PacketSnitch Documentation Guide

Welcome to the PacketSnitch documentation. PacketSnitch is a desktop packet capture analysis tool with a Python Scapy backend and NodeJS/Electron frontend. Use the links below to dive into each area of the project, or check the Features list and FAQ first.

Reference

• Backend Documentation — Python backend (snitch.py) plus the Electron bridge HTTP service mode: usage, arguments, output structure, transport modes, and searchable attributes. Covers credential extraction from PCAPs, threat intelligence from network captures, and GeoIP enrichment of every packet.
• Frontend Documentation — Electron frontend: UI workspaces, worldmap/heatmap, PGP tooling, settings, LLM-powered network analysis flows, and bridge controls.
• Decoder Reference — Modular protocol decoders: the DECODER_SPEC contract, auto-detection hints, bundled and user drop-in locations, permissiveness rules, and authoring guidance.
• Plugins Documentation — Combined Themes + Plugins reference: theme engine schema plus complete plugin engine tutorial and hello-snitch sample code.
• Filter Reference — Complete guide to the filter bar: all filter keys, search syntax, operators, boolean combinators, and examples.
• Context Menu Reference — Right-click context menu: copy, convert, filter, keystore, notes, and export options.

More

• Features — the full feature list across backend and frontend.
• FAQ — frequently asked questions about installation, building, LLM/Ollama, plugins, licensing, and privacy.
• Overview / Quick Start — what PacketSnitch is and how to get it running.