.
• Toolbar: Info always works (Capture details, or About when nothing is open), Help sits at the right, Close capture is a circled ×.
• Protocol legend folds away under the pairs list and remembers its state.

• PacketCircle Native stays free of charge and unlimited — no ads, no in-app purchases, no telemetry.
• It is not open source (yet). Everything is built with the GPL in mind, but after this complete re-architecture it is not published under GPL-2.0 today. I plan to release the sources as soon as I feel comfortable; if your organization wants to see them before that, just ask — there is no secret.
• The original PacketCircle Wireshark plugin is unchanged and remains open source (GPL-2.0).

• New third Circle layout: Hosts → Services → Map.
• Core / Distribution / Access drawing learned from STP, CDP, LLDP, OSPF, BGP, EIGRP, IS-IS, RIP and ARP in the capture — devices that never spoke in the trace are left out on purpose.
• Toggle L2 and L3 separately; STP root changes and topology-change signals appear as alerts above the map.
• Tap a switch or router to open its Session details.
• Don’t need it? Options → Circle → Show Infrastructure Map turns it off (Mac: Settings → General → Circle).

• Pick a socket (for example TCP 80) and the Expert list shows only that service’s findings, that socket’s TCP health, and host-wide network or link findings.
• A short note tells you when more findings sit on other sockets of the same conversation.
• New Other sockets list at the bottom of Session details: switch sockets in one tap, with a warning marker on the ones that have alerts. Whole conversation is one tap away.

• Circle (Mac Settings · iOS Options): show or hide the Expert Alerts strip, the Conversation quality bar, and the Map layout.
• Conversation details: show or hide Expert findings and TCP session quality panels. Services and decode always stay available.

• NetBIOS Name Service: queries, responses, name records and NBSTAT name tables — names also feed the host labels.
• NetBIOS Datagram and the Windows Browser protocol (\\MAILSLOT\\BROWSE host announcements, elections).
• Separate labels for NetBIOS-NS, NetBIOS-DGM and NetBIOS-SSN (ports 137–139).

• Kerberos findings only on Kerberos traffic (ports 88 / 464) — no more false alarms on unrelated TCP streams.
• Jumbo / giant frame findings based on the real on-wire frame size.
• Same finding on two services of one conversation (for example HTTP 404 on :80 and :8080) is now listed per socket.
• Mac: right-click a TCP reset (or another alert) → Treat as normal for this conversation; manage exceptions in Settings → Expert.

• Fixed a crash when decoding certain Windows Browser election packets.
• Reset always returns the Circle to the IP view, even after filtering on link-layer (DLC) alerts.
• Show host names is on by default for new installs.
• Services layout line thickness better reflects traffic volume.
• Mac: recent captures on the start screen use one clean line each.

• IGMP / MLD decode — group addresses, v1/v2/v3 queries and reports (source lists, INCLUDE/EXCLUDE), well-known multicast labels (SSDP, mDNS, all-systems).
• TLS on HTTP alt ports — HTTPS on 8080 / 80xx / 8888 is labeled TLS when the payload is a TLS record; plaintext HTTP on those ports stays HTTP.
• PCAP over IP (client) — connect to a remote classic-PCAP stream (TCP@host:57012), same idea as Wireshark -k -i TCP@host:port.
• Payload NetFlow / syslog — custom collector ports (e.g. UDP 515) classify from the datagram, not only IANA 2055/514.
• Richer mDNS — Bonjour service types, cache-flush / QU, additional A/AAAA.

• Live PCAP-over-IP no longer re-analyzes the whole file every second or re-packs the Circle ring.
• iOS remote-connect failures no longer look like a Files import error; invalid host/port is shown in the sheet.
• Options → PCAP over IP waits for Options to dismiss before presenting the connect sheet.

• Display filter next to text/hex search (Mac window and iPhone tab).
• Familiar syntax: tcp, tcp.port == 80, ip.addr == 10.0.0.1, http and tcp.flags.syn, contains, and/or/not.
• Autocomplete from PacketCircle’s catalog only. Unknown names (ospf, wlan, tcp.stream) turn the filter red and do not silently match.
• tcp.analysis.* for experts I raise myself: retransmission, spurious retransmission, ACKed unseen, zero window, duplicate ACK.

• ARP request storm (who-has burst per second) and ARP unanswered (retried who-has with no reply in the file).
• Experts on the Circle toolbar (after Top 10/25/50): show conversations with warn/error alerts, not only the busiest (cap 250). Solo an Expert Alerts band first to restrict the layer.
• Duplicate-IP, local routing / hairpin, ICMP, HTTP/TLS/apps, and TCP quality experts as before.

• New Expert messages section (Detailed + Field guide): type, description, counters, sample nodes/pairs.
• Per type: what triggered it, typical use, and when the finding can be informational — present in the capture without proving a connectivity or performance outage (SPAN duplicates, traceroute TTL=1, jumbo frames, one-sided unanswered ARP, HTTP 404, encrypted TLS alerts, and similar).

Sliders for thresholds that vary by LAN:

• ARP storm warning / error (who-has per second)
• Unanswered ARP retry count
• Giant-frame size (raise this on jumbo/storage fabrics)
• Endpoint retransmit % and zero-window count

ARP sliders apply immediately to Expert Alerts and the report. Giant-frame size applies the next time the capture is analyzed.

• ICMPv6 Neighbor Solicitation no longer shows as a UUID-looking source to solicited-node multicast; DAD self-pairs are omitted.
• IP communication-matrix legend uses the same volume coloring as the chords (teal → red).
• Recent captures and drag-and-drop open on Mac.