Live Packet Capture

Capture from any local interface in real time. Available on every tier — Community, Professional, Team, and Enterprise / MSSP. The same pipeline runs incrementally on the captured stream.

Quick start

1. Open the Live Capture view from the sidebar (or Ctrl/Cmd + 7).
2. Pick an interface from the dropdown.
3. (Optional) set a BPF capture filter (tcp port 80 or udp port 53).
4. Click Start. Packets stream in; the pipeline runs incrementally.
5. Click Stop when done. The capture is saved as a session and a .pcap file under your data directory.

macOS

BPF permissions

macOS gates raw packet access through Berkeley Packet Filter (BPF) devices at /dev/bpf*. Without the right permissions, capture fails with permission denied.

The Intreys .pkg installer registers ChmodBPF, a small launchd job (label com.cybershelt.intreys.ChmodBPF) that on every boot grants the access_bpf group read+write on /dev/bpf* (mode 660). The read+write mode is what libpcap needs to set BPF capture filters and to enable promiscuous mode. After install, log out and back in so the new access_bpf group membership takes effect.

Verifying ChmodBPF

# Check that the Intreys ChmodBPF LaunchDaemon is loaded
sudo launchctl list | grep com.cybershelt.intreys.ChmodBPF
# Expected: a line with com.cybershelt.intreys.ChmodBPF

# Check that you're in the access_bpf group
groups
# Expected: access_bpf appears in your groups

# Check device permissions
ls -l /dev/bpf0
# Expected: crw-rw----  1 root  access_bpf  ...

If the ChmodBPF helper isn't installed

Re-run the .pkg installer (Intreys_*_aarch64.pkg) — its postinstall script is idempotent and will recreate the group, the LaunchDaemon, and the user membership. The unsigned .dmg does not include the helper.

macOS support

v1.0.0 ships an Apple Silicon (ARM64) build only — Intreys_*_aarch64.dmg and Intreys_*_aarch64.pkg. Run uname -m to confirm arm64. Intel Macs (x86_64) are not supported in v1.0.0.

Windows 10/11

Npcap

Live capture on Windows requires Npcap (NDIS-based packet capture driver). Intreys installer bundles Npcap and installs it if not present, in WinPcap-compatible mode.

Verifying Npcap

sc query npcap
:: Expected: STATE = 4 RUNNING

Loopback capture

Npcap supports loopback capture via the “Npcap Loopback Adapter”. Enable during install or via the Npcap installer.

Common Windows issues

• “No interfaces found” — Npcap not installed or service stopped. Re-run the Intreys installer.
• Permission denied — on a domain-managed Windows install, an admin may need to add your user to the Network Configuration Operators group, or the Npcap service must be set to start as NetworkService.
• Wireshark conflict — if Wireshark is also installed and using Npcap, both apps can capture simultaneously without conflict.

Linux

libpcap and capabilities

Linux capture uses libpcap. Without elevated privileges, opening a raw socket fails. The .deb postinst sets cap_net_raw on the capture binary so live capture works without sudo:

sudo setcap cap_net_raw,cap_net_admin=eip /usr/bin/intreys-capture

Verifying capabilities

getcap /usr/bin/intreys-capture
# Expected: /usr/bin/intreys-capture cap_net_admin,cap_net_raw=eip

AppImage (portable)

The portable .AppImage does not install a system package, so it cannot grant capabilities at install time. Run the setcap command above against the extracted capture helper, or launch with elevated privileges for live capture.

Docker

To capture from inside a container, run with --cap-add NET_RAW --cap-add NET_ADMIN and --net=host:

Build the image first from the included Dockerfile (tagged intreys:local below); Intreys does not publish a prebuilt image for v1.0.0.

docker run --cap-add NET_RAW --cap-add NET_ADMIN --net=host \
  -p 8765:8765 intreys:local

Capture filters (BPF syntax)

Capture filters use BPF/tcpdump syntax (different from display filters):

# Only HTTP traffic
tcp port 80

# DNS only
udp port 53

# Traffic to/from a specific host
host 192.168.1.42

# All except local management
not (port 22 or port 3389)

# ICS / Modbus
tcp port 502

Troubleshooting

“Permission denied”

• macOS: log out and back in after install. Verify ChmodBPF.
• Windows: verify Npcap is running. Re-run installer.
• Linux: run getcap on the capture binary; re-apply setcap if missing.

“No interfaces listed”

• Refresh the dropdown. Some interfaces appear/disappear with VPN or USB-Ethernet.
• Run as a non-restricted user (capture access depends on group membership).

Drops in the capture

• Tighten the capture filter so the kernel drops uninteresting packets early.
• Reduce snap length under Settings → Capture → Snap length (default 65535).
• On macOS, increase BPF buffer: sudo sysctl -w debug.bpf_bufsize=8388608.

VLAN tags missing

Some NICs strip VLAN tags before they reach BPF/Npcap. Check NIC driver settings to disable VLAN offload.

Where captures are stored