Frequently Asked Questions

Welcome to the PacketSnitch FAQ. If your question isn’t answered here, reach out to Marshall Whittaker — see the Contact block at the bottom of this page. You can also browse the full Documentation, the Features list, or the Downloads page.

Table of Contents

General

What is PacketSnitch?

PacketSnitch is a desktop packet capture analysis tool that transforms packet captures (.pcap/.pcapng) into searchable, protocol-aware intelligence. It helps security professionals, developers, and researchers rapidly uncover hosts, credentials, certificates, files, locations, protocols, anomalies, threat-intel hits, and other actionable insights. See the Overview and Features pages.

Who is PacketSnitch for?

Security analysts, incident responders, forensics engineers, developers debugging networked applications, CTF players, and researchers who need to slice through large captures without writing one-off tshark/scapy scripts every time.

How is it different from Wireshark?

Wireshark is a brilliant line-by-line packet browser. PacketSnitch focuses on extracted intelligence — carved files, credential extraction from PCAPs, certificates, keystroke timing, GeoIP enrichment, threat-intel scoring, and LLM summaries — surfaced in purpose-built workspaces (Stats, List, Conv, Crypt, Keystore, Notes). Many users keep it open alongside Wireshark as a Wireshark alternative desktop app focused on the intelligence layer rather than the frames themselves.

Installation & Platforms

What platforms are supported?

Pre-built installers are published for Windows 10/11 (.exe Squirrel installer) and Linux (.deb for Kali/Debian/Ubuntu and .rpm for CentOS/Red Hat/Fedora). macOS is not currently shipped as a signed installer — see Building from Source for running on macOS.

Where do I download it?

From the GitHub releases page. The download bar at the top of every page on this site also links to the latest release for each platform.

How do I install on Linux?

sudo dnf install ./out/make/*/packetsnitch-*.rpm   # redhat/centos/fedora
sudo apt install ./out/make/*/packetsnitch-*.deb   # debian/kali/ubuntu

On Fedora specifically, run npm run patch-rpm-build before packaging so the RPM payload is laid out correctly. See the Quick Start on the home page.

How do I install on Windows?

Run PacketSnitchInstaller.exe. The installer uses Squirrel for Windows and will create Start Menu shortcuts automatically.

Building from Source

What are the build dependencies?

  • Node.js (with npm)
  • Python 3 (for the backend — see src/backend/requirements.txt)
  • npm install from the repo root, then npm run make.

Full step-by-step instructions are on the home page Quick Start.

Do I need to rebuild the backend after editing Python?

Yes. Python sources are not hot-reloaded. After editing anything under src/backend/**/*.py, run npm run build:backend before npm start.

Captures & Protocols

What capture formats are supported?

Both classic .pcap and .pcapng. See the backend documentation for the full protocol decoder list.

Can PacketSnitch decrypt traffic?

Yes — the Crypt tab supports 802.11 (Wi-Fi) CCMP/TKIP decryption when you supply the right keys, plus TLS certificate inspection. See the backend docs for details.

Where can I get sample captures?

The repo ships a few under samples/. The Wireshark Sample Captures page is also a great resource. A few curated links are on the home page.

LLM / Ollama Integration

Do I need an LLM to use PacketSnitch?

No. Ollama is optional. If the ollama npm package or a local server isn’t present, LLM features silently disable rather than crashing the GUI.

What models are supported?

Any model your local Ollama daemon can serve, plus cloud models served through ollama.com (model names ending in :cloud, such as the shipped default minimax-m3:cloud). Cloud calls use settings.apiKeys.ollamaApiKey.

Where are LLM settings stored?

Under settings.llm and settings.apiKeys — see the frontend docs and the Settings tab in the app.

Themes & Plugins

How do themes work?

Themes are JSON files loaded under Settings → Themes. The in-app sub-tab shows a 400×250 preview of every installed theme plus a catalog of paid themes. See the plugins & themes documentation.

How do I write a plugin?

Plugins are declared with a capabilities manifest and can be packaged as a .zip and installed under Settings → Plugins. A complete tutorial with a hello-snitch sample is in the plugins reference.

Licensing & Store

Is PacketSnitch free?

The core app is distributable under the EULA. Paid themes and the catalog are available through the store.

Where can I buy themes?

From the PacketSnitch store, hosted on the catalog server. Theme installation is handled entirely inside the app.

What is the refund policy?

See the Refund Policy.

Privacy

Does PacketSnitch phone home?

Metrics are anonymous and keyed by a stable install ID; you can opt out in Settings. See the Privacy Policy for the full details.

Are captures uploaded anywhere?

No. Captures are parsed locally by the bundled Python backend. The only network egress is the optional LLM calls (to your local Ollama daemon or ollama.com for cloud models), the optional threat-intel lookups, and the anonymous metrics transport.

Contact

Questions, bug reports, and contributions are welcome.

You can also follow along with development on the Oxasploits blog.